Broadcom CBX Technical Specialist (250-624) Certification Sample Questions

01. A managed security provider has just moved a retail client onto CBX. Its analysts keep a habit from their previous tool: they page through alerts one at a time and look at a case only when someone escalates it.
Where does CBX guidance say most of an analyst's time should go?
a) Mostly in Investigations, with a smaller share for the Alerts page
b) Mostly on the Alerts page, triaging every alert as it arrives
c) Mostly in the Notification Center, acting on each notification
d) Mostly on the Events page, reading through each telemetry record in turn

02. A threat hunter at a regional bank lists the jobs planned for the week.
Which of them are forensic Device Query work?
(Select two.)
a) Terminating a running process on one host
b) Blocking a known-bad file hash on every device
c) Checking whether event logs were cleared on hosts
d) Forecasting where the attacker moves next
e) Looking for reverse shells on the devices

03. Before a briefing, an analyst wants to see the MITRE ATT&CK detections relevant to an investigation.
Where in the investigation are these shown?
a) The Entities and Remediation tab
b) The Summary tab
c) The Threat Tracer Activity log
d) The File Inventory page

04. A retail group has Data Security Cloud Services connected to its Microsoft 365 tenant, and staff logins, file sharing and email activity appear on the Events page beside endpoint telemetry. After the group acquires a smaller chain, the acquired staff move into the same tenant but keep their own email domain. None of their cloud-app activity appears in CBX.
What should the administrator do?
a) Run Active Directory Sync again so the acquired staff's devices are listed
b) Push enroll the acquired chain's laptops so their activity is collected
c) Create an Event Data Forwarder for that domain
d) Register that domain as a secondary organization domain

05. The automatically generated Threat Tracer graph for an investigation ends at a suspicious host, and the analyst wants to look further at what that host is connected to.
How does Threat Tracer support this?
a) Open a separate investigation for each connected host
b) Switch the Alerts list to Group by Threat ID
c) Run explorations from the host to develop the graph
d) Export the graph and rebuild it on the Events page

06. An analyst at a chemicals manufacturer adds one alert from a second host to an existing Investigation. Immediately afterward, the Entities and Remediation tab lists that host's device together with a parent process and several child processes.
What most likely explains these new entries?
a) The host was quarantined, which lists it automatically
b) Threat Tracer traced lateral movement onto that host
c) CBX automatically opened a fresh Investigation
d) They arrived as the added alert's related entities

07. A suspicious script has turned up on a sales director's laptop. The analyst is not yet sure it is malicious, the laptop must stay on the network for a client demonstration, and nothing that affects other devices should change yet.
Which action fits all three conditions?
a) Quarantine the device entity
b) Quarantine just the script file
c) Deny the script's hash
d) Delete the script from the laptop

08. On a design agency workstation, Microsoft Word starts PowerShell, and PowerShell writes a file to disk. CBX records this as one action involving a parent process, a primary process and a target file.
What does CBX call such a record?
a) An event
b) A Threat ID
c) An Investigation
d) An alert

09. An infrastructure director asks for a document listing each computer's name, operating system and whether protection is installed, to reconcile against the asset register.
Which CBX report fits?
a) The Intrusion Prevention activity summary report
b) The Symantec White Papers threat research report
c) The Device Integrity Computer Status report
d) The Firewall summary report from a template

10. For a pilot, an administrator turns on Monitor Mode in an Adaptive Protection policy and also enables Auto Tune, expecting zero-prevalence behaviors to be set to Deny while the pilot runs. Several weeks later, none of them has been set to Deny.
What is the most likely reason?
a) Auto Tune acts only on behaviors at High prevalence
b) Auto Tune does not run while Monitor Mode is on
c) Auto Tune applies only to untrusted applications
d) Auto Tune waits for Quick-Tune to be run at least once