Broadcom CBX Technical Specialist (250-624) Certification Sample Questions

01. A lead responder explains to a junior analyst why the team visualizes an incident's blast radius early in a response.
Which two benefits does visualizing the blast radius provide when scoping the response?
Select the two correct answers.
a) It reveals the full set of affected entities
b) It updates endpoint protection definitions automatically
c) It writes the final compliance report
d) It authenticates analysts into the console
e) It prevents over-containing unaffected systems

02. An analyst must hand off an investigation that includes sensitive data-loss telemetry to a peer who only needs the network findings.
How do RBAC guardrails best support this handover?
a) Grant the peer the analyst's complete case access
b) Export all telemetry so the peer has full context
c) Scope the peer's role to the network telemetry only
d) Copy the sensitive data into a shared open workspace

03. A SOC lead is deciding how to fit AI-generated incident summaries into the team's triage process.
At which point does such a summary add the most value?
a) Only after remediation, when writing the closing report
b) Early, to grasp incident scope before prioritizing
c) Only once the incident has already been escalated
d) Only when a compliance audit later requests it

04. A security lead is explaining why CBX's Microsoft Entra ID synchronization matters to the organization's security posture.
Which outcomes does surfacing shadow IT through directory synchronization support?
Select the two correct answers.
a) Guaranteeing no unsanctioned app is ever installed
b) Automatically patching every unmanaged endpoint
c) Expanding visibility into unmanaged usage
d) Replacing the need for network telemetry entirely
e) Revealing unsanctioned apps that bypass IT review

05. An incident review shows that a phishing site repeatedly lured managed users over several days before it was flagged. Endpoint cleanup is complete, but leadership wants assurance the same site cannot be reached again by anyone in the organization.
What is the most durable hardening step?
a) Revoke the sessions of all the users who clicked
b) Re-image only the endpoints that were hit
c) Generate a compliance report on the case
d) Add the phishing site to the global deny list

06. An analyst begins a shift in the CBX Alerts workspace and is presented with a very large volume of open alerts.
What is the primary purpose of applying the workspace's multi-dimensional filters?
a) Permanently delete low-priority alerts from storage
b) Narrow the alert set by combining several attributes
c) Assign every open alert to a separate analyst
d) Group related alerts into a formal investigation case

07. Which statement best describes the relationship between a detection and a global deny list update in CBX hardening?
a) The deny list update removes the need to detect threats
b) The deny list update affects only the analyst's session
c) The detection automatically encrypts all of the flagged traffic
d) The detection justifies a policy change enforced org-wide

08. A team is deciding when a coordinated cross-domain containment response is warranted rather than a narrower single-domain action.
Which two situations call for cross-domain containment?
Select the two correct answers.
a) A threat is active on the host, network, and in data
b) A dashboard needs a posture summary for a report card
c) A closed incident is being documented for compliance
d) A single quarantined file needs analyst review soon
e) A fast-spreading incident is pivoting between vectors

09.During an active investigation, an analyst sees several alerts that appear to stem from one intrusion and wants to track them together as a single, managed unit of work.
Which CBX capability is designed for grouping related activity in this way?
a) Definition updates delivered by LiveUpdate
b) Multi-dimensional filters in the Alerts workspace
c) Incident summaries from the AI Assistant
d) Case management in the Investigations layer

10. On their own, a single endpoint alert and a single network alert each look low-severity and are easy to dismiss.
Why can correlating them across sources change that assessment?
a) Correlation discards the weaker alert
b) Together the signals reveal a threat
c) Each source raises its own severity
d) Network signals always take precedence