XDR-Analyst Evidence Review And Response Actions — All Questions With Answers

Question 1hardmultiple choice

Read the full network assurance explanation →

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

Question 2easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Question 3mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During an investigation, an analyst needs to isolate a compromised endpoint from the network while still allowing the Cortex XDR agent to communicate with the management console for remediation. Which Cortex XDR response action should the analyst use?

Question 4mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During a Cortex XDR investigation, an analyst sees an alert for a suspicious process that spawned from a Microsoft Word document. The analyst needs to determine whether the process made any network connections after execution. Which Cortex XDR capability should the analyst use to correlate the process activity with network events?

Question 5mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident that involves a malicious PowerShell script executed on multiple endpoints. To effectively contain and remediate the threat, which TWO response actions can the analyst take directly from the Cortex XDR Incident Response view? (Choose two.)

Question 6easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, an analyst wants to verify that the malicious files identified during the investigation have been removed from all affected endpoints. Which Cortex XDR action should the analyst take to ensure the files are no longer present?

Question 7mediummulti select

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is reviewing the timeline of a security incident and needs to determine which user account was responsible for launching several suspicious processes on a compromised server. The analyst wants to correlate identity data with process execution events. Which TWO fields available in the Cortex XDR process execution event data can directly identify the user context of the process? (Choose two.)

Question 8hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

Question 9hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Question 10easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Question 11easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Question 12mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Question 13mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Question 14mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Question 15easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Question 16mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Question 17easymultiple choice

Read the full Evidence Review And Response Actions explanation →

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Question 18hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Question 19mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Question 20easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Question 21hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Question 22easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Question 23mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Question 24easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Question 25mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Question 26hardmultiple choice

Read the full Ansible explanation →

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Question 27hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Question 28easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Question 29mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Question 30hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Question 31easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Question 32easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

Question 33hardmultiple choice

Read the full network assurance explanation →

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

Question 34mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Question 35hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Question 36mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Question 37mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Question 38easymulti select

Read the full Evidence Review And Response Actions explanation →

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Question 39easymulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Question 40mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Question 41hardmulti select

Read the full Evidence Review And Response Actions explanation →

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Question 42easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Question 43hardmulti select

Read the full Evidence Review And Response Actions explanation →

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Question 44mediummulti select

Read the full network assurance explanation →

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Question 45hardmulti select

Read the full Ansible explanation →

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Question 46easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Question 47hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Question 48mediummulti select

Read the full Evidence Review And Response Actions explanation →

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Question 49easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Question 50mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Question 51hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Question 52easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Question 53hardmulti select

Read the full network assurance explanation →

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Question 54mediummulti select

Read the full Evidence Review And Response Actions explanation →

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Question 55mediummulti select

Read the full Evidence Review And Response Actions explanation →

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Question 56easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Question 57hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Question 58easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Question 59hardmulti select

Read the full Evidence Review And Response Actions explanation →

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Question 60easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Question 61mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Question 62mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Question 63hardmulti select

Read the full Evidence Review And Response Actions explanation →

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

Question 64mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

Question 65hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Question 66mediummulti select

Read the full network assurance explanation →

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

Question 67hardmulti select

Read the full Evidence Review And Response Actions explanation →

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Question 68easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Question 69easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

Question 70mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

Question 71mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

Question 72hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

Question 73hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

Question 74hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

Question 75easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, an analyst needs to document the incident in Cortex XDR. The analyst wants to add a note summarizing the root cause and remediation steps to the incident for future reference. Which action should the analyst take?

Question 76mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

Question 77mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

Question 78hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

Question 79mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

Question 80hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

Question 81hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

Question 82hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

Question 83mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

Question 84mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Question 85mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

Question 86easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

Question 87easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Question 88mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Question 89hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

Question 90hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

Question 91hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Question 92mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

Question 93hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

Question 94easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

Question 95hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

Question 96hardmulti select

Read the full Evidence Review And Response Actions explanation →

During an investigation of a suspected data exfiltration incident, an analyst observes that a finance workstation initiated an outbound SMB connection to an unfamiliar internal host on port 445 at 02:14. The analyst wants to determine whether lateral movement occurred before sensitive files were staged. Which TWO Cortex XDR evidence sources should the analyst review to correlate the SMB session with the originating process and the remote endpoint's activity? (Choose two.)

Question 97mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

Question 98easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?

