I85PREP
⌘ K
PSE Cortex study materials
PSE Cortex study resources

PSE Cortex practice questions

One question at a time. Build your PSE Cortex understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cortex XSIAM

In Cortex XSIAM, which component is responsible for ingesting and normalizing data from multiple sources before it is stored for querying?

  1. The Cortex Data Lake broker
  2. The data ingestion pipeline Correct answer.
  3. The playbook engine
  4. The incident war room

Explanation

The ingestion pipeline parses, normalizes, and enriches raw event data from brokers and feeds before it lands in the platform's storage layer. Normalization into a common schema is what makes cross-source correlation possible. The other components operate on data after ingestion or on analyst workflows.

Question 2Cortex XSIAM

A security engineer wants Cortex XSIAM to automatically open an incident when a high-severity analytics alert fires. Which mechanism in the platform is designed for this?

  1. A saved search scheduled hourly
  2. A correlation rule in the query library
  3. A dataset retention policy
  4. An automation rule with a matching trigger Correct answer.

Explanation

Automation rules evaluate trigger conditions such as alert severity or type and can create incidents, assign owners, and launch playbooks. They are the native routing layer between detections and incident handling. Saved searches and correlation rules produce alerts but do not by themselves define incident creation logic.

Question 3Cortex XSIAM

Which statement best describes the role of XQL in Cortex XSIAM?

  1. It is a protocol for forwarding syslog to the platform
  2. It is a scripting language for writing endpoint agent plugins
  3. It is a query language used to search and correlate normalized datasets Correct answer.
  4. It is a configuration format for broker deployment

Explanation

XQL is the platform's query language, used across datasets to hunt, build correlation rules, and drive dashboards. It operates on normalized fields rather than raw vendor formats. It is not a deployment format or transport protocol.

Question 4Cortex XSIAM

What is the primary purpose of the Cortex XSIAM identity and asset inventory?

  1. To schedule automated compliance reports
  2. To store raw packet captures for forensic replay
  3. To replace the endpoint protection policy engine
  4. To maintain context about users and hosts that enriches alerts and supports risk scoring Correct answer.

Explanation

The inventory builds a picture of users, endpoints, and cloud assets so detections can be enriched with ownership and criticality context. That context feeds risk scoring and prioritization. It does not capture packets or replace policy enforcement.

Question 5Cortex XSIAM

An analyst needs to see which MITRE ATT&CK techniques are most frequently detected across the environment over the last 30 days. Which Cortex XSIAM capability is most appropriate?

  1. The agent installation audit log
  2. The broker high-availability status page
  3. The playbook task library
  4. The MITRE ATT&CK coverage dashboard Correct answer.

Explanation

The ATT&CK coverage view maps detections to techniques and shows gaps and frequency across the environment. It is purpose-built for technique-level visibility. Playbooks, broker status, and install logs serve unrelated operational purposes.

Question 6Cortex XSIAM

Which data source type does Cortex XSIAM consume directly through a broker for endpoint telemetry?

  1. AWS CloudTrail logs
  2. SMTP gateway message traces
  3. Cortex XDR agent events Correct answer.
  4. NetFlow records from a core switch

Explanation

The Cortex XDR agent reports endpoint telemetry to brokers, which forward it into the platform for normalization and analytics. Cloud and network sources arrive through separate integrations or collectors. This distinction matters when troubleshooting missing endpoint data.

Question 7Cortex XSIAM

What does a Cortex XSIAM playbook primarily define?

  1. The retention period for each dataset
  2. The network segmentation policy for brokers
  3. A sequence of automated and manual tasks executed during incident handling Correct answer.
  4. The licensing tier assigned to each analyst

Explanation

Playbooks orchestrate response by chaining automated tasks, conditional branches, and analyst approvals. They are the operational backbone of incident response in the platform. Retention, segmentation, and licensing are configured elsewhere.

Question 8Cortex XSIAM

Which statement accurately distinguishes an analytics alert from an incident in Cortex XSIAM?

