XDR Analyst

0/9 checked

Q_01 domain/d1 · medium single discuss →

A SOC analyst wants to begin detecting attacks immediately after deploying Cortex XDR, without waiting to author custom detection logic. Which capability allows the team to start detecting attacks out of the box?

A 400+ pre-defined correlation rules shipped with the platform
B A single web-based console for policy management
C Live Terminal access to endpoints
D Host Restore for recovering damaged files

Q_02 domain/d1 · medium single discuss →

An analyst is evaluating detection methods and wants to move beyond simple indicator-of-compromise matching to catch targeted attacks. Based on the threat hunting solution brief, which statement best reflects the limitation of IOC-based detection?

A Targeted attacks can't be stopped with IOCs, so more elaborate use cases relying on full TTPs are needed
B IOC-based detection produces the fewest false positives of any technique
C IOCs are the only reliable data source for threat hunting maturity
D IOC detection requires the eXtended Threat Hunting Data Module to function