Question 86
An administrator attempts to initiate a Live Terminal session to a remote Windows endpoint but the connection repeatedly times out. The endpoint status is Connected in the Cortex XSIAM console, and general agent check-ins are successful. The network team confirms that traffic to the Cortex XSIAM tenant on port 443 is allowed.
Which network security configuration will cause this timeout behavior?
Question 87
An XSIAM Playbook is designed to contain a ransomware outbreak. A critical step involves isolating affected endpoints. The Playbook task chosen is 'Isolate Endpoint'. Which of the following conditions must be met for this task to successfully isolate a Windows endpoint using the Cortex XDR agent?
Question 88
A critical server application occasionally executes system-level commands for legitimate maintenance tasks, which sometimes resemble malicious activity. An existing XSIAM BIOC rule flags any 'Process.CommandLine contains 'whoami' OR Process.CommandLine contains 'net user'' on critical servers. This rule is generating too many false positives. To reduce these false positives without missing actual attacks, how should the XSIAM engineer optimize this rule using context from the XDR dataset?
Question 89
Consider the following XSIAM correlation rule pseudo-code designed to detect a suspicious 'Golden Ticket' attack attempt, where an attacker might try to use a forged Kerberos ticket:
Based on a new threat intelligence report, a 'Golden Ticket' attack can now be executed without 'mimikatz.exe' and often involves a 'service ticket' request from a newly created user account. How should this XSIAM rule be optimized to align with the updated threat intelligence, while maintaining a low false positive rate?
Question 90
A large software development company plans to deploy Cortex XSIAM agents on its Linux-based build servers. These servers have strict change control, custom kernel modules, and require minimal performance impact during active compilation. What advanced planning and configuration steps are crucial to ensure stability and performance, specifically considering the unique environment of build servers?