Question 1

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was aprevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about amassive ongoing supply chain attack. Using Cortex XDR you recognize that your server wascompromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure thatthe same protection is extended to all your servers?

Options :

A : Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

B : Enable DLL Protection on all servers but there might be some false positives.

C : Create IOCs of the malicious files you have found to prevent their execution.

D : Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Answer: A

Question 2

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Options :

A : Agent Proxy

B : Agent Installer and Content Caching

C : Syslog Collector

D : CSV Collector

Answer: B

Question 3

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software inyour organization that is known to be benign. Which of the following options would prevent CortexXDR from blocking this software in the future, for all endpoints in your organization?

Options :

A : Create an individual alert exclusion.

B : Create a global inclusion.

C : Create an endpoint-specific exception.

D : Create a global exception.

Answer: D

Question 4

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Options :

A : causality_chain

B : endpoint_name

C : threat_event

D : event_type

Answer: D

Question 5

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

Options :

A : in the macOS Malware Protection Profile to indicate allowed signers

B : in the Linux Malware Protection Profile to indicate allowed Java libraries

C : SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

D : in the Windows Malware Protection Profile to indicate allowed executables

Answer: D

Higher Test Marks with Free Online XDR-Analyst Exam Practice

Buying Options: