1.4 Demonstrate Understanding of Data Retention and Compute Units XDR-ENGINEER Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A new security analyst asks why Cortex XDR retains raw endpoint telemetry in addition to alerts and incidents. What is the primary reason for retaining raw telemetry?

   • ARaw telemetry is kept only to satisfy regulatory compliance and has no operational security value.
   • BRaw telemetry is retained to allow the platform to re-generate alerts if the original alert logic changes.
   • CRaw telemetry is retained to reduce compute unit consumption by avoiding the need to process alerts.
   • DRaw telemetry provides the underlying evidence needed for deep investigation, threat hunting, and correlating events that may not generate alerts.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a best practice for configuring data retention in XDR?

   • AAlign retention periods with organizational security and compliance requirements
   • BSet the longest possible retention period for all data types to maximize forensic value
   • CUse the same retention period for all data types to simplify management
   • DDisable retention policies to avoid storage costs
   Reveal Solution Discussion Select an answer first