Cortex XDR

A security analyst wants to block a known malicious hash across all endpoints managed by Cortex XDR. Which component should the analyst use to enforce this block?

Which of the following describes the 'Agent Content' component?

What is the purpose of the 'XQL Query' feature in Cortex XDR?

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Which THREE actions are available when responding to an incident via the Response feature?

You need to export a report of all alerts from the last 30 days for a compliance audit. Which section of the console should you use?

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

A security analyst is investigating a high-severity alert in Cortex XDR. The alert details show a process named 'svchost.exe' with a parent process 'services.exe'. The analyst notices that the 'svchost.exe' process has a digital signature from Microsoft but is exhibiting unusual network behavior, connecting to an external IP address on port 443. The analyst wants to determine if this is a malicious process injection. Which Cortex XDR feature should the analyst use to inspect the memory of the 'svchost.exe' process?

Which THREE items can you use to build a BIOC rule in Cortex XDR?

In the Cortex XDR console, where can you see the current status of all your endpoints?

You want to automate the response to a specific type of alert. Where should you configure this?

An analyst needs to collect and analyze forensic data from a compromised endpoint without disrupting the user's work. The endpoint is running Windows 10 and has the Cortex XDR agent installed. Which capability should the analyst use?

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Which THREE components are part of the Cortex XDR architecture?

A security analyst needs to ensure that all endpoints in the organization are protected against a newly discovered fileless malware that exploits PowerShell. The analyst wants to configure Cortex XDR to block this threat automatically. Which component should the analyst configure?

A Cortex XDR analyst is investigating a high-severity alert involving a suspicious process on a critical server. The analyst needs to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

A security operations center (SOC) manager wants to reduce the number of false positive alerts generated by Cortex XDR. Which two features can be used to tune alert generation and reduce noise? (Choose two.)

A Cortex XDR administrator needs to ensure that all endpoint agents are reporting to the correct tenant and that the agent version is up to date. Which section of the Cortex XDR console provides a centralized view of endpoint agent status, including version, last seen time, and operational status?

A Cortex XDR administrator is configuring a new External Data Ingestion (EDI) integration to collect logs from a third-party cloud application. The administrator needs to ensure that the logs are parsed and mapped to Cortex XDR's data model for correlation with endpoint telemetry. Which configuration step is mandatory to achieve this?

Which TWO of the following are valid ways to deploy the Cortex XDR agent?

Which TWO types of logs can be ingested by a Cortex XDR Collector?

What is the function of the 'Cortex XDR Broker Service'?

A security analyst is investigating an alert in Cortex XDR and wants to see the raw endpoint data that contributed to the alert, including registry modifications and network connections. Which console section should the analyst use to query this data directly?

A Cortex XDR analyst is troubleshooting why a specific endpoint is not sending telemetry to the console. The analyst checks the agent status and sees that it is connected but no new events are appearing. Which action should the analyst take first to diagnose the issue?

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Which THREE pieces of information are displayed in the Incident View?

What is the primary function of the 'Cortex XDR Data Lake'?

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

If an endpoint is marked as 'Out of Date', what does this mean?

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

A Cortex XDR administrator needs to ensure that all endpoint agents can communicate with the Cortex XDR management console even when endpoints are behind a proxy. Which configuration should the administrator verify?

A security analyst is investigating a potential data exfiltration incident. The analyst needs to identify all external IP addresses that a specific endpoint has communicated with over the past 7 days. Which Cortex XDR feature should the analyst use?

An analyst is investigating an alert where a process launched by Microsoft Word spawned a child process that executed an encoded PowerShell command. The analyst wants to view the full process lineage, including parent-child relationships and command-line arguments, for this specific alert. Which Cortex XDR feature should the analyst use?

When investigating a file, you see a 'WildFire' verdict. What does this indicate?

A Cortex XDR administrator is configuring a new alert exclusion rule to reduce noise from a legitimate application that frequently triggers behavioral alerts. The administrator wants to ensure that the exclusion applies only to the specific endpoint group 'Finance' and only for alerts generated by the 'Credential Dumping' category. Which configuration should the administrator use?

A Cortex XDR administrator is configuring a new policy to restrict USB device usage on endpoints. The administrator wants to allow only specific USB devices while blocking all others. Which two actions must be performed to achieve this? (Choose two.)

A Cortex XDR analyst is investigating a suspected ransomware incident on a Windows endpoint. The analyst has identified the malicious process but needs to quickly determine whether it spawned any child processes and what those children did. Which feature within the Cortex XDR console provides this information in a visual timeline?