What is the Wildfire analysis file size limit for Windows PE files?
A. 100MB
B. No Limit
C. 1GB
D. 500MB
正解:A
解説: (Pass4Test メンバーにのみ表示されます)
質問 2:
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?
A. Security Manager Dashboard
B. Incident Management Dashboard
C. Security Admin Dashboard
D. Data Ingestion Dashboard
正解:B
解説: (Pass4Test メンバーにのみ表示されます)
質問 3:
Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.
A. Exfiltration, Command and Control, Privilege Escalation
B. Exfiltration, Command and Control, Collection
C. Exfiltration, Command and Control, Lateral Movement
D. Exfiltration, Command and Control, Impact
正解:C
解説: (Pass4Test メンバーにのみ表示されます)
質問 4:
What is the difference between presets and datasets in XQL?
A. A dataset is a Cortex data lake data source only; presets are built-in data source.
B. A dataset is a third-party data source; presets are built-in data source.
C. A dataset is a built-in or third-party source; presets group XDR data fields.
D. A dataset is a database; presets is a field.
正解:C
解説: (Pass4Test メンバーにのみ表示されます)
質問 5:
When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?
A. This isn't supported, you have to exit the dashboard and go into the Widget Library first to create it.
B. Click on "Save to Action Center" in the dashboard and you will be prompted to give the query a name and description.
C. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.
D. Click the three dots on the widget and then choose "Save" and this will link the query to the Widget Library.
正解:C
解説: (Pass4Test メンバーにのみ表示されます)
質問 6:
What contains a logical schema in an XQL query?
A. Field
B. Dataset
C. Array expand
D. Bin
正解:A
解説: (Pass4Test メンバーにのみ表示されます)
質問 7:
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?
A. threat_event
B. event_type
C. causality_chain
D. endpoint_name
正解:B
解説: (Pass4Test メンバーにのみ表示されます)
質問 8:
Can you disable the ability to use the Live Terminal feature in Cortex XDR?
A. No, it is a required feature of the agent.
B. Yes, via Agent Settings Profile.
C. Yes, via the Cortex XDR console or with an installation switch.
D. No, a separate installer package without Live Terminal is required.
正解:B
解説: (Pass4Test メンバーにのみ表示されます)
1098 お客様のコメント





Asano -
Palo Alto Networksの問題集はなにから何まで素晴らしかった。XDR-Analystに合格しました。ありがとうございます。