As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

• A.Enable DLL Protection on all servers but there might be some false positives.
• B.Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
• C.Create IOCs of the malicious files you have found to prevent their execution.
• D.Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Comment: *

Name: *

Email: *

Verification: *

Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

• A.WebSocket
• B.UDP and a random port
• C.TCP, over port 80
• D.NetBIOS over TCP

Comment: *

Name: *

Email: *

Verification: *

Which Type of IOC can you define in Cortex XDR?

• A.full path
• B.App-ID
• C.destination port
• D.e-mail address

Comment: *

Name: *

Email: *

Verification: *

After scan, how does file quarantine function work on an endpoint?

• A.Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.
• B.Quarantine takes ownership of the files and folders and prevents execution through access control.
• C.Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.
• D.Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

Comment: *

Name: *

Email: *

Verification: *

In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

• A.Create a custom XQL widget
• B.This is not currently supported
• C.Create a custom report and filter on starred incidents
• D.Click the star in the widget

Comment: *

Name: *

Email: *

Verification: *