Weekend Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

How does DBot score an indicator that has multiple reputation scores?

A.

uses the most severe score scores

B.

the reputation as undefined

C.

uses the average score

D.

uses the least severe score

Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

A.

firewall alert

B.

SIEM alert

C.

full URL

D.

registry set value

Which statement applies to the malware protection flow of the endpoint agent in Cortex XSIAM?

A.

A tile from an allowed signer is exempt from local analysis.

B.

Local analysis always happens before a WildFire verdict check.

C.

Hash comparisons come after local static analysis.

D.

The block list is verified in the final step.

What is the difference between the intel feed’s license quotas of Cortex XSOAR Starter Edition and Cortex XSOAR (SOAR + TIM)?

A.

Cortex XSOAR Started Edition has unlimited access to the Threat Intel Library.

B.

In Cortex XSOAR (SOAR + TIM), Unit 42 Intelligence is not included.

C.

In Cortex XSOAR (SOAR + TIM), intelligence detail view and relationships data are not included.

D.

Cortex XSOAR Starter Edition includes up to 5 active feeds and 100 indicators/fetch.

When initiated, which Cortex XDR capability allows immediate termination of the process-or entire process tree-on an anomalous process discovered during investigation of a security event?

A.

Live sensors

B.

Live terminal

C.

Log forwarding

D.

Log stitching

Which two troubleshooting steps should be taken when an integration is failing to connect? (Choose two.)

A.

Ensure the playbook is set to run in quiet mode to minimize CPU usage and suppress errors

B.

Confirm the integration credentials or API keys are valid.

C.

Check the integration logs and enable a higher logging level, if needed, view the specific error.

D.

Confirm there are no dashboards or reports configured to use that integration instance.

Which service helps identify attackers by combining world-class threat intelligence with Cortex XSIAM technology?

A.

Virtual Desktop Infrastructure

B.

Managed Threat Hunting

C.

Threat Intelligence Platform

D.

Cloud Identity Engine

How many use cases should a POC success criteria document include?

A.

only 1

B.

3 or more

C.

no more than 5

D.

no more than 2

What are two reasons incident investigation is needed in Cortex XDR? (Choose two.)

A.

No solution will stop every attack requiring further investigation of activity.

B.

Insider Threats may not be blocked and initial activity may go undetected.

C.

Analysts need to acquire forensic artifacts of malware that has been blocked by the XDR agent.

D.

Detailed reports are needed for senior management to justify the cost of XDR.

Which technology allows a customer to integrate Cortex Xpanse with third-party applications or services, assets, and IP ranges while leveraging investigation capabilities?

A.

POSTMAN

B.

Webhook

C.

REST API

D KPI