Question 1

Where is the data retrieved by an integration task (such as a user's email address or a file's reputation) storedwithin an incident so that other playbook tasks can access it?

Options :

A : War Room

B : Context Data

C : Incident Fields

D : Evidence Board

Answer: B

Question 2

Which task should a threat hunter include in the investigation when a Cortex XDR incident contains alertsabout a malicious process?

Options :

A : Immediately isolate the endpoint and delete the identified file.

B : Search for the SHA256 file hash on other endpoints in the environment.

C : Add the SHA256 file hash to the Cortex XDR global block list.

D : Disable the account of the user responsible for initiating the process.

Answer: B

Question 3

Which dashboard or module in Cortex XSIAM provides visibility into unmanaged devices, unauthorizedshadow IT, and cloud assets that do not currently have a Cortex agent installed?

Options :

A : Host Insights

B : Asset Inventory

C : Cloud Discovery & Exposure

D : Identity Analytics

Answer: C

Question 4

Which scripting language will allow the use of the Query Builder in Cortex XDR to show the top fiveaccounts with failed Windows logons in the past 24 hours? (Choose one answer)

Options :

A : PowerShell

B : JavaScript

C : XQL

D : Python

Answer: C

Question 5

In Cortex XSOAR, what happens by default to an indicator (such as a malicious IP) once it reaches itsconfigured expiration date?

Options :

A : It is permanently deleted from the XSOAR database.

B : It is moved to the "Archive" tab and cannot be used in playbooks.

C : It remains in the system but is marked as "Expired" and no longer actively pushed to integrations.

D : Its verdict is automatically changed from "Malicious" to "Benign".

Answer: C

Free SecOps-Pro Mock Exam – Practice Online Confidently

Buying Options: