SecOps-Pro 무료 덤프문제 온라인 액세스

A custom script activity, previously categorized as non-malicious, suddenly begins executing a series of unusual file operations and network connections. Cortex XDR detects this change, aggregates the sequence of abnormal events, and immediately raises a high-severity alert. Which Cortex XDR capability uses statistical baselining and machine learning to specifically identify this type of activity?

• A.Threat Hunting Engine
• B.Causality View
• C.Incident Management Engine
• D.Analytics Engine

What is the primary function of the Causality Analysis Engine in supporting actions following a security incident?

• A.Grouping malicious processes under the Behavioral Threat Protection (BTP) verdict
• B.Providing real-time Live Terminal access to all endpoints involved in the incident
• C.Automatic suppression of low-severity alerts to focus the analyst's attention
• D.Identifying the forensic timeline to trace the attack from root cause to final actions

Which response action in Cortex XSIAM would be unavailable to a SOC analyst investigating an incident involving a Linux server?

• A.File search and destroy
• B.Halting network access
• C.Running a script
• D.Live Terminal session initiation

Which task is primarily handled by Identity Analytics?

• A.Suspicious login identification
• B.Credential phishing detection
• C.Threat intelligence ingestion
• D.Policy enforcement

Which action should an administrator take to create automated response actions when a user account is compromised?

• A.Run a custom script from the Cortex XDR script library.
• B.Map the events as a type of Cortex XSOAR incident, then run a playbook.
• C.Create playbook triggers in Cortex XSIAM and run playbooks for each alert.
• D.Create a script in Cortex XSOAR that will run a playbook based on the scenario.