  1. An incident exists only after a playbook completes successfully
  2. An alert and an incident are identical objects with different display names
  3. An alert is always created by an analyst, while an incident is created by the platform
  4. An alert is a detection signal, while an incident is a tracked case that may group related alerts Correct answer.

Explanation

Alerts are individual detection signals produced by analytics or correlation rules, and incidents aggregate related alerts into a case with ownership and workflow state. Automation rules decide when alerts roll up into incidents. The two objects are distinct and neither is merely a renamed form of the other.

Question 9Cortex XSIAM

An analyst writes an XQL query and wants to count events grouped by the acting user over the past day. Which clause combination accomplishes this?

  1. join and union
  2. comp count() by actor_effective_username Correct answer.
  3. filter and limit
  4. fields and sort

Explanation

The comp stage performs aggregation, and count() with a by clause groups results by the specified field. Adding a time filter in the dataset stage scopes the query to the past day. The other clause combinations do not aggregate.

Question 10Cortex XSIAM

A detection must fire only when a user logs in from a country they have never used in the prior 90 days. Which approach best fits Cortex XSIAM?

  1. A static IOC list matched against login IPs
  2. A weekly report reviewed by the SOC manager
  3. A firewall geo-block applied to all users
  4. A behavioral analytics rule that baselines each user's historical login geography Correct answer.

Explanation

Behavioral analytics baseline normal activity per entity and alert on deviations such as a first-seen country. Static lists cannot express per-user history, and blanket geo-blocking is a preventive control rather than a detection. Reviewing reports is not automated detection.

Question 11Cortex XSIAM

An automation rule is configured to create an incident for every alert with severity High or above. Analysts report duplicate incidents for the same host. Which adjustment best addresses this?

  1. Add a grouping condition so related alerts roll into a single incident Correct answer.
  2. Disable the automation rule entirely
  3. Increase the dataset retention period
  4. Lower the severity threshold to Medium

Explanation

Incident grouping conditions consolidate related alerts, such as those sharing a host or user, into one case. This preserves detection coverage while removing duplicates. Lowering the threshold would increase volume, and disabling the rule removes routing.

Question 12Cortex XSIAM

Which Cortex XSIAM feature provides a curated set of detections mapped to attacker tactics and techniques?

  1. The dataset schema editor
  2. The analytics content library Correct answer.
  3. The user role manager
  4. The broker configuration profile

Explanation

The analytics content library delivers prebuilt detection rules organized by MITRE ATT&CK tactic and technique, which teams can enable and tune. Broker profiles, schema editing, and role management are administrative functions.

Question 13Cortex XSIAM

A SOC wants Cortex XSIAM to automatically isolate an endpoint when a confirmed malware alert fires, but only after analyst approval. Which playbook design satisfies this?

  1. A conditional task that requires analyst approval before running the isolate action Correct answer.
  2. A fully automated task that isolates without any approval step
  3. A scheduled report that lists endpoints needing isolation
  4. A task that sends an email notification after isolation completes

Explanation

Playbooks support approval tasks that pause execution until an analyst authorizes the next step, after which the isolation action runs. This balances speed with human control. Isolating without approval or merely notifying after the fact does not meet the requirement.

Question 14Cortex XSIAM

When tuning a noisy analytics rule in Cortex XSIAM, which action best preserves detection intent while reducing false positives?

  1. Raise the severity of every alert the rule produces
  2. Add exclusions scoped to specific benign entities or behaviors Correct answer.
  3. Disable all automation rules that reference the alert
  4. Delete the rule and rely on manual hunting

Explanation

Scoped exclusions suppress known-benign activity without removing the detection for other entities. This is the standard tuning pattern that keeps coverage intact. Deleting the rule loses coverage, and severity changes do not reduce volume.

Question 15Cortex XSIAM

An analyst needs to correlate endpoint process events with authentication events from an identity provider in a single XQL query. Which capability makes this possible?

