Cybersecurity-Apprentice Practice Test 10 — 10 Questions

Question 1

A security analyst is reviewing a Cortex XDR alert on a Windows workstation where the agent reported a process that spawned from a Microsoft Word document, wrote a copy of itself into the user's Startup folder, and then contacted an external IP address. The analyst confirms the file hash is not present in any threat intelligence feed and the file signature is unsigned. Which Cortex XDR capability most directly generated this detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Behavioral Threat Protection monitoring process activity on the endpoint. The alert describes a behavior chain rather than a known file or an exploit technique. Behavioral Threat Protection is the Cortex XDR module that continuously monitors process, file, and network activity on the endpoint and correlates suspicious sequences such as an Office process spawning a child that achieves persistence and then beacons externally. Because the hash is unknown and unsigned, signature and reputation-based modules cannot explain the detection.

Answer

Exploit Protection blocking a memory corruption attempt in Word

Answer

Malware Protection matching the dropped file against a local signature database

Answer

WildFire cloud analysis of the dropped executable

Question 2

A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)

Accepted Answer

Add the application's executable and its working directory to the Behavioral Threat Protection exclusions for the server policy. Reducing false positives on a trusted server requires narrowly scoped exclusions rather than weakening protection globally. Excluding the specific application executable and its working directory from Behavioral Threat Protection stops the benign process-spawning and file-writing pattern from being flagged, while a malware exclusion on the temporary directory prevents repeated scanning of churning trusted files. Both actions preserve the modules for all other activity on the host.

Answer

Disable the Malware, Exploit, and Behavioral Threat Protection modules entirely on the server policy

Answer

Set the agent to Report mode for all modules so detections are logged but nothing is blocked

Answer

Lower the agent's scan schedule frequency so temporary files are only scanned once per day

Question 3

A security administrator is configuring the Cortex XDR agent on a new Windows endpoint. The administrator wants to ensure that the agent can detect and block known malicious files by comparing file hashes against a cloud-based database. Which prevention module should be enabled?

Accepted Answer

Malware Prevention. Malware Prevention is the Cortex XDR module specifically designed to detect and block known malicious files using signature and hash-based checks, including cloud lookups. The other modules address different threat vectors: Exploit Prevention targets memory exploits, Behavioral Threat Protection analyzes process behavior, and Device Control manages peripherals. Only Malware Prevention directly satisfies the requirement to compare file hashes against a cloud database.

Answer

Behavioral Threat Protection

Answer

Exploit Prevention

Answer

Device Control

Question 4

A security analyst is investigating a suspicious process on a Windows endpoint protected by Cortex XDR. The analyst wants to see the full command line, parent process, and network connections associated with that process. Which Cortex XDR console feature should the analyst use?

Accepted Answer

Incident response investigation view. The incident response investigation view offers a detailed process tree with command lines, parent processes, and network connections, enabling deep forensic analysis. Other console areas provide summary or configuration data, not the granular process details required.

Answer

Alerts table

Answer

Policy audit log

Answer

Threat intelligence dashboard

Question 5

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to modify the memory of another process on a critical server. The analyst wants to determine whether the Cortex XDR agent blocked the attempt or only logged it. Which field in the Cortex XDR alert details should the analyst examine to confirm the action taken by the agent?

Accepted Answer

The 'Action' field in the alert details, which shows 'Blocked' or 'Reported'.. In Cortex XDR, the 'Action' field in alert details explicitly states whether the agent blocked or merely reported the activity. For a memory modification attempt, this field will show 'Blocked' if prevention was enforced, or 'Reported' if the module was in monitor mode. This is the authoritative indicator of the agent's response, making it the correct field to examine.

Answer

The 'Severity' field in the alert details, which indicates the potential impact.

Answer

The 'MITRE Technique' field in the alert details, which maps the activity to a tactic.

Answer

The 'Process Name' field in the alert details, which identifies the offending process.

Question 6

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent service stopped unexpectedly. The administrator restarts the Cortex XDR agent service, but the endpoint still shows as disconnected in the console several minutes later. The endpoint has valid network connectivity to other internal resources, and the agent logs show repeated failures during the initial handshake with the cloud tenant. Which action should the administrator take to resolve the agent-to-cloud communication failure?

