3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A security analyst notices that a user's endpoint is making repeated connections to a cloud storage service that the company does not use. The EDR flags the process as benign because it is a legitimate system utility. However, the analyst suspects data exfiltration because the volume of data transferred is unusually high. Which Cortex XDR capability would help confirm this suspicion?

   • ACorrelating the endpoint process activity with network traffic logs to identify the volume and destination of the data transfer
   • BUsing the EDR's built-in application control to block the system utility from making any network connections
   • CReviewing the cloud provider's access logs to see if the user has permissions to the storage service
   • DChecking the endpoint's local firewall logs to see if the connection was allowed
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In which scenario would Cortex XDR's cross-data analytics be more beneficial than an EDR's endpoint-only approach?

   • AWhen an attacker uses a compromised endpoint to access a cloud application and then exfiltrates data via network traffic
   • BWhen an organization has no cloud or network visibility requirements
   • CWhen a single endpoint is infected with a known malware variant
   • DWhen an organization needs to monitor only on-premises servers
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which capability is a defining characteristic of Cortex XDR that is not typically found in traditional EDR?

   • AOn-premises management console
   • BSignature-based malware detection
   • CCross-source data correlation across endpoints, network, and cloud
   • DReal-time endpoint antivirus scanning
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A mid-sized company currently uses three separate security products: an EDR for endpoints, a network traffic analysis tool, and a cloud security posture management (CSPM) solution for their AWS environment. The security team spends significant time manually correlating alerts across these tools to investigate incidents. They are evaluating Cortex XDR to consolidate. Which benefit is most directly aligned with this goal?

   • ACortex XDR automatically patches all vulnerabilities across endpoints and cloud workloads
   • BCortex XDR replaces the need for any other security product, including firewalls and identity management
   • CCortex XDR's agent can be installed on network switches to replace the network traffic analysis tool
   • DCortex XDR provides a single console to view and investigate alerts from endpoints, network, and cloud, reducing the need to switch between tools
   Reveal Solution Discussion Select an answer first