SecOps-Pro Cortex XDR — 10 Questions

Question 1

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Accepted Answer

Cortex XDR Collector. Cortex XDR Collectors are used to ingest logs and telemetry from third-party sources and infrastructure.

Answer

Cortex Data Lake

Answer

Broker Service

Answer

Cortex XDR Agent

Question 2

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Accepted Answer

actor_process_command_line. The command line arguments contain the encoded script block, which is essential for detecting obfuscated PowerShell activity.

Answer

file_hash

Answer

target_process_path

Answer

process_name

Question 3

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 4

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Creating a Hash-based Blocklist (IOC) is the standard, enterprise-wide method to block known malicious files.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 5

During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?

Accepted Answer

Manual Incident Creation. Cortex XDR uses Incident Stitching based on causality and correlation logic to group related alerts into an incident automatically or manually.

Answer

Alert Grouping policy

Answer

Alert Suppression

Answer

Correlation Rule Execution

Question 6

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

Accepted Answer

Content Update Policy. Update policies control when and how agents receive software and content updates.

Answer

Global Settings

Answer

Incident Management Settings

Answer

Endpoint Policy

Question 7

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 8

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 9

Which view in the Cortex XDR console provides the most comprehensive timeline of all activities related to a specific endpoint?

Accepted Answer

Endpoint View. The Endpoint View provides a detailed historical log of processes, network connections, and file modifications on a per-host basis.

Answer

Alert View

Answer

Incident View

Answer

Dashboard View

Question 10

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Adding an exception for that specific process or behavior path allows the administrative script to run while keeping the BIOC active for other threats.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.