An insider compromise investigation has been requested to provide evidence of an unauthorized removable drive being mounted on a company laptop. Cortex XDR agent is installed with default prevention…

Question

Options

• ACheck Host Inventory -> Mounts
• Bdataset = xdr_data | filter event_type = ENUM.MOUNT and event_sub_type =
• CThe requested data requires additional configuration to be captured
• Dpreset = device_control

• A
  80% (52)
• B
  3% (2)
• C
  5% (3)
• D
  12% (8)

Explanation

Option A is correct because Cortex XDR's Host Inventory > Mounts section automatically logs removable drive mount events under the default prevention agent settings and default "Device Configuration" extension profile - no extra configuration is needed, making this the direct, out-of-the-box location for this evidence.

Option B is wrong because the XQL query shown is both incomplete (truncated after event_sub_type =) and unnecessary when the evidence is already surfaced in the UI via Host Inventory. Even a corrected query would be a roundabout path when the native view exists.

Option C is wrong because the default "Device Configuration" profile already captures removable drive mount activity - the claim that additional configuration is required is a distractor designed to mislead candidates unfamiliar with what the defaults cover.

Option D is wrong because preset = device_control refers to Device Control policy enforcement (allowing/blocking devices), not a forensic evidence store - it controls behavior, it doesn't serve as an investigation log.

Memory tip: Think "Host = what happened on the machine." When you need to prove something physically touched a host (like a USB drive), go to Host Inventory first. The Mounts sub-view is Cortex XDR's purpose-built answer to "what was plugged in?"

No community discussion yet for this question.