Loading questions...
Updated
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Create a free account to unlock all questions for this exam.
Log In / Sign UpA Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation."
Which response will mitigate the threat?
A Cortex XSIAM analyst is reading a blog that references an unfamiliar critical zero-day vulnerability. This vulnerability has been weaponized, and there is evidence that it is being exploited by threat actors targeting a customer's industry.
Where can the analyst go within Cortex XSIAM to learn more about this vulnerability and any potential impacts on the customer environment?
Which pane in the User Risk View will identify the country from which a user regularly logs in, based on the past few weeks of data?
Which interval is the duration of time before an analytics detector can raise an alert?
Which attributes can be used as featured fields?
Which dataset should an analyst search when looking for Palo Alto Networks NGFW logs?
Which two actions will allow a security analyst to review updated commands from the core pack and interpret the results without altering the incident audit? (Choose two.)
How can a SOC analyst highlight alerts generated on C-level executive hosts?
An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files.
What could be the reason for this issue?
What information is provided in the timeline view of Cortex XSIAM?