3.6 Demonstrate Understanding of Cortex XDR Dashboards and Reports XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC manager wants to see a real-time count of active incidents and a breakdown by severity on a single dashboard. The default dashboards do not show both widgets together. What should the manager do?

   • AExport the incident data to a CSV file and create a chart in a spreadsheet application.
   • BCreate a custom dashboard and add the 'Incident Count' and 'Incidents by Severity' widgets from the widget library.
   • COpen two separate browser tabs, one for each default dashboard, and switch between them.
   • DUse the default 'Incident Management' dashboard and rely on the built-in widgets only.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is viewing the 'Incidents by Status' widget and wants to see the details of a specific incident that is in 'Open' status. What should the analyst do?

   • AOpen the 'Incidents' tab and manually search for the incident.
   • BClick on the 'Open' segment of the widget to drill down to the incident list, then click on the specific incident.
   • CApply a filter for 'Open' status on the dashboard and then view the incident list.
   • DExport the widget data to a CSV file and search for the incident.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary method to share a Cortex XDR report with external stakeholders?

   • AExport the report and send it via email or a file-sharing service
   • BGrant them direct access to the Cortex XDR console
   • CCopy the report data into a chat message
   • DPublish the report to a public website
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst has created a detailed incident report and needs to share it with an external auditor who does not have access to Cortex XDR. Which action should the analyst take?

   • AExport the report to PDF and email it to the auditor.
   • BCopy the report content into a chat message and send it.
   • CSchedule the report to run daily and email it to the auditor.
   • DShare the report link with the auditor and grant them a Cortex XDR account.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary method to add a new widget to a Cortex XDR dashboard?

   • ARun a SQL query from the Investigation page
   • BEdit the dashboard's JSON configuration file
   • CUse the 'Add Widget' button on the dashboard toolbar
   • DSubmit a request to the administrator to add widgets
   Reveal Solution Discussion Select an answer first