Threat Detection And Incident Response

Which TWO of the following are primary benefits of using 'Causality' in Cortex XDR?

You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?

An analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?

An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?

Which THREE of the following items are commonly included in the 'Evidence Board' in a Cortex XSOAR incident?

In the context of the Palo Alto Networks SOC, what is the primary purpose of the 'AutoFocus' platform?

Which TWO of the following are valid methods for an analyst to trigger an investigation in Cortex XSOAR?

What is the primary role of the 'Cortex Data Lake' in the Palo Alto Networks architecture?

When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?

Which THREE of the following are components of the incident response lifecycle as defined by standard security frameworks and supported by Palo Alto Networks tools?

When writing an XQL query to search for successful logins followed by a suspicious process start, which join/union operator would you typically use to correlate these distinct event types?

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

Which TWO of the following steps are part of the 'Containment' phase in a Palo Alto Networks SOC incident response plan?

Which TWO of the following are types of data that can be ingested into Cortex Data Lake?

In an XSOAR playbook, you need to extract an email address from a raw log string. Which component of XSOAR do you use to parse and structure this data automatically?

You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?

Which THREE of the following represent common data sources for building an XQL query in Cortex XDR?

Which type of Palo Alto Networks log would provide the most detail regarding an application-layer threat detected on the network?

During incident response, you identify a C2 domain that needs to be blocked. If using PAN-DB, which specific object should be updated to ensure the domain is blocked globally across all firewalls in the Panorama-managed group?

When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?

In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?

Which THREE of the following are capabilities provided by the Palo Alto Networks 'WildFire' service?

An analyst is reviewing the 'Incidents' page in Cortex XDR. They want to group related alerts into a single incident entity to reduce alert fatigue. Which feature is used for this?

Which stage of the incident response lifecycle involves the identification of the incident, initial triage, and verification of the alert?

Which TWO of the following are key features of the Palo Alto Networks 'Threat Vault'?

An analyst needs to correlate network logs with endpoint logs. In Cortex XDR, which feature allows the analyst to search across all data sources using a unified query language?

An attacker is using a custom encryption method for C2. Which WildFire feature can be used to perform automated sandboxing and analysis of the suspicious executable file to derive new threat intelligence?

Within Cortex XDR, what is the primary function of the 'BIOC' (Behavioral Indicator of Compromise) rules compared to standard 'IOC' (Indicator of Compromise) lookups?

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

When an endpoint is deemed compromised, which action should be taken in Cortex XDR to prevent the attacker from moving laterally while the incident is being investigated?

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

When investigating a compromise, you find an artifact in XSOAR. To gather more context about this file without leaving the platform, which integration should be utilized?

Which tab in Cortex XSOAR would an analyst use to document all actions taken during an active incident investigation?