Cortex XDR

Which of the following describes the 'Agent Content' component?

What is the purpose of the 'XQL Query' feature in Cortex XDR?

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Which THREE actions are available when responding to an incident via the Response feature?

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Which THREE items can you use to build a BIOC rule in Cortex XDR?

In the Cortex XDR console, where can you see the current status of all your endpoints?

You want to automate the response to a specific type of alert. Where should you configure this?

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Which THREE components are part of the Cortex XDR architecture?

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Which configuration setting in the Malware profile determines if the agent should move a file to a secure location upon detection?

Which TWO of the following are valid ways to deploy the Cortex XDR agent?

Which TWO types of logs can be ingested by a Cortex XDR Collector?

What is the function of the 'Cortex XDR Broker Service'?

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Which THREE pieces of information are displayed in the Incident View?

What is the primary function of the 'Cortex XDR Data Lake'?

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Which view in the Cortex XDR console provides the most comprehensive timeline of all activities related to a specific endpoint?

If an endpoint is marked as 'Out of Date', what does this mean?

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

When investigating a file, you see a 'WildFire' verdict. What does this indicate?