XSIAM-Analyst 무료 덤프문제 온라인 액세스

An on-demand malware scan of a Windows workstation using the Cortex XDR agent is successful and detects three malicious files. An analyst attempts further investigation of the files by right-clicking on the scan result, selecting "Additional data," then "View related alerts," but no alerts are reported.
What is the reason for this outcome?

• A.The malicious files are currently in an excluded directory in the Malware Profile.
• B.The malicious files were true positives and were automatically quarantined from the scan results.
• C.The malware scan action detects malicious files but does not generate alerts for them.
• D.The malicious files were false positives and were automatically removed from the scan results.

Based on the image below, which two determinations can be made from the causality chain?
(Choose two.)

• A.Three alerts in total were generated by the agent on the endpoint.
• B.Cortex XDR agent malware profile module applied is set to "Report" mode.
• C.Malware.pdf.exe is responsible for the entire chain of execution resulting in the alerts.
• D.The process cmd.exe is responsible for the entire chain of execution resulting in the alerts.

In the Identity Threat Detection and Response (ITDR) module, what does "compromised identity" typically indicate?

• A.Missing antivirus signature
• B.Unauthorized access or behavior from a known identity
• C.Failed software update
• D.USB device connection

An alert involves credential dumping. Reviewing the causality chain, you notice the following:
- lsass.exe is accessed by powershell.exe
- Prior to this, cmd.exe launched the PowerShell script
What can you infer?

• A.Possible credential access tactic
• B.There is an indicator of defense evasion
• C.It's a known benign service activity
• D.Scripted behavior likely launched manually

Which two features can trigger Cortex XSIAM playbooks? (Choose two.)

• A.Indicator query
• B.Detection rule
• C.Alert
• D.Action center