3.7 Identify and Explain the Data Retention Options in Cortex XDR XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization must comply with data retention regulations that require security logs to be kept for at least 1 year. They are evaluating Cortex XDR and need to understand what retention options are available. Which statement accurately describes the retention capabilities in Cortex XDR?

   • ACortex XDR automatically retains all data for 1 year by default, meeting most compliance requirements.
   • BCortex XDR does not allow customization of retention; it uses fixed retention periods that cannot be changed.
   • CCortex XDR provides a single global retention setting that applies to all data types equally.
   • DCortex XDR allows administrators to configure retention periods for different data types, such as alerts, incidents, and raw endpoint data.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a potential impact of setting a very long data retention period in Cortex XDR?

   • ANo impact on storage or performance
   • BIncreased storage usage and potentially slower query performance
   • COnly affects storage usage, not performance
   • DDecreased storage usage and faster query performance
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A company is planning their incident response workflow and needs to know how long they can access raw endpoint data (e.g., process execution, file events) in Cortex XDR after an incident occurs. They have not customized any retention settings. What is the default retention period for raw endpoint data?

   • A30 days
   • B1 year
   • C7 days
   • D90 days
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is subject to a regulation that requires them to retain security incident data for 5 years. They use Cortex XDR and have configured the maximum retention period for alerts and incidents, which is 1 year. They also have a policy to export data to an external SIEM for long-term storage. What is the most appropriate way to ensure compliance?

   • AUse Cortex XDR's built-in compliance archive feature to store data for 5 years.
   • BIncrease the retention period in Cortex XDR to 5 years, even though it exceeds the documented maximum.
   • CExport alerts and incidents to the external SIEM on a regular basis and retain them there for 5 years.
   • DRely solely on the Cortex XDR retention settings, as they are sufficient for compliance.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which regulatory principle is directly supported by the ability to set custom data retention periods in Cortex XDR?

   • AData minimization
   • BData encryption
   • CData portability
   • DData sovereignty
   Reveal Solution Discussion Select an answer first