最新的Security Operations認證 XDR-Analyst考試題庫

問題1

What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?

A. Worm

B. Rootkit

C. Keylogger

D. Ransomware

正確答案: D

說明：（僅 VCESoft 成員可見）

問題2

Which statement best describes how Behavioral Threat Protection (BTP) works?

A. BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.

B. BTP injects into known vulnerable processes to detect malicious activity.

C. BTP matches EDR data with rules provided by Cortex XDR.

D. BTP uses machine Learning to recognize malicious activity even if it is not known.

正確答案: D

說明：（僅 VCESoft 成員可見）

問題3

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

A. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.

B. Click the three dots on the widget and then choose "Save" and this will link the query to the Widget Library.

C. Click on "Save to Action Center" in the dashboard and you will be prompted to give the query a name and description.

D. This isn't supported, you have to exit the dashboard and go into the Widget Library first to create it.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題4

Which profiles can the user use to configure malware protection in the Cortex XDR console?

A. Malware Detection profile

B. Malware profile

C. Malware Protection profile

D. Anti-Malware profile

正確答案: C

說明：（僅 VCESoft 成員可見）

問題5

What is the outcome of creating and implementing an alert exclusion?

A. The Cortex XDR console will delete those alerts and block ingestion of them in the future.

B. The Cortex XDR agent will not create an alert for this event in the future.

C. The Cortex XDR console will hide those alerts.

D. The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

正確答案: C

說明：（僅 VCESoft 成員可見）

問題6

In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

A. Slack

B. Salesforce

C. Jira

D. Service Now

正確答案: A

說明：（僅 VCESoft 成員可見）

問題7

Which Type of IOC can you define in Cortex XDR?

A. destination port

B. App-ID

C. full path

D. e-mail address

正確答案: C

說明：（僅 VCESoft 成員可見）

問題8

Can you disable the ability to use the Live Terminal feature in Cortex XDR?

A. Yes, via Agent Settings Profile.

B. Yes, via the Cortex XDR console or with an installation switch.

C. No, it is a required feature of the agent.

D. No, a separate installer package without Live Terminal is required.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題9

While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

A. create a BIOC rule excluding this behavior

B. mark the incident as Unresolved

C. mark the incident as Resolved - False Positive

D. create an exception to prevent future false positives

正確答案: C

說明：（僅 VCESoft 成員可見）

問題10

What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

A. Automatically close the connections involved in malicious traffic.

B. Automatically block the IP addresses involved in malicious traffic.

C. Automatically kill the processes involved in malicious activity.

D. Automatically terminate the threads involved in malicious activity.

正確答案: B,C

最新的Palo Alto Networks XDR Analyst - XDR-Analyst免費考試真題

最新更新

站內鏈接

聯系我們