SecOps-Pro Cortex XDR Practice Test 2 — 15 Questions

Question 1

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Adding the malicious script's hash to the Blocklist in IOC management lets Cortex XDR block that exact file across all protected endpoints via the global IOC mechanism. Hash-based blocking is deterministic and applies enterprise-wide without needing per-endpoint exceptions or manual response actions. This is the most efficient way to prevent execution of a known malicious file at scale.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 2

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 3

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 4

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Creating an exception for the BIOC rule based on the process path or hash allows the legitimate administrative script to bypass the rule without disabling it entirely. This maintains detection for other processes while suppressing false positives for known good scripts. Exceptions are a standard feature in security tools to handle benign activity.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.

Question 5

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.

Question 6

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 7

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 8

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

Accepted Answer

The endpoint has not received the updated policy containing the BIOC.. If the agent has not yet received the latest policy update containing the new BIOC, it will not enforce the rule.

Answer

The agent is not configured to send BIOC logs.

Answer

The BIOC rule is disabled by default.

Answer

The BIOC rule requires a full agent reboot.

Question 9

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Accepted Answer

Continues to function using locally stored policies.. The agent is designed to continue protecting the endpoint using its locally stored policies and protection engines even when offline.

Answer

Enters a default 'Allow All' state.

Answer

Stops all security monitoring.

Answer

Automatically uninstalls itself.

Question 10

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

Accepted Answer

Reporting. The Reporting section allows for the generation and scheduling of custom and predefined reports based on alert data.

Answer

Settings

Answer

Incident View

Answer

Query Center

Question 11

What is the purpose of the 'XQL Query' feature in Cortex XDR?

Accepted Answer

To perform advanced cross-data analysis and threat hunting.. XQL (XDR Query Language) in Cortex XDR is a powerful query language used for advanced cross-data analysis and threat hunting. It allows security analysts to search and correlate data across endpoints, network, and cloud logs to detect sophisticated threats. It is not used for agent updates, firewall rules, or incident rule creation.

Answer

To manage agent updates.

Answer

To configure firewall rules.

Answer

To create new incident rules.

Question 12

In the Cortex XDR console, where can you see the current status of all your endpoints?

Accepted Answer

Endpoint Inventory. The Endpoint Inventory in the Cortex XDR console provides a consolidated view of all registered endpoints, including their online/offline status, agent version, OS, and last check-in. It is the designated place to monitor endpoint health and coverage. This directly answers where to see the current status of all endpoints.

Answer

System logs

Answer

Alerts dashboard

Answer

Policy management

Question 13

If an endpoint is marked as 'Out of Date', what does this mean?

Accepted Answer

The agent version is older than the latest available version.. An 'Out of Date' status means the agent software version is behind the current version available in the console, indicating it needs an upgrade.

Answer

The agent has failed a security scan.

Answer

The agent has not communicated for a long time.

Answer

The license has expired.

Question 14

You want to automate the response to a specific type of alert. Where should you configure this?

Accepted Answer

Automation/Playbooks. Automation rules (often part of the Cortex XDR Orchestration or Playbook features) allow for automated responses to alerts.

Answer

Data Lake settings

Answer

Endpoint Policy

Answer

BIOC rules

Question 15

Which of the following describes the 'Agent Content' component?

Accepted Answer

The latest threat signatures and detection logic.. Agent Content in Cortex XDR refers to the latest threat signatures and detection logic that are delivered to the agent. It is regularly updated to ensure the agent can detect new threats. It is not the configuration file, logs, or executable.

Answer

The configuration file for the agent.

Answer

The logs generated by the agent.

Answer

The main executable file of the agent.