Question 1

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Options :

A : causality_chain

B : endpoint_name

C : threat_event

D : event_type

Answer: D

Question 2

Which statement is correct based on the report output below?

Options :

A : Host Inventory Data Collection is enabled.

B : 3,297 total incidents have been detected.

C : Forensic inventory data collection is enabled.

D : 133 agents have full disk encryption.

Answer: C

Question 3

Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Options :

A : Cortex XDR Pro per TB

B : Host Insights

C : Cortex XDR Pro per Endpoint

D : Cortex XDR Cloud per Host

Answer: D

Question 4

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Options :

A : Agent Proxy

B : Agent Installer and Content Caching

C : Syslog Collector

D : CSV Collector

Answer: B

Question 5

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software inyour organization that is known to be benign. Which of the following options would prevent CortexXDR from blocking this software in the future, for all endpoints in your organization?

Options :

A : Create an individual alert exclusion.

B : Create a global inclusion.

C : Create an endpoint-specific exception.

D : Create a global exception.

Answer: D

Free XDR-Analyst Mock Exam – Practice Online Confidently

Buying Options: