An incident response team is investigating a potential breach involving an internal server communicating with a suspicious external IP address. Initial checks on VirusTotal for the external IP yield no results. Upon further investigation, network telemetry suggests the communication pattern is highly unusual and indicative of command-and-control (C2) activity. The team needs to determine if this C2 traffic is associated with a known threat actor, understand their TTPs, and identify specific exploit methods. Which of the following distinct characteristics, when comparing WildFire, Unit 42, and VirusTotal, are most critical for the team to leverage in this situation?
(Select all that apply)

• A. Unit 42's comprehensive, human-curated threat intelligence reports providing detailed adversary profiles, campaign analysis, and TTPs, which can link the observed C2 to known threat groups.
• B. The ability of VirusTotal to conduct real-time deep packet inspection on live network traffic to identify unknown C2 protocols.
• C. WildFire's automatic generation and distribution of new threat signatures to Palo Alto Networks NGFWs upon detecting novel malware, ensuring proactive network protection against the C2.
• D. WildFire's ability to perform deep, proprietary behavioral analysis of submitted malware samples, including C2 communications, even if the IP is not yet publicly blacklisted.
• E. VirusTotal's aggregated community intelligence, allowing for rapid lookup of known bad hashes and URLs from various antivirus vendors and public sandboxes.

Which task should a threat hunter include in the investigation when a Cortex XDR incident contains alertsout a malicious process?

• A. Add the SHA256 file hash to the Cortex XDR global block list.
• B. Immediately isolate the endpoint and delete the identified file.
• C. Disable the account of the user responsible for initiating the process.
• D. Search for the SHA256 file hash on other endpoints in the environment.

A Security Operations Center (SOC) using Palo Alto Networks XSOAR for incident management receives a high volume of alerts daily. An analyst is tasked with prioritizing incidents related to potential data exfiltration. Which of the following incident categorization criteria, when combined, would MOST effectively facilitate accurate prioritization for data exfiltration incidents, considering both technical indicators and business impact?

• A. File Hash Reputation (WildFire) and Endpoint OS Version. File hash is good for malware, but OS version isn't a primary exfiltration indicator.
• B. Source IP Geolocation and Destination Port. While useful, these alone may not capture the full context of data exfiltration.
• C. Alert Volume from a specific sensor and Protocol Used. Alert volume can be misleading, and protocol alone might not signify exfiltration.
• D. Time of Day and User Department. These are primarily contextual and less indicative of immediate threat severity.
• E. Threat Intelligence Feed Match (e.g., C2 IP from Unit 42) and Affected Asset Criticality (e.g., Crown Jewel Asset). This combines technical indicators with business impact for effective prioritization.

How is WildFire typically used by Cortex XDR?

• A. To serve as a cloud-based sandboxing and a malware analysis engine
• B. To be an extension of the Unit 42 incident response team
• C. To build custom correlation rules using XQL
• D. To display the compared artifacts with known bad SHA256 hashes

Which two statements apply to creating scripts in Cortex XSOAR? (Choose two.)

• A. They can be scheduled to run at a later time and day.
• B. They can be protected using a password.
• C. They can be written using Java.
• D. They can be executed with higher permissions.