Question 1

Which of the following represents a common sequence of cyber-attack tactics?

Options :

A : Actions on the objective Â» Reconnaissance Â» Weaponization & Delivery Â» Exploitation Â»Installation Â» Command & Control

B : Installation >> Reconnaissance Â» Weaponization & Delivery Â» Exploitation Â» Command & Control Â»Actions on the objective

C : Reconnaissance Â» Weaponization & Delivery Â» Exploitation Â» Installation Â» Command & Control Â»Actions on the objective

D : Reconnaissance >> Installation Â» Weaponization & Delivery Â» Exploitation Â» Command & Control Â»Actions on the objective

Answer: C

Question 2

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software inyour organization that is known to be benign. Which of the following options would prevent CortexXDR from blocking this software in the future, for all endpoints in your organization?

Options :

A : Create an individual alert exclusion.

B : Create a global inclusion.

C : Create an endpoint-specific exception.

D : Create a global exception.

Answer: D

Question 3

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Options :

A : Agent Proxy

B : Agent Installer and Content Caching

C : Syslog Collector

D : CSV Collector

Answer: B

Question 4

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was aprevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about amassive ongoing supply chain attack. Using Cortex XDR you recognize that your server wascompromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure thatthe same protection is extended to all your servers?

Options :

A : Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

B : Enable DLL Protection on all servers but there might be some false positives.

C : Create IOCs of the malicious files you have found to prevent their execution.

D : Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Answer: A

Question 5

Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Options :

A : Hash Verdict Determination

B : Behavioral Threat Protection

C : Restriction Policy

D : Child Process Protection

Answer: A