Which two areas of Cortex XDR are used for threat hunting activities? (Choose two.)

• A.indicators of compromise (IOC) rules
• B.query builder
• C.live terminal
• D.host insights module

Comment: *

Name: *

Email: *

Verification: *

An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?

• A.The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
• B.The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
• C.The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
• D.The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console

Comment: *

Name: *

Email: *

Verification: *

Why is reputation scoring important in the Threat Intelligence Module of Cortex XSOAR?

• A.It allows for easy comparison between open-source intelligence and paid services.
• B.It deconflicts prioritization when two vendors give different scores for the same indicator.
• C.It provides a mathematical model for combining scores from multiple vendors.
• D.It helps identify threat intelligence vendors with substandard content.

Comment: *

Name: *

Email: *

Verification: *

Cortex XSOAR has extracted a malicious IP address involved in command-and-control traffic.
What is the best method to automatically block this IP from communicating with endpoints without requiring a configuration change on the firewall?

• A.Create a NetOps ticket requesting a configuration change to the firewall to block the IP.
• B.Add the IP address to an external dynamic list used by the firewall.
• C.Add the IP address to a threat intelligence management malicious IP list to elevate priority of future alerts.
• D.Block the IP address by creating a deny rule in the firewall.

Comment: *

Name: *

Email: *

Verification: *

What are two capabilities of a War Room? (Choose two.)

• A.create widgets for an investigation
• B.create playbooks for orchestration
• C.act as an audit trail for an investigation
• D.run ad-hoc automation commands

Comment: *

Name: *

Email: *

Verification: *