Question 1hardmultiple choice

Read the full network assurance explanation →

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

Question 2easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Question 3mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During an investigation, an analyst needs to isolate a compromised endpoint from the network while still allowing the Cortex XDR agent to communicate with the management console for remediation. Which Cortex XDR response action should the analyst use?

Question 4mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During a Cortex XDR investigation, an analyst sees an alert for a suspicious process that spawned from a Microsoft Word document. The analyst needs to determine whether the process made any network connections after execution. Which Cortex XDR capability should the analyst use to correlate the process activity with network events?

Question 5mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident that involves a malicious PowerShell script executed on multiple endpoints. To effectively contain and remediate the threat, which TWO response actions can the analyst take directly from the Cortex XDR Incident Response view? (Choose two.)

Question 6easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, an analyst wants to verify that the malicious files identified during the investigation have been removed from all affected endpoints. Which Cortex XDR action should the analyst take to ensure the files are no longer present?

Question 7mediummulti select

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is reviewing the timeline of a security incident and needs to determine which user account was responsible for launching several suspicious processes on a compromised server. The analyst wants to correlate identity data with process execution events. Which TWO fields available in the Cortex XDR process execution event data can directly identify the user context of the process? (Choose two.)

Question 8hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

Question 9hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Question 10easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Question 11easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Question 12mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Question 13mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Question 14mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Question 15easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Question 16mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Question 17easymultiple choice

Read the full Evidence Review And Response Actions explanation →

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Question 18hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Question 19mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Question 20easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Question 21hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Question 22easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Question 23mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Question 24easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Question 25mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Question 26hardmultiple choice

Read the full Ansible explanation →

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Question 27hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Question 28easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Question 29mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Question 30hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Question 31easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Question 32easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

Question 33hardmultiple choice

Read the full network assurance explanation →

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

Question 34mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Question 35hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Question 36mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Question 37mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Question 38easymulti select

Read the full Evidence Review And Response Actions explanation →

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Question 39easymulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Question 40mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Question 41hardmulti select

Read the full Evidence Review And Response Actions explanation →

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Question 42easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Question 43hardmulti select

Read the full Evidence Review And Response Actions explanation →

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Question 44mediummulti select

Read the full network assurance explanation →

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Question 45hardmulti select

Read the full Ansible explanation →

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Question 46easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Question 47hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Question 48mediummulti select

Read the full Evidence Review And Response Actions explanation →

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Question 49easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Question 50mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Question 51hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Question 52easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Question 53hardmulti select

Read the full network assurance explanation →

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Question 54mediummulti select

Read the full Evidence Review And Response Actions explanation →

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Question 55mediummulti select

Read the full Evidence Review And Response Actions explanation →

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Question 56easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Question 57hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Question 58easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Question 59hardmulti select

Read the full Evidence Review And Response Actions explanation →

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Question 60easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Question 61mediummulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Question 62mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Question 63hardmulti select

Read the full Evidence Review And Response Actions explanation →

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

Question 64mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

Question 65hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Question 66mediummulti select

Read the full network assurance explanation →

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

Question 67hardmulti select

Read the full Evidence Review And Response Actions explanation →

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Question 68easymulti select

Read the full Evidence Review And Response Actions explanation →

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Question 69easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

Question 70mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

Question 71mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

Question 72hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

Question 73hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

Question 74hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

Question 75easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, an analyst needs to document the incident in Cortex XDR. The analyst wants to add a note summarizing the root cause and remediation steps to the incident for future reference. Which action should the analyst take?

Question 76mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

Question 77mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

Question 78hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

Question 79mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

Question 80hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

Question 81hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

Question 82hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

Question 83mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

Question 84mediummulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Question 85mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

Question 86easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

Question 87easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Question 88mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Question 89hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

Question 90hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

Question 91hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Question 92mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

Question 93hardmultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

Question 94easymultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

Question 95hardmulti select

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

Question 96hardmulti select

Read the full Evidence Review And Response Actions explanation →

During an investigation of a suspected data exfiltration incident, an analyst observes that a finance workstation initiated an outbound SMB connection to an unfamiliar internal host on port 445 at 02:14. The analyst wants to determine whether lateral movement occurred before sensitive files were staged. Which TWO Cortex XDR evidence sources should the analyst review to correlate the SMB session with the originating process and the remote endpoint's activity? (Choose two.)

Question 97mediummultiple choice

Read the full Evidence Review And Response Actions explanation →

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

Question 98easymultiple choice

Read the full Evidence Review And Response Actions explanation →

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?