Accepted Answer

Verify that the endpoint can reach the required Cortex XDR cloud service endpoints and that any TLS-inspecting proxy presents a trusted certificate chain.. The repeated handshake failures despite working internal connectivity point to a trust or reachability problem on the path to the Cortex XDR cloud service endpoints. Verifying outbound reachability and ensuring any TLS-inspecting proxy presents a trusted certificate chain resolves the most common cause of this symptom without weakening endpoint security or making disruptive changes.

Answer

Disable the Windows Defender Firewall on the endpoint to eliminate all filtering that could interfere with the agent.

Answer

Reinstall the operating system on the endpoint to reset the network stack and trust store.

Answer

Downgrade the agent to an earlier version that uses a different cloud communication protocol.

Question 7

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

Accepted Answer

Endpoint management platforms such as Microsoft Intune or SCCM.. Option C is correct because Cortex XDR agent MSI packages can be distributed through enterprise endpoint management tools like Microsoft Intune or SCCM, which push the installer to managed Windows endpoints and run it with the required system privileges. Option D is correct because the agent package can be installed manually by running the MSI interactively with administrator rights, which is a supported deployment method for individual or small-scale installs. Option E is correct because Active Directory Group Policy Object software installation can assign or publish the Cortex XDR MSI to domain-joined Windows computers, installing it automatically at startup with elevated rights. Option A is not a valid software deployment mechanism, since FM radio broadcasts cannot deliver or execute an MSI package on Windows endpoints. Option B is also invalid and unsafe, as unauthenticated printer port scans cannot inject an MSI payload and do not represent any supported Cortex XDR deployment method.

Answer

Broadcasting the installation package over commercial FM radio frequencies.

Answer

Injecting the MSI payload via unauthenticated network printer port scans.

Question 8

A security analyst is investigating a potential credential compromise in an AWS environment monitored by Prisma Cloud. The analyst needs to determine which IAM user or role made a specific API call that modified a security group to allow unrestricted inbound access. Which AWS service should the analyst query to obtain this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the authoritative source for API activity in AWS, capturing the identity of the caller, the action performed, and the affected resources. By querying CloudTrail events for the security group modification, the analyst can pinpoint the IAM user or role responsible, enabling further investigation into credential compromise.

Answer

Amazon Inspector

Answer

AWS Config

Answer

Amazon GuardDuty

Question 9

A cybersecurity apprentice is analyzing traffic captures and notices that a workstation sends a single packet to a server, and the server responds with a packet that is much larger than the original. The apprentice suspects that the network path cannot handle the larger frame size. Which protocol should the apprentice examine to confirm that the path supports the larger frame size without fragmentation?

Accepted Answer

Path MTU Discovery (PMTUD). Path MTU Discovery (PMTUD) is the correct protocol because it actively determines the largest packet size that can traverse the network path without fragmentation. When a host sends a packet larger than the path MTU, PMTUD relies on ICMP 'fragmentation needed' messages to learn the correct size. In this scenario, the server's larger response likely triggered a PMTUD failure, so examining PMTUD is the right approach.

Answer

ICMP

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Address Resolution Protocol (ARP)

Question 10

A security engineer must give an application running on an Amazon EC2 instance temporary credentials to read objects from a specific S3 bucket. The engineer wants to avoid storing long-term access keys on the instance. Which approach should the engineer use?

Accepted Answer

Attach an IAM role to the instance profile and let the instance retrieve temporary credentials from the instance metadata service.. Attaching an IAM role to an EC2 instance through an instance profile lets the application obtain temporary credentials from the instance metadata service, with automatic rotation and no long-term secrets on disk. IAM user keys, anonymous bucket policies, and embedded presigned URLs either persist secrets or remove authentication, so they do not meet the requirement.

Answer

Create an IAM user with an access key and store the key in a file on the instance.

Answer

Generate a presigned URL for each object and embed the URLs in the application code.

Answer

Configure the S3 bucket policy to allow anonymous GetObject requests from the instance's public IP address.