Palo Alto Networks XDR Analyst - XDR-Analyst 模擬練習

A. Security Admin Dashboard

B. Data Ingestion Dashboard

C. Incident Management Dashboard

D. Security Manager Dashboard

A. Destination IP Address

B. Destination IP Address: Destination

C. Source IP Address

D. Source port

A. a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system

B. a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the "swap"

C. a hierarchical database that stores settings for the operating system and for applications

D. a central system, available via the internet, for registering officially licensed versions of software to prove ownership

A. dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

B. dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

C. dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

D. dataset = xdr_data
| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
| fields action_process_image

A. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

B. Conduct a thorough Endpoint Malware scan.

C. Enable DLL Protection on all servers but there might be some false positives.

D. Create lOCs of the malicious files you have found to prevent their execution.

A. Forensics module

B. Live Terminal module

C. Host Insights module

D. Device Control Violations module

A. Cortex XDR Cloud per Host

B. Host Insights

C. Cortex XDR Pro per Endpoint

D. Cortex XDR Pro per TB

A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

B. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.

C. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.

D. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.

A. Support exception

B. Process exception

C. Local file threat examination exception

D. Behavioral threat protection rule exception

A. Every alert creates a new Incident.

B. Only alerts with the same host are grouped together into one Incident in a given time frame.

C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

D. Alerts that occur within a three-hour time frame are grouped together into one Incident.