  1. Normalized schemas that map both sources to common fields Correct answer.
  2. Separate broker clusters per data source
  3. Raw log forwarding without parsing
  4. Manual spreadsheet correlation outside the platform

Explanation

Normalization maps diverse sources onto shared field names, so a single query can join or correlate endpoint and identity events. Without a common schema, cross-source correlation would require custom parsing per source. Separate brokers and raw forwarding do not solve the schema problem.

Question 16Cortex XSIAM

Which Cortex XSIAM component continuously evaluates normalized data against detection logic to generate alerts?

  1. The case management module
  2. The agent installer
  3. The report scheduler
  4. The analytics engine Correct answer.

Explanation

The analytics engine applies detection logic, including behavioral models and correlation rules, to normalized data and emits alerts. Case management organizes the resulting work, while scheduling and installation are unrelated utilities.

Question 17Cortex XSIAM

A team wants risk-based prioritization where a compromised privileged account outranks a compromised standard workstation. Which Cortex XSIAM capability supports this?

  1. Asset and identity criticality used in risk scoring Correct answer.
  2. Static severity assigned equally to all alerts
  3. Retention tiers applied to datasets
  4. Random sampling of alerts for review

Explanation

Risk scoring incorporates asset criticality and identity sensitivity so that high-value entities produce higher-priority findings. Equal static severity ignores context, and sampling or retention does not affect prioritization logic.

Question 18Cortex XSIAM

Which statement best explains why Cortex XSIAM emphasizes a single platform over separate SIEM, SOAR, and XDR consoles?

  1. It eliminates the need for any detection content
  2. It reduces tool sprawl and enables correlation across endpoint, network, and identity data in one schema Correct answer.
  3. It guarantees zero false positives
  4. It removes the requirement for analyst triage

Explanation

Consolidating SIEM, SOAR, and XDR functions lets the platform correlate telemetry across domains using one normalized schema and one workflow. It does not remove the need for detection content, triage, or tuning, and no platform guarantees zero false positives.

Question 19Cortex XSIAM

An analyst wants to test whether a new correlation rule would have fired on historical data before enabling it. Which approach is most appropriate in Cortex XSIAM?

  1. Ask the vendor to simulate the rule externally
  2. Disable all other rules to isolate the new one
  3. Enable the rule in production and wait for alerts
  4. Run the rule's query logic against historical datasets and review matches Correct answer.

Explanation

Running the underlying query against retained historical data lets analysts validate logic and estimate volume before enabling the rule. Enabling directly in production risks noise, and disabling other rules degrades coverage. External simulation is unnecessary when the platform supports backtesting through queries.

Question 20Cortex XSIAM

Which Cortex XSIAM data management consideration most directly affects how far back an analyst can hunt in XQL?

  1. The dataset retention period Correct answer.
  2. The broker CPU allocation
  3. The analyst's role permissions
  4. The number of playbook tasks

Explanation

Retention determines how long events remain queryable, which bounds historical hunting. Brokers affect collection performance, playbook length is unrelated, and role permissions control access rather than data availability.

Question 21Cortex XSIAM

A detection fires on a suspicious PowerShell command. Which enrichment most improves analyst triage in Cortex XSIAM?

  1. The broker's uptime counter
  2. Asset criticality and user role context attached to the alert Correct answer.
  3. The number of datasets in the tenant
  4. The raw command string repeated in the description

Explanation

Attaching asset criticality and identity context lets analysts judge blast radius and prioritize quickly. Repeating the command adds no new information, and broker uptime or dataset counts are irrelevant to the specific alert.

Question 22Cortex XSIAM

An organization wants to measure whether its Cortex XSIAM deployment is closing coverage gaps over time. Which metric set is most meaningful?

  1. Total number of raw events ingested per day
  2. Number of analysts with administrator roles
  3. Average broker memory utilization
  4. Count of enabled detections mapped to ATT&CK techniques versus known gaps Correct answer.

Explanation

Mapping enabled detections to ATT&CK techniques and comparing against identified gaps shows whether coverage is improving. Raw event volume, broker memory, and admin counts measure operations and administration rather than detection coverage.

