XDR-ANALYST Exam Questions

What license would be required for ingesting external logs from various vendors?

An attacker tries to load dynamic libraries on macOS from an unsecure location. Which Cortex XDR module can prevent this attack?

What is the purpose of the Unit 42 team?

Which Type of IOC can you define in Cortex XDR?

When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?

In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

Where would you view the WildFire report in an incident?

What does the following output tell us?

Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

What occurs if a lookup table referenced in an XQL query is deleted from Cortex XDR?

What is the main benefit of using the Query Library in Cortex XDR?

What are two key characteristics of alerts generated from third-party integrations in Cortex XDR?

What is the primary purpose of Host Insights in Cortex XDR?

When is the wss (WebSocket Secure) protocol used?

With a Cortex XDR Prevent license, which objects are considered to be sensors?

Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

What kind of the threat typically encrypts user files?

When using the "File Search and Destroy" feature, which of the following search hash type is supported?

If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

What is by far the most common tactic used by ransomware to shut down a victim's operation?

Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.

When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

In Cortex XDR, what action is taken once an incident is confirmed as benign?

Which of the following are valid use cases for using XQL in Cortex XDR? (Choose two)

Why is it important to regularly update Cortex XDR agents?

When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose Two)

What types of actions you can execute with live terminal session?

Which version of python is used in live terminal?

What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?

Which function describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed?

To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR A...

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure t...

What is the difference between presets and datasets in XQL?

What should you do to automatically convert leads into alerts after investigating a lead?

Which type of IOC can you define in Cortex XDR?

Which of the following Live Terminal options are available for Android systems?

Which search methods is supported by File Search and Destroy?

What is the primary purpose of using lookup tables in Cortex XDR?

Which reports can be generated or scheduled from the Cortex XDR dashboard? (Choose two)

What are two purposes of using the Pre-defined Query Builder Template in Cortex XDR? (Choose two)

Which features are supported by scheduled queries in Cortex XDR? (Choose two)

Which statement accurately describes the purpose of the Cortex XDR dashboard?

When conducting threat hunting using IOC data, what actions are typically taken? (Choose two)

Which two elements are part of alert evidence in Cortex XDR? (Choose two)

Phishing belongs to which of the following MITRE ATT&CK tactics?

When creating a BIOC rule, which XQL query can be used?

Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?