EMT Practice Test

1. Question Content...

---

Question1: While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

Question2: What is the purpose of targeting software vendors in a supply-chain attack?

Question3: Which of the following represents the correct relation of alerts to incidents?

Question4: When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?

Question5: Which of the following policy exceptions applies to the following description?
'An exception allowing specific PHP files'

Question6: When creating a scheduled report which is not an option?

Question7: When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

Question8: Which statement regarding scripts in Cortex XDR is true?

Question9: What kind of the threat typically encrypts user files?

Question10: Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Question11: A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

Question12: To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Question13: When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

Question14: What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

Question15: Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

Question16: Which profiles can the user use to configure malware protection in the Cortex XDR console?

Question17: Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Question18: What does the following output tell us?

Question19: Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

Question20: What is the purpose of the Unit 42 team?