Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Palo Alto Networks XDR-Analyst Exam - Topic 1 Question 7 Discussion

Which type of IOC can you define in Cortex XDR?
A) Destination IP Address
B) Source IP Address
C) Source port
D) Destination IP Address: Destination

Palo Alto Networks XDR-Analyst Exam - Topic 1 Question 7 Discussion

Actual exam question for Palo Alto Networks's XDR-Analyst exam
Question #: 7
Topic #: 1
[All XDR-Analyst Questions]

Which type of IOC can you define in Cortex XDR?

Show Suggested Answer Hide Answer
Suggested Answer: A

Cortex XDR allows you to define IOC rules based on various types of indicators of compromise (IOC) that you can use to detect and respond to threats in your network. One of the types of IOC that you can define in Cortex XDR isdestination IP address, which is the IP address of the remote host that a local endpoint is communicating with. You can use this type of IOC to identify malicious network activity, such as connections to command and control servers, phishing sites, or malware distribution hosts. You can also specify the direction of the network traffic (inbound or outbound) and the protocol (TCP or UDP) for the destination IP address IOC.Reference:

Cortex XDR documentation portal

Is there a possibility to create an IOC list to employ it in a query?

Cortex XDR Datasheet


by Lenora at Mar 09, 2026, 04:33 AM

Limited Time Offer

25%

Off

Get Premium XDR-Analyst Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Novella
2 days ago
I lean towards B) e-mail address. It's common in threats.
upvoted 0 times
...
Tarra
7 days ago
I think it's A) destination port. Seems straightforward.
upvoted 0 times
...
Stephanie
12 days ago
I thought destination port was the only one allowed!
upvoted 0 times
...
Marleen
17 days ago
Wait, can you really use App-ID as an IOC? That seems off.
upvoted 0 times
...
Levi
2 months ago
Totally agree, full path is definitely one!
upvoted 0 times
...
Kristofer
2 months ago
I think e-mail address is also an IOC option.
upvoted 0 times
...
Janae
2 months ago
You can define destination port as an IOC.
upvoted 0 times
...
Annita
3 months ago
Totally agree, destination port is key for threat detection!
upvoted 0 times
...
Pansy
3 months ago
Wait, can you really use an e-mail address as an IOC?
upvoted 0 times
...
Jody
3 months ago
Full path is definitely an IOC in Cortex XDR.
upvoted 0 times
...
Jacquelyne
3 months ago
I thought App-ID was also an IOC option?
upvoted 0 times
...
Mozell
3 months ago
You can define destination port as an IOC.
upvoted 0 times
...
Margurite
3 months ago
App-ID sounds familiar, but I’m not sure if it qualifies as an IOC in Cortex XDR. I might need to double-check that.
upvoted 0 times
...
Herminia
4 months ago
I practiced a similar question about IOCs last week, and I think full paths were included, but I’m not confident about their relevance in this context.
upvoted 0 times
...
Ashlee
4 months ago
I feel like we covered e-mail addresses as IOCs in class, but I can't recall if they were specifically mentioned for Cortex XDR.
upvoted 0 times
...
Blair
4 months ago
I think I remember something about destination ports being a type of IOC, but I'm not entirely sure if that's the only one.
upvoted 0 times
...

Save Cancel