Question 31
A zero-day vulnerability in a widely used web application is actively being exploited, leading to immediate concern for your organization's internet-facing servers. While vendor patches are not yet available, your Palo Alto Networks NGFW is deployed. Which temporary compensating control, leveraging NGFW capabilities, would offer the best immediate protection against this zero-day exploit without disrupting legitimate traffic or requiring custom signatures?
Question 32
During a forensic investigation, an analyst needs to understand the exact sequence of events leading to a ransomware infection. This requires not only identifying the malicious executable but also tracing its parent processes, network connections, file modifications, and registry changes. Which Cortex XDR sensor feature or element is most critical for reconstructing this detailed attack storyline, and how does it facilitate this?
Question 33
A Security Operations Center (SOC) is migrating its log ingestion strategy to Cortex XSIAM. They have a critical business application generating logs in a custom JSON format with nested objects and arrays. The existing SIEM struggled to parse this efficiently, leading to incomplete security analytics. What is the most effective Cortex XSIAM data ingestion process to ensure accurate parsing and enrichment of these complex JSON logs, and why?
Question 34
An organization is deploying Cortex XDR to a highly sensitive Linux server farm, primarily running critical applications on Red Hat Enterprise Linux (RHEL) 8. They have strict change control policies and require granular control over which agent modules are active. The security team wants to ensure that only the Exploit Protection, Behavioral Threat Protection, and WildFire modules are enabled initially, with the option to enable other modules like Data Loss Prevention (DLP) or Host Insights at a later date, without reinstalling the agent. Which of the following Cortex XDR features and configurations would best facilitate this requirement, considering the need for both initial deployment control and future flexibility?
Question 35
A Security Operations Center (SOC) analyst is investigating a suspected phishing incident where an employee clicked on a malicious link. The XSOAR playbook needs to automatically enrich the incident with threat intelligence, isolate the affected endpoint, and notify relevant stakeholders. Which of the following XSOAR playbook features are essential to achieve this level of automation and orchestration?