Question 1

Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Options :

A : Hash Verdict Determination

B : Behavioral Threat Protection

C : Restriction Policy

D : Child Process Protection

Answer: A

Question 2

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Options :

A : causality_chain

B : endpoint_name

C : threat_event

D : event_type

Answer: D

Question 3

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Options :

A : Agent Proxy

B : Agent Installer and Content Caching

C : Syslog Collector

D : CSV Collector

Answer: B

Question 4

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

Options :

A : in the macOS Malware Protection Profile to indicate allowed signers

B : in the Linux Malware Protection Profile to indicate allowed Java libraries

C : SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

D : in the Windows Malware Protection Profile to indicate allowed executables

Answer: D

Question 5

Which statement is correct based on the report output below?

Options :

A : Host Inventory Data Collection is enabled.

B : 3,297 total incidents have been detected.

C : Forensic inventory data collection is enabled.

D : 133 agents have full disk encryption.

Answer: C