3.6 Demonstrate Understanding of Cortex XDR Dashboards and Reports XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst needs to quickly review the most recent high-severity alerts across all endpoints and then investigate the underlying events for the top alert. Which Cortex XDR dashboard and workflow should the analyst use?

   • AOpen the Reports tab, generate a new report for high-severity alerts, and then export it to PDF for review.
   • BOpen the Network Traffic dashboard, apply a time range of 'last 24 hours', and then click on the top source IP.
   • COpen the Alert Management dashboard, apply a severity filter for 'high', then click on the alert count widget to drill down into the alert list.
   • DOpen the Endpoint Management dashboard, filter by 'high' severity, and then click on the endpoint name to view its details.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of the drill-down feature on a Cortex XDR dashboard widget?

   • ATo refresh the widget's data manually
   • BTo change the widget's position on the dashboard
   • CTo navigate to a more detailed view of the underlying events or alerts
   • DTo export the widget's data to a CSV file
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How do user roles affect access to dashboards and reports in Cortex XDR?

   • ARoles only affect the ability to export reports, not view them
   • BRoles determine which dashboards and reports a user can view or edit
   • CRoles only affect the ability to create alerts, not dashboards
   • DAll users have the same access to all dashboards and reports
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How can a user customize an existing widget on a Cortex XDR dashboard to show specific data?

   • ABy editing the widget's settings to change the data source and display options
   • BBy creating a new dashboard for each data view
   • CBy modifying the underlying database schema
   • DBy using the API to rewrite the widget's code
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   While reviewing the 'Alerts by Severity' widget on a dashboard, an analyst notices an unusually high number of medium-severity alerts. The analyst wants to see the individual alerts that make up that count. What should the analyst do?

   • AOpen the 'Alerts' tab and manually search for medium-severity alerts.
   • BApply a filter for 'medium' severity on the dashboard and then view the alert list.
   • CClick on the medium-severity segment of the widget to drill down into the alert list.
   • DExport the widget data to a CSV file and open it in a spreadsheet.
   Reveal Solution Discussion Select an answer first