Question 23Cortex XSIAM

A correlation rule joins endpoint and cloud audit datasets but returns far fewer results than expected. Which cause is most likely in Cortex XSIAM?

  1. The broker is forwarding data too quickly
  2. The playbook has too many approval tasks
  3. The analyst's role lacks report permissions
  4. The join key fields use different names or formats across the two normalized datasets Correct answer.

Explanation

Joins depend on matching key values, so mismatched field names or value formats such as IP versus hostname cause silent drops. Broker speed, playbook approvals, and report permissions do not affect join result counts.

Question 24Cortex XSIAM

An automation rule creates incidents but analysts report that critical alerts sometimes sit unassigned. Which configuration element should be reviewed?

  1. The dataset normalization schema
  2. The incident assignment logic in the automation rule Correct answer.
  3. The broker certificate rotation schedule
  4. The XQL query timeout setting

Explanation

Automation rules can set incident ownership, so missing or misconfigured assignment logic leaves cases unowned. Schema, certificate rotation, and query timeouts do not govern incident ownership.

Question 25Cortex XSIAM

A SOC wants to suppress a known scanner that triggers many low-fidelity alerts while still detecting the same technique from other sources. Which approach best fits Cortex XSIAM?

  1. Raise the severity of the scanner's alerts to High
  2. Create a narrowly scoped exclusion keyed to the scanner's identity or address range Correct answer.
  3. Disable the entire detection rule for all entities
  4. Delete the scanner from the asset inventory

Explanation

A narrowly scoped exclusion targets only the known-benign scanner, leaving the detection active for other sources. Disabling the rule or deleting the asset removes visibility, and raising severity increases noise rather than suppressing it.

Question 26Cortex XSIAM

In Cortex XSIAM, what is the primary role of a dataset when an analyst writes an XQL query?

  1. It is a temporary cache that exists only during a single query execution
  2. It defines the retention period applied to raw logs before ingestion
  3. It stores only playbook definitions and automation task metadata
  4. It is the searchable, structured target that XQL queries read from after normalization Correct answer.

Explanation

Datasets are the structured, normalized storage layers that XQL queries target; analysts query a dataset rather than raw vendor log formats. Retention is configured separately, and datasets persist beyond a single query.

Question 27Cortex XSIAM

Which Cortex XSIAM capability lets analysts apply machine-learning models to historical data to surface anomalous behavior without writing detection logic manually?

  1. Behavioral analytics (UEBA) models Correct answer.
  2. Signature-based antivirus scanning
  3. Manual correlation rule authoring
  4. Static IOC blocklists

Explanation

Behavioral analytics/UEBA models in XSIAM use machine learning over normalized data to baseline and flag anomalous user and entity behavior. Signature scanning and IOC lists are deterministic, and correlation rules are hand-authored logic.

Question 28Cortex XSIAM

A SOC wants Cortex XSIAM to enrich alerts with threat intelligence reputation for observed IP addresses automatically. Which mechanism is the most appropriate?

  1. A manual analyst lookup performed per alert
  2. An indicator extraction and enrichment configuration tied to the relevant dataset fields Correct answer.
  3. A separate spreadsheet maintained by the SOC team
  4. Disabling alerting for any event containing an IP address

Explanation

XSIAM can extract indicators from events and enrich them with threat intelligence by configuring indicator extraction and the fields that carry the observables. This automates reputation lookups at ingestion and alert time rather than relying on manual steps.

Question 29Cortex XSIAM

Which statement best describes how Cortex XSIAM's identity analytics contribute to detecting credential-based attacks?

  1. They only store password hashes for forensic review
  2. They replace endpoint telemetry entirely for authentication monitoring
  3. They baseline normal authentication behavior and flag deviations such as impossible travel or abnormal access patterns Correct answer.
  4. They disable multi-factor authentication during investigations

Explanation

Identity analytics in XSIAM model normal authentication behavior and surface deviations like impossible travel, unusual access times, or anomalous privilege use. They complement rather than replace endpoint telemetry and do not alter authentication controls.

