Palo Alto Networks System Engineer – Cortex — Question 22

Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

Answer options

• A. causality group owner
• B. chain's alert initiator
• C. adversary's remote process
• D. relevant shell

Correct answer: A

Explanation

The correct answer, A. causality group owner, is identified by the Cortex XDR agent as the primary trigger for initiating an event sequence. The other options do not represent the initiating factor; for instance, B refers to a component in the alerting mechanism, while C and D pertain to external processes and commands, respectively.