A global financial institution uses Cortex XSIAM to monitor its highly regulated environment. They have a strict policy that no agents can be installed on certain legacy critical production servers due to vendor support agreements. However, network-level visibility for these servers is still required for compliance and threat detection. Furthermore, the institution heavily relies on Microsoft 365 for collaboration and email. Which Cortex XSIAM sensor types would be best suited to address these specific requirements, and what data would they ingest?

• A.Deploy Network Sensors (e.g., a dedicated Network Sensor appliance or virtual appliance) to monitor traffic from legacy servers, ingesting NetFlow or full packet capture. Additionally, use Cloud Sensors (e.g., API integration) for Microsoft 365 audit logs and activities.
• B.Implement Host Sensors on the legacy servers, despite the policy, as they are the only way to get necessary visibility. For Microsoft 365, rely on Identity Sensors for user authentication data.
• C.Utilize Identity Sensors (e.g., Active Directory logs) for the legacy servers, focusing on authentication events, and Orchestration Sensors for Microsoft 365 to pull data on demand.
• D.Only rely on third-party SIEM integrations for legacy server network data and Microsoft 365, as XSIAM sensors would not be able to meet these specific requirements without agents.
• E.Deploy Container Sensors for the legacy servers, assuming they are containerized, and use specific Microsoft 365 connectors designed for containerized applications.

Comment: *

Name: *

Email: *

Verification: *

Which response action in Cortex XDR allows a SOC analyst to remotely access an endpoint's command-line interface to perform manual forensic data collection or system remediation?

• A.Remote Shell
• B.Live Terminal
• C.Action Center
• D.Python Console

Comment: *

Name: *

Email: *

Verification: *

Which Cortex XDR component raises an alert when suspicious activity composed of multiple events is detected and deviates from established baseline behavior?

• A.Analytics Engine
• B.Causality Analysis Engine
• C.XQL Query Engine
• D.Cloud Identity Engine

Comment: *

Name: *

Email: *

Verification: *

A Security Operations Center (SOC) using Palo Alto Networks XSOAR for incident management receives a high volume of alerts daily. An analyst is tasked with prioritizing incidents related to potential data exfiltration. Which of the following incident categorization criteria, when combined, would MOST effectively facilitate accurate prioritization for data exfiltration incidents, considering both technical indicators and business impact?

• A.Time of Day and User Department. These are primarily contextual and less indicative of immediate threat severity.
• B.Alert Volume from a specific sensor and Protocol Used. Alert volume can be misleading, and protocol alone might not signify exfiltration.
• C.Threat Intelligence Feed Match (e.g., C2 IP from Unit 42) and Affected Asset Criticality (e.g., Crown Jewel Asset). This combines technical indicators with business impact for effective prioritization.
• D.Source IP Geolocation and Destination Port. While useful, these alone may not capture the full context of data exfiltration.
• E.File Hash Reputation (WildFire) and Endpoint OS Version. File hash is good for malware, but OS version isn't a primary exfiltration indicator.

Comment: *

Name: *

Email: *

Verification: *

Which two statements are relevant to reports in Cortex XDR? (Choose two.)

• A.They can be sent in a password protected PDF version.
• B.They can be automatically pushed to the corporate intranet.
• C.They can use mock data for visualization.
• D.They can have an attached screenshot of an XQL query widget.

Comment: *

Name: *

Email: *

Verification: *