Question 30Cortex XSIAM

An analyst wants to summarize the count of alerts per severity over the last 7 days in XQL. Which clause structure produces a per-severity count?

  1. A sort clause applied before any filtering
  2. A single filter clause with no aggregation
  3. A filter clause followed by a group-by on severity and an aggregation count Correct answer.
  4. A limit clause applied to raw events without grouping

Explanation

To count alerts per severity, XQL needs a filter to scope the time window, a group-by on the severity field, and an aggregation such as count. Sorting or limiting alone does not produce grouped counts.

Question 31Cortex XSIAM

A detection engineer wants a rule to fire only when a process spawns a child process whose command line contains an encoded PowerShell flag, and the parent is a known office application. Which detection approach best expresses this in XSIAM?

  1. A scheduled report emailed to analysts daily
  2. A correlation rule joining parent and child process fields with conditions on both command line and parent image Correct answer.
  3. A dashboard widget showing all process events
  4. A simple field-equality filter on the process name alone

Explanation

Expressing a parent-child relationship with conditions on both the parent image and child command line requires correlating process events and testing both fields. A single field filter cannot capture the relationship, and reports or dashboards are presentation, not detection logic.

Question 32Cortex XSIAM

A SOC notices that a high-severity analytics alert is generated but no incident is created. Which Cortex XSIAM configuration should be reviewed first?

  1. The XQL query syntax used in dashboards
  2. The automation rule conditions that map alerts to incidents Correct answer.
  3. The retention period configured for raw logs
  4. The endpoint agent version installed on servers

Explanation

Incident creation from alerts is governed by automation rules that evaluate alert attributes such as severity and type. If the rule conditions do not match the alert, no incident is created even when the alert fires.

Question 33Cortex XSIAM

An analyst wants to triage an alert by pivoting from an alert to the underlying endpoint process events that triggered it. Which XSIAM workflow best supports this?

  1. Deleting the alert and re-running the detection
  2. Exporting all raw logs to an external SIEM
  3. Reinstalling the endpoint agent
  4. Opening the alert's issue view and pivoting to related events in the relevant dataset Correct answer.

Explanation

XSIAM's issue/alert view links an alert to the events and context that produced it, letting analysts pivot into the relevant dataset for investigation. Exporting logs, reinstalling agents, or deleting alerts do not provide the pivot.

Question 34Cortex XSIAM

A detection team wants to validate a new correlation rule against past data before enabling it in production. Which approach is most appropriate in Cortex XSIAM?

  1. Enable the rule in production and wait for real alerts
  2. Run the rule logic as an XQL query over historical datasets to review matches Correct answer.
  3. Ask analysts to manually review logs for a week
  4. Disable all other rules to isolate behavior

Explanation

Testing detection logic as an XQL query against historical datasets lets engineers see what the rule would have matched without affecting production. This backtesting validates precision and recall before enabling the rule.

Question 35Cortex XSIAM

An organization wants Cortex XSIAM to automatically create a case and assign it to the on-call analyst when a critical alert fires outside business hours. Which combination of features achieves this?

  1. A raw log export job
  2. A dashboard filter plus a scheduled report
  3. An automation rule with time-based conditions plus case assignment logic Correct answer.
  4. A manual triage checklist

Explanation

Automation rules can evaluate alert severity and time conditions, then create cases and assign ownership to the correct analyst. Dashboards, exports, and checklists do not perform automated case creation and assignment.

Question 36Cortex XSIAM

An analyst needs to join endpoint process data with firewall traffic data in a single XQL query. What must be true for the join to return meaningful results?

  1. The query must avoid any filtering clauses
  2. Both datasets must have identical schemas and column counts
  3. Both datasets must share a common field with compatible values to join on Correct answer.
  4. The join must run only on raw unnormalized logs

Explanation

A join correlates records across datasets using a shared key field with compatible values, such as an IP or host identifier. Identical schemas are not required, and filtering is compatible with joins.

