What are two reasons incident investigation is needed in Cortex XDR? (Choose two.)

• A.No solution will stop every attack requiring further investigation of activity.
• B.Detailed reports are needed for senior management to justify the cost of XDR.
• C.Insider Threats may not be blocked and initial activity may go undetected.
• D.Analysts need to acquire forensic artifacts of malware that has been blocked by the XDR agent.

Comment: *

Name: *

Email: *

Verification: *

For which two purposes can Cortex XSOAR engines be deployed? (Choose two.)

• A.To integrate with tools in a network location that the Cortex XSOAR server cannot reach directly
• B.To execute recurring daybooks based on specific time schedules or changed to a feed
• C.To connect Cortex XSOAR to all required Palo Alto Networks resources such as the Cortex Gateway
• D.To add processing resources for a heavily-used integration via load-balancing groups.

Comment: *

Name: *

Email: *

Verification: *

An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

• A.Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
• B.In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
• C.With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
• D.Contact support and ask for a security exception.

Comment: *

Name: *

Email: *

Verification: *

A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users.
What would be the appropriate next step in the playbook?

• A.Email the CISO to advise that malicious email was found.
• B.Disable the user's email account.
• C.Email the user to confirm the reported email was phishing.
• D.Change the user's password.

Comment: *

Name: *

Email: *

Verification: *

Which technology allows a customer to integrate Cortex Xpanse with third-party applications or services, assets, and IP ranges while leveraging investigation capabilities?

• A.POSTMAN
• B.Webhook
• C.REST API
  D KPI

Comment: *

Name: *

Email: *

Verification: *