3.7 Identify and Explain the Data Retention Options in Cortex XDR XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   An administrator needs to change how long Cortex XDR retains endpoint event data. Which action correctly customizes the data retention policy for this data type?

   • AModify the retention period by editing the storage account settings in the Azure portal where Cortex XDR data is hosted.
   • BUse the Cortex XDR API to change the retention period by updating the 'retention_days' field in the endpoint configuration object.
   • CCreate a new log forwarding profile and select the 'Endpoint' data type to override its default retention period.
   • DNavigate to Settings > Data Retention and modify the retention period for the 'Endpoint' data type, then save the change.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is preparing for an audit and needs to provide evidence of security incidents from 6 months ago. They have not customized any retention settings in Cortex XDR. Which data type will still be available for this audit?

   • AAlerts
   • BIncidents
   • CNone of the data types will be available, as all default retention periods are less than 6 months.
   • DRaw endpoint data
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating an incident that occurred 45 days ago. They need to review the raw endpoint data from that time. The default retention settings are in place. What should they do?

   • AAccess the raw endpoint data from 45 days ago, as it is still available.
   • BUse the alerts and incidents from that time, as they are retained for 90 days and may contain relevant information.
   • CRequest that the administrator increase the retention period for raw endpoint data to 60 days, and then access the data.
   • DCheck the forensics data, which is retained for 180 days by default.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is subject to a regulation that requires them to retain security logs for 2 years. They use Cortex XDR and have configured the maximum retention period for alerts and incidents, which is 1 year. They are considering exporting data to an external SIEM. What is the most important consideration when exporting data for long-term retention?

   • AExport data to the same cloud provider as Cortex XDR to ensure compatibility.
   • BEnsure that the export includes all relevant metadata and context for each alert and incident.
   • CExport data only when an incident occurs, to reduce the volume.
   • DExport data in a proprietary format to save storage space.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security administrator is configuring Cortex XDR for a new deployment. They want to ensure that alerts are available for 180 days for auditing purposes, but they are concerned about storage costs. Which data type should they focus on adjusting to balance these needs?

   • AIncidents
   • BAlerts
   • CRaw endpoint data
   • DForensics data
   Reveal Solution Discussion Select an answer first