Question 37Cortex XSIAM

A SOC observes that a detection based on a rare parent-child process relationship generates many false positives because a common software updater matches the pattern. Which tuning action best preserves detection intent?

  1. Remove all process-based detections from the platform
  2. Disable the detection entirely
  3. Add an exclusion for the known benign updater's specific parent-child signature while keeping the broader rule active Correct answer.
  4. Increase the severity of the detection to Critical

Explanation

A targeted exclusion for the specific benign updater pattern removes the noise while leaving the detection active for genuinely suspicious parent-child relationships. Disabling the rule or removing process detections loses coverage.

Question 38Cortex XSIAM

A security architect is comparing Cortex XSIAM's approach with a traditional multi-tool stack. Which design principle most directly reduces mean time to respond?

  1. Relying solely on periodic log exports to external systems
  2. Requiring analysts to rebuild context in each tool during an investigation
  3. Separate consoles for SIEM, SOAR, and XDR with manual data handoffs
  4. A unified data foundation with integrated detection, investigation, and response workflows Correct answer.

Explanation

Consolidating data, detection, and response in one platform removes handoffs and preserves context across the investigation lifecycle, which shortens response time. Separate consoles and manual handoffs add latency.

Question 39Cortex XSIAM

An analyst is investigating a suspected lateral movement incident and needs to determine which accounts authenticated to a specific host in the past 24 hours. Which XSIAM investigation approach is most efficient?

  1. Query the authentication dataset filtered by destination host and time window, then pivot to related endpoint events Correct answer.
  2. Search each endpoint's local logs individually via remote shell
  3. Rely on the initial alert severity alone to conclude the scope
  4. Wait for the next scheduled weekly report

Explanation

Filtering the authentication dataset by destination host and time window, then pivoting into endpoint events, scopes the accounts involved and their activity. Manual per-host log collection and waiting for reports are slow and incomplete.

Question 40Cortex XSIAM

A detection engineering team wants to measure whether new detections are improving coverage against MITRE ATT&CK techniques over time. Which approach best supports this?

  1. Mapping detections to ATT&CK techniques and reviewing technique coverage trends Correct answer.
  2. Tracking the count of raw events ingested per day
  3. Measuring endpoint agent uptime only
  4. Counting the number of dashboards created each month

Explanation

Mapping detections to ATT&CK techniques allows the team to visualize which techniques are covered and track gaps closing over time. Event volume, dashboard counts, and agent uptime do not measure detection coverage.

Question 41Cortex XDR

In Cortex XDR, which component is responsible for collecting endpoint telemetry and enforcing response actions initiated by the console?

  1. The Cortex XDR agent installed on the endpoint Correct answer.
  2. The Cortex XDR API gateway
  3. The Cortex XDR analytics engine in the cloud
  4. The Cortex XDR management console web server

Explanation

The Cortex XDR agent runs on the endpoint, streams telemetry such as process, network, and file events to the console, and executes response actions like file quarantine or process termination when instructed. The console, analytics engine, and API gateway operate server-side and cannot directly enforce actions on a host without the agent.

Question 42Cortex XDR

A security engineer wants Cortex XDR to automatically terminate a malicious process and quarantine the involved file on an endpoint the moment a known-malware detection fires. Which configuration achieves this?

  1. A prevention profile with malware action set to block and quarantine Correct answer.
  2. An IOC rule with a severity of informational
  3. A BIOC rule with a notification-only response
  4. A custom alert exclusion scoped to the endpoint

Explanation

Prevention profiles define the action the agent takes when a detection occurs, including blocking, terminating, and quarantining the offending file. BIOC and IOC rules generate detections and alerts but do not by themselves specify endpoint enforcement unless paired with an action. Exclusions suppress alerts rather than enforce.

Question 43Cortex XDR

Which Cortex XDR construct is used to define a custom behavioral detection based on a sequence of events rather than a static file hash?

  1. Indicator of Compromise (IOC)
  2. Exception policy
  3. Alert exclusion
  4. Behavioral Indicator of Compromise (BIOC) Correct answer.

