Question 1

Which Cortex XDR capability extends investigations to an endpoint?

ALog Stitching

BCausality Chain

CSensors

DLive Terminal

Answer : A

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts

Question 2

Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

AIP

Bendpoint hostname

Cdomain

Dregistry entry

Answer : A, C

Question 3

A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.

Where would the user configure the ratio of storage for each log type?

AWithin the TMS, create an agent settings profile and modify the Disk Quota value

BIt is not possible to configure Cortex Data Lake quota for specific log types.

CGo to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota

DWrite a GPO for each endpoint agent to check in less often

Answer : C

Question 4

An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?

AUncommon Local Scheduled Task Creation

BMalware

CNew Administrative Behavior

DDNS Tunneling

Answer : B

Question 5

Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?

Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)

AGeneric Polling Automation Playbook

BPlaybook Tasks

CSub-Play books

DPlaybook Functions