IT Certification Exam Questions & Answers

QUESTION 35
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;

What is the remaining configuration?
A)

B)

C)

D)

QUESTION 36
Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)

QUESTION 37
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

QUESTION 38
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

QUESTION 39
Which Cortex XDR capability extends investigations to an endpoint?

QUESTION 40
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

QUESTION 41
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)

QUESTION 42
In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

QUESTION 43
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

QUESTION 44
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

QUESTION 45
Which CLI query would bring back Notable Events from Splunk?
A)

B)

C)

D)

QUESTION 46
Which step is required to prepare the VDI Golden Image?

QUESTION 47
Which option describes a Load-Balancing Engine Group?

QUESTION 48
When a Demisto Engine is part of a Load-Balancing group it?

QUESTION 49
How can you view all the relevant incidents for an indicator?

QUESTION 50
When analyzing logs for indicators, which are used for only BIOC identification’?

QUESTION 51
What is the difference between an exception and an exclusion?

QUESTION 52
What are process exceptions used for?

QUESTION 53
Which option is required to prepare the VDI Golden Image?

QUESTION 54
Which two entities can be created as a BIOC? (Choose two.)

QUESTION 55
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

QUESTION 56
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )

QUESTION 57
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)