3 - PALO ALTO SOP

Which incident should a responder prioritize based on overall functional and informational impact to the company?

• A user in the accounting department receives a pop-up message after visiting a website.
• A public-facing web server has multiple failed login attempts over a short period of time.
• An external-facing company website is currently unavailable.
• A large upload of user data from an internal file server to a public website occurs.

Which response action in Cortex XSIAM would be unavailable to a SOC analyst investigating an incident involving a Linux server?

• File search and destroy.
• Live Terminal session initiation.
• Running a script.
• Halting network access.

What is the role of content packs in Cortex XSOAR?

• To provide rebuilt bundles for supporting security orchestration use cases.
• To support technical support teams with relevant information required to troubleshoot.
• To serve as a central location for installing, exchanging, and contributing content.
• To serve as a major software versioning update.

Which action should an administrator take to create automated response actions when a user account is compromised, allowing attacker to upload data to an external IP address and infect a machine on the company network with malware?

• Create automation rules in Cortex XDR that will trigger for each alert.
• Create a script in Cortex XSOAR that will run a playbook based on the scenario.
• Create playbook triggers in Cortex XSIAM and run playbooks for each alert.
• Map the events as type of Cortex XSOAR incident, then run a playbook.

Which two statements apply to creating scripts in Cortex XSOAR? (Choose two.)

• They can be protected using a password.
• They can be scheduled to run at a later time and day.
• They can be written using Java.
• They can be executed with higher permissions.

Which two roles can access data model rules in Cortex XSIAM? (Choose two.)

• Account admin.
• Deployment admin.
• Instance administrator.
• IT administrator.

Which two types of tasks are supported in Cortex XSIAM playbooks? (Choose two.)

• Sub-playbook.
• Script creation.
• Conditional.
• Data collection.

Which scripting language would create a custom widget in Cortex XDR that shows the top five accounts with failed Windows logons in the past 24 hours?

• XQL.
• JavaScript.
• Python.
• PowerShell.

Which solution will minimize mean time to resolution (MTTR) when, as a result of previous malware infection, a company’s Windows endpoint is suffering a small amount of file corruption and modified registry keys?

• Issue a new laptop from the help desk to expedite a clean system.
• Use Live Terminal to connect to the machine and upload files to replace the corrupted files.
• Use group policy objects to push new files and registry key changes to the endpoint.
• Use remediation suggestions to restore the affected files and registry modifications.

With a Windows endpoint, what is required to remove the Cortex XDR agent when the endpoint is no longer online and cannot be managed directly from the management console?

• A Cortex XDR administrator must provide the end user with an offline removal tool created in the management console.
• When running the uninstaller, the administrator must enter an uninstall password from the management console.
• An administrator must use Cytool to disable security protection on the endpoint with an uninstall password.
• An administrator must disable the agent by opening the agent console from the system tray and entering a password.