300 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?
The Cortex XDR Collector is the component designed to ingest logs and data from non-endpoint sources such as network devices, firewalls, and third-party systems. It forwards this telemetry into Cortex XDR for correlation and analytics. This makes it the correct answer for collect…Read full explanation
You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?
To detect PowerShell executed with an encoded command, the rule must inspect the command line used to launch PowerShell. The 'actor_process_command_line' field captures the full command line of the process that initiated the action, including '-EncodedCommand' or '-enc' arguments…Read full explanation
When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?
The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.