Cortex XDR

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

What is the primary function of the 'Cortex XDR Data Lake'?

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

What is the purpose of the 'XQL Query' feature in Cortex XDR?

In the Cortex XDR console, where can you see the current status of all your endpoints?

If an endpoint is marked as 'Out of Date', what does this mean?

You want to automate the response to a specific type of alert. Where should you configure this?

Which of the following describes the 'Agent Content' component?

What is the function of the 'Cortex XDR Broker Service'?

When investigating a file, you see a 'WildFire' verdict. What does this indicate?

Which TWO of the following are valid ways to deploy the Cortex XDR agent?

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Which THREE actions are available when responding to an incident via the Response feature?

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Which THREE components are part of the Cortex XDR architecture?

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Which THREE pieces of information are displayed in the Incident View?

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

An analyst is investigating an alert where a process launched by Microsoft Word spawned a child process that executed an encoded PowerShell command. The analyst wants to view the full process lineage, including parent-child relationships and command-line arguments, for this specific alert. Which Cortex XDR feature should the analyst use?

A security analyst wants to block a known malicious hash across all endpoints managed by Cortex XDR. Which component should the analyst use to enforce this block?

A Cortex XDR administrator is configuring a new External Data Ingestion (EDI) integration to collect logs from a third-party cloud application. The administrator needs to ensure that the logs are parsed and mapped to Cortex XDR's data model for correlation with endpoint telemetry. Which configuration step is mandatory to achieve this?

A Cortex XDR analyst is investigating a suspected ransomware incident on a Windows endpoint. The analyst has identified the malicious process but needs to quickly determine whether it spawned any child processes and what those children did. Which feature within the Cortex XDR console provides this information in a visual timeline?

A security analyst is investigating a high-severity alert in Cortex XDR. The alert details show a process named 'svchost.exe' with a parent process 'services.exe'. The analyst notices that the 'svchost.exe' process has a digital signature from Microsoft but is exhibiting unusual network behavior, connecting to an external IP address on port 443. The analyst wants to determine if this is a malicious process injection. Which Cortex XDR feature should the analyst use to inspect the memory of the 'svchost.exe' process?

A security operations center (SOC) manager wants to reduce the number of false positive alerts generated by Cortex XDR. Which two features can be used to tune alert generation and reduce noise? (Choose two.)

A security analyst needs to ensure that all endpoints in the organization are protected against a newly discovered fileless malware that exploits PowerShell. The analyst wants to configure Cortex XDR to block this threat automatically. Which component should the analyst configure?

An analyst needs to collect and analyze forensic data from a compromised endpoint without disrupting the user's work. The endpoint is running Windows 10 and has the Cortex XDR agent installed. Which capability should the analyst use?

A Cortex XDR administrator needs to ensure that all endpoint agents are reporting to the correct tenant and that the agent version is up to date. Which section of the Cortex XDR console provides a centralized view of endpoint agent status, including version, last seen time, and operational status?

A Cortex XDR administrator needs to ensure that all endpoint agents can communicate with the Cortex XDR management console even when endpoints are behind a proxy. Which configuration should the administrator verify?

A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?

A security analyst is investigating an alert in Cortex XDR and wants to see the raw endpoint data that contributed to the alert, including registry modifications and network connections. Which console section should the analyst use to query this data directly?

A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)

A Cortex XDR analyst is troubleshooting why a specific endpoint is not sending telemetry to the console. The analyst checks the agent status and sees that it is connected but no new events are appearing. Which action should the analyst take first to diagnose the issue?

A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?

A Cortex XDR analyst is investigating a high-severity alert involving a suspicious process on a critical server. The analyst needs to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?