Cortex Practice Questions

Live Terminal is the correct feature for this purpose. It provides a remote shell (Command Prompt on Windows, bash on Linux/macOS) directly to the endpoint from the Cortex XDR console. The engineer can use this session to execute the PowerShell reconnaissance script, which will then trigger the appropriate behavioral alerts in XDR. This allows for a controlled and effective demonstration of XDR's detection and investigation capabilities for fileless attacks.

The calculation is a straightforward multiplication of the time saved by the analyst's hourly cost. 400 hours * $75/hour = $30,000. This is a direct measure of the operational expense savings achieved through automation with Cortex XSOAR.

The best practice for executing a set of repetitive tasks on a list of items is to use a looping sub-playbook. The three tasks are built into a sub-playbook. In the main playbook, this sub-playbook is called and configured with the 'For each input' loop setting, using the array of IP addresses as the input. This creates a clean, reusable, and scalable design, avoiding cluttered and unmanageable main playbooks.

The best practice is to create the most specific and targeted exception possible. Directly from the alert generated by the Behavioral Threat Protection (BTP) module, an administrator can create an exception. This exception should be scoped to the specific BTP rule that is firing, the application's process path/signer, and applied only to the group of endpoints that run this application. This approach resolves the false positive issue while maintaining maximum security visibility and protection for all other activities on those endpoints.

The Cortex XDR Broker VM is designed specifically for this use case. It acts as a secure proxy and message broker for agents in isolated or air-gapped networks. The agents are configured to communicate with the Broker VM, which then forwards their data to the Cortex XDR cloud tenant and relays policy updates back to the agents. This allows for full agent functionality without requiring direct internet access from each protected server.

The optimal solution is to use XSOAR's multi-tenancy feature. A main (master) tenant can be used for central content management (playbooks, integrations) and threat intelligence, which can then be propagated to the child tenants. Each regional SOC operates within its own child tenant, ensuring strict data isolation and meeting sovereignty requirements. RBAC alone on a single instance does not provide true data segregation. Fully separate instances create significant management overhead for content synchronization.

While WildFire is a powerful tool, it is primarily for file-based threats. Fileless attacks, such as living-off-the-land techniques, do not involve traditional malware files. The key differentiator for Cortex XDR in this context is its Behavioral Threat Protection engine. This engine analyzes chains of events (causality) and uses machine learning to detect anomalous behaviors indicative of an attack, even when no single event or file is inherently malicious. This is crucial for identifying sophisticated, fileless techniques that evade signature and IOC-based detection.

To achieve the customer's goal, two core components are necessary. First, you need configured Integrations for each third-party tool involved: the email gateway (to fetch the email), the sandbox (to detonate the URL), and the firewall (to block the URL). Second, you need a Playbook to define the logic and sequence of operations: parse the alert, extract the URL, send it to the sandbox, evaluate the result, and execute conditional actions on the firewall and email gateway. Dashboards and Threat Intelligence Management are valuable but not essential for executing this core automated workflow.

The most critical step is the knowledge transfer session. This ensures the customer's operational team fully understands their specific deployment, including the configured security policies, alert investigation procedures, and daily management tasks. This direct engagement is far more effective than just providing documentation or support numbers, as it empowers the customer to successfully manage the solution, leading to higher satisfaction and adoption.

This is the correct approach because it uses the appropriate agent type for each environment. The standard Windows agent is for persistent workstations. For non-persistent VDI environments, Cortex XDR has a specific agent and installation method (using the --vdi_name flag) designed to be installed on the golden image. This prevents endpoint identity duplication and licensing issues when new desktops are spun up. The standard Linux agent is correct for the research servers.