XDR-ANALYST Exam Questions

What is the standard installation disk space recommended to install a Broker VM?

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256- based SSL certificate?

What is the outcome of creating and implementing an alert exclusion?

Which statement is true for Application Exploits and Kernel Exploits?

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Which of the following is an example of a successful exploit?

Which of the following represents the correct relation of alerts to incidents?

Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatic...

Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

After scan, how does file quarantine function work on an endpoint?

Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

Which profiles can the user use to configure malware protection in the Cortex XDR console?

Which module provides the best visibility to view vulnerabilities?

Which of the following is NOT a precanned script provided by Palo Alto Networks?

Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

You can star security events in which two ways? (Choose two.)

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report...

When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

What is the purpose of the Cortex Data Lake?

When creating a scheduled report which is not an option?

Which statement regarding scripts in Cortex XDR is true?

What is the function of WildFire for Cortex XDR?

A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to...

Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

Which statement best describes how Behavioral Threat Protection (BTP) works?

Which of the following policy exceptions applies to the following description? `An exception allowing specific PHP files'

In the Cortex XDR console, from which two pages are you able to manually perform the agent upgrade action? (Choose two.)

What motivation do ransomware attackers have for returning access to systems once their victims have paid?

What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

Which statement is correct based on the report output below?

What contains a logical schema in an XQL query?

Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

Can you disable the ability to use the Live Terminal feature in Cortex XDR?

Which of the following represents a common sequence of cyber-attack tactics?

What is the maximum number of agents one Broker VM local agent applet can support?

Which Exploit Protection Module (EPM) can be used to prevent attacks based on OS function?

Why would one threaten to encrypt a hypervisor or, potentially, a multiple number of virtual machines running on a server?

Which minimum Cortex XDR agent version is required for Kubernetes Cluster?

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options wou...

Which of the following paths will successfully activate Remediation Suggestions?

What is an example of an attack vector for ransomware?

What is the Wildfire analysis file size limit for Windows PE files?

How can you pivot within a row to Causality view and Timeline views for further investigate?