During a forensic investigation using Cortex XDR, an analyst discovers a persistent backdoor communicating with an external IP address (192.0. 2.100). The analyst needs to quickly determine if this IP address is associated with known malicious activity and implement a preventative measure. Which of the following actions, leveraging Cortex products, would be the most efficient and comprehensive approach?

• A. Initiate a 'Live Response' session in Cortex XDR on affected endpoints to block outbound connections to 192.0.2.100 locally.
• B. Create a new 'Alert Rule' in Cortex XDR specifically for connections to 192.0.2. lee to monitor future attempts.
• C. Perform a 'Packet Capture' in Cortex XDR for all traffic to and from 192.0.2.100 to gather more evidence before taking any action.
• D. Manually add 192.0.2.100 to a custom Block List on the Next-Generation Firewall (NGFW) and then perform a 'Threat Vault' lookup in Cortex XDR.
• E. Utilize Cortex XSOAR to orchestrate a lookup of 192 .0.2.100 against multiple integrated threat intelligence feeds (e.g., Unit 42, AlienVault OT X), and if identified as malicious, automatically push a dynamic block rule to all relevant NGFWs.

An incident in Cortex XSIAM displays alerts for "Lsass Memory Dump" originating from a process named proc_dump.exe. The process is unsigned, has an unknown reputation, and was launched from a temporary directory. Which initial verdict applies to this incident?

• A. False negative
• B. True positive
• C. False positive
• D. True negative

What determines the indicator layout displayed and the scripts that will run on an indicator of compromise (IOC) in Cortex XSIAM?

• A. Origin
• B. Size
• C. Type
• D. Date

A security operations center (SOC) analyst is reviewing the current queue of incidents in the Cortex XDR console. The goal is to prioritize a new threat that signifies a confirmed, deep-seated persistent compromise and represents the greatest risk of immediate, irreparable damage to core network assets. Which incident should the analyst prioritize for immediate containment and remediation?

• A. A spike of 1500 blocked email messages containing common phishing URLs was recorded in the last hour, and no users can be detected as having clicked on the links.
• B. The nightly data integrity check failed for the main customer billing database, reporting corrupt indices due to an unknown database process.
• C. An unknown internal host is communicating with a known command-and-control (C2) server over a non-standard port after a successful lateral movement activity was found on a domain controller.
• D. A third-party security scanner reports an unpatched critical vulnerability with a Common Vulnerability Scoring System (CVSS) score of 9.8 on a secondary internal application server.

A Security Operations Center (SOC) using Palo Alto Networks XSOAR for incident management receives a high volume of alerts daily. An analyst is tasked with prioritizing incidents related to potential data exfiltration. Which of the following incident categorization criteria, when combined, would MOST effectively facilitate accurate prioritization for data exfiltration incidents, considering both technical indicators and business impact?

• A. File Hash Reputation (WildFire) and Endpoint OS Version. File hash is good for malware, but OS version isn't a primary exfiltration indicator.
• B. Threat Intelligence Feed Match (e.g., C2 IP from Unit 42) and Affected Asset Criticality (e.g., Crown Jewel Asset). This combines technical indicators with business impact for effective prioritization.
• C. Alert Volume from a specific sensor and Protocol Used. Alert volume can be misleading, and protocol alone might not signify exfiltration.
• D. Time of Day and User Department. These are primarily contextual and less indicative of immediate threat severity.
• E. Source IP Geolocation and Destination Port. While useful, these alone may not capture the full context of data exfiltration.