1.2 Explain the Deployment and Functionality of Cortex XDR Components XDR-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team wants to create a policy that blocks access to a sensitive application for all users in the 'Finance' group. They have Cloud Identity Engine integrated with Cortex XDR. What is the most efficient way to implement this?

   • AConfigure the Broker VM to block traffic for the Finance group.
   • BCreate a policy in Cortex XDR that references the 'Finance' group from Cloud Identity Engine.
   • CCreate a policy for each user in the Finance group individually.
   • DUse the XDR Collector to filter traffic based on user names.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst notices that a user's laptop is exhibiting signs of a possible malware infection. The analyst wants to quickly determine if the Cortex XDR agent on that laptop has collected relevant process and network connection data. What should the analyst do?

   • ARun a manual scan from the agent's local interface and export the results.
   • BUse the endpoint's built-in Windows Event Viewer to review local logs.
   • CConnect to the laptop via remote desktop and inspect running processes.
   • DAccess the Cortex XDR console and review the endpoint's timeline and behavioral indicators.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An organization uses a third-party network security product that generates alerts in a proprietary format. They want to bring those alerts into Cortex XDR for unified analysis. Which capability of the Broker VM should they use?

   • AIntegration with the third-party product via a syslog or API-based collector.
   • BUsing the Broker VM's firewall to block malicious traffic from the third-party product.
   • CNetwork traffic inspection using the built-in intrusion detection engine.
   • DDeploying the third-party product's agent on the Broker VM to forward alerts.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What role does Cloud Identity Engine play in Cortex XDR?

   • AIt manages network traffic routing
   • BIt stores all endpoint logs
   • CIt performs malware analysis on endpoints
   • DIt supplies user and group context for alerts and investigations
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has a distributed network with a central data center and several remote branches. They want to inspect network traffic from all locations and also ingest logs from various security devices. They have limited IT staff at the branches. What is the most efficient architecture?

   • AUse Cloud Identity Engine to route traffic from branches to the central Broker VM.
   • BDeploy a Broker VM at each branch to inspect traffic and an XDR Collector at the central data center to aggregate all logs.
   • CDeploy an XDR Collector at each branch and a single Broker VM at the central data center.
   • DDeploy a single Broker VM at the central data center and have all branch traffic sent to it via VPN.
   Reveal Solution Discussion Select an answer first