Online Access Free XDR-Analyst Exam Questions

Which type of IOC can you define in Cortex XDR?

• A.Source port
• B.Destination IP Address
• C.Destination IP Address: Destination
• D.Source IP Address

What motivation do ransomware attackers have for returning access to systems once their victims have paid?

• A.The ransomware attackers hope to trace the financial trail back and steal more from traditional banking institutions. -
• B.There is organized crime governance among attackers that requires the return of access to remain in good standing.
• C.Failure to restore access to systems undermines the scheme because others will not believe their valuables would be returned.
• D.Nation-states enforce the return of system access through the use of laws and regulation.

Which statement is true for Application Exploits and Kernel Exploits?

• A.The ultimate goal of any exploit is to reach the application.
• B.The ultimate goal of any exploit is to reach the kernel.
• C.Application exploits leverage kernel vulnerability.
• D.Kernel exploits are easier to prevent then application exploits.

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

• A.Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
• B.From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
• C.In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.
• D.Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

• A.Netflow Collector
• B.Pathfinder
• C.Syslog Collector
• D.DB Collector