SecOps-Pro Exam Dumps | Which action should an administrator take to create automated response actions when a user account is

<< Prev Question Next Question >>

Question 28/40

Which action should an administrator take to create automated response actions when a user account is compromised, allowing attacker to upload data to an external IP address and infect a machine on the company network with malware?

A. Create automation rules in Cortex XDR that will trigger for each alert.

B. Create a script in Cortex XSOAR that will run a playbook based on the scenario.

C. Create playbook triggers in Cortex XSIAM and run playbooks for each alert.

D. Map the events as type of Cortex XSOAR incident, then run a playbook.

Question 28/40

LEAVE A REPLY

Download PDF File