Explanation

A BIOC is a behavioral rule that evaluates event sequences and process behavior to detect malicious activity, independent of file hashes. IOCs match static artifacts such as hashes, domains, or IPs. Exclusions and exceptions suppress detections rather than create them.

Question 44Cortex XDR

An analyst needs to isolate a compromised endpoint from the network while keeping the Cortex XDR agent able to communicate with the console. Which response action should be used?

  1. File quarantine
  2. Network isolation of the endpoint Correct answer.
  3. Process termination
  4. Endpoint scan

Explanation

Network isolation restricts host network traffic to only the communication channel required for the agent to remain reachable by the console, allowing the analyst to continue investigation and later release the host. File quarantine, process termination, and endpoint scans address specific artifacts or files but do not sever general network connectivity.

Question 45Cortex XDR

Which statement best describes the role of the Cortex XDR analytics engine?

  1. It provides the web interface for analysts to triage incidents
  2. It stores prevention profiles and pushes them to agents
  3. It correlates endpoint, network, and cloud data to generate detections and alerts Correct answer.
  4. It executes response actions directly on endpoints

Explanation

The analytics engine ingests and correlates telemetry from multiple sources, applies detection logic, and produces alerts and incidents for analyst review. Prevention profiles are managed by the console and enforced by the agent, the web interface is the console UI, and response actions are executed by the agent.

Question 46Cortex XDR

What is the primary purpose of a Cortex XDR alert exclusion?

  1. To quarantine files matching a hash
  2. To suppress alerts that match defined criteria to reduce noise Correct answer.
  3. To increase the severity of matching detections
  4. To block a process from executing on endpoints

Explanation

Alert exclusions define criteria that prevent matching alerts from being generated or displayed, reducing analyst noise from known-benign activity. They do not block execution, quarantine files, or escalate severity; those are handled by prevention profiles or detection tuning.

Question 47Cortex XDR

Which Cortex XDR feature provides a historical, queryable record of endpoint activity that analysts can search to investigate an incident?

  1. BIOC rule
  2. Cortex Data Lake Correct answer.
  3. Prevention profile
  4. Endpoint isolation

Explanation

Cortex Data Lake stores and indexes telemetry so analysts can run queries over historical endpoint, network, and cloud events during investigations. Prevention profiles and BIOC rules define enforcement and detections, and endpoint isolation is a response action.

Question 48Cortex XDR

An analyst wants a Cortex XDR incident to be created automatically when a high-severity alert fires. Which concept groups related alerts into a single incident?

  1. Endpoint scan schedule
  2. Incident grouping based on alert correlation Correct answer.
  3. Alert exclusion
  4. Manual alert assignment

Explanation

Cortex XDR correlates related alerts and groups them into incidents so analysts can investigate a coherent story rather than isolated alerts. Manual assignment, exclusions, and scan schedules do not perform correlation-based grouping.

Question 49Cortex XDR

A Cortex XDR administrator needs to ensure a specific known-good internal application is not blocked by exploit protection. Which mechanism is most appropriate?

  1. A network isolation policy
  2. An IOC rule matching the application's hash as malicious
  3. An exploit protection exception for that application Correct answer.
  4. A BIOC rule targeting the application

Explanation

Exploit protection exceptions allow administrators to exempt specific applications from exploit mitigation modules so legitimate software is not disrupted. BIOC and IOC rules create detections, and network isolation is unrelated to exploit mitigation.

Question 50Cortex XDR

Which Cortex XDR agent capability allows it to detect malicious behavior even when the endpoint is offline?

  1. Local behavioral analysis performed by the agent Correct answer.
  2. Data Lake retrospective queries
  3. Cloud analytics correlation
  4. Console-based BIOC evaluation

Explanation

The agent performs local behavioral analysis so detections and prevention can occur without connectivity to the cloud. Cloud analytics, console BIOC evaluation, and Data Lake queries depend on telemetry reaching the platform and therefore do not provide offline detection.