3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A financial services company must comply with PCI DSS, which requires them to monitor and log all access to cardholder data environments. They currently use an EDR that logs endpoint activity but does not capture network traffic or cloud storage access. The compliance team needs to provide evidence that they have visibility into all relevant systems. Which Cortex XDR capability would best support this compliance requirement?

   • AIntegration with the EDR's existing logs to create a single report for all compliance needs
   • BA built-in PCI DSS scanner that automatically generates compliance reports without any configuration
   • CAutomated deletion of cardholder data from endpoints to reduce the scope of compliance
   • DCentralized logging and reporting that includes endpoint, network, and cloud activity, providing a comprehensive audit trail
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is a key advantage of Cortex XDR's orchestration capabilities over traditional EDR?

   • AIt can perform forensic analysis without any human input.
   • BIt can trigger response actions in integrated third-party tools, such as blocking a user in a cloud identity provider.
   • CIt can automatically patch all vulnerabilities on endpoints.
   • DIt can replace the need for a SIEM.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which data source is typically included in Cortex XDR's visibility but NOT in a traditional EDR?

   • AFile system changes on endpoints
   • BCloud workload activity
   • CEndpoint process execution
   • DRegistry key modifications
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In which situation does Cortex XDR's automated response provide an advantage over manual EDR responses?

   • AWhen the organization has no playbooks defined.
   • BWhen the organization has a small number of endpoints and a large security team.
   • CWhen a threat is detected and requires immediate containment actions across multiple endpoints and network devices.
   • DWhen the organization prefers to have analysts manually review every alert.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a benefit of Cortex XDR's unified incident management compared to EDR?

   • AAnalysts can investigate and respond to threats without switching between multiple security tools.
   • BIt only works with Palo Alto Networks firewalls.
   • CIt eliminates the need for any manual investigation.
   • DIt guarantees zero false positives.
   Reveal Solution Discussion Select an answer first