Cybersecurity-Apprentice Endpoint Security — 20 Questions

Question 1

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR allows administrators to configure isolation exceptions that specify permitted IP addresses or ports for isolated endpoints.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 2

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

Accepted Answer

Ensure the operation mode parameter is set to prevent rather than detect or disable.. The prevention module must be explicitly enabled in the agent installation settings to ensure full enforcement immediately upon installation.

Answer

Disable the self-defense mechanism during MSI deployment.

Answer

Configure the proxy bypass list for local loopback communication.

Answer

Set the heartbeat interval to 60 seconds.

Question 3

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

Accepted Answer

Behavioral Threat Protection. Local Analysis and Exploit/Behavioral Threat Protection guard against process injection and memory-based attacks.

Answer

URL Filtering profile

Answer

Data Loss Prevention (DLP) engine

Answer

DNS Security subscription

Question 4

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 5

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. The connection status in Endpoint Management indicates whether the agent has an active, healthy TLS session with the backend server.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 6

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Quarantined items can be managed and reviewed directly from the Cortex XDR management console under Incident Response or Endpoint views.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 7

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agents require specific Windows OS patches (such as Universal C Runtime updates) and proper MSI execution privileges.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.

Question 8

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

Accepted Answer

Enable Causation Analysis and expanded forensic data collection in the Agent Settings profile for that endpoint group.. Granular agent settings allow administrators to adjust data collection profiles and enable enhanced forensics or BIOC rules.

Answer

Increase the firewall packet capture buffer size to 1 GB.

Answer

Configure a URL filtering block page bypass.

Answer

Enable administrative debug logging on the local syslog server.

Question 9

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures usually stem from expired certificates, SSL inspection proxies intercepting traffic without proper root CA trust, or incorrect proxy settings.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 10

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire acts as the cloud-based threat analysis engine that analyzes unknown files and provides accurate verdicts.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 11

An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?

Accepted Answer

Approve the system extension and network filter configurations via Mobile Device Management (MDM) policy or local system settings.. Modern macOS versions require explicit user or MDM approval for system extensions and kernel extensions used by security software.

Answer

Disable SIP (System Integrity Protection) permanently on all Mac endpoints.

Answer

Reformat the drive using the APFS file system format.

Answer

Configure the Endpoint Security client to run as a root daemon via launchd.

Question 12

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Accepted Answer

Configure Syslog forwarding or use the Cortex XDR streaming API to export alerts and BIOC data to the SIEM.. Cortex XDR provides integration via Syslog forwarding or REST APIs to stream alerts and logs to third-party SIEM platforms.

Answer

Configure NetFlow export on the local endpoint network interface card.

Answer

Export daily CSV reports from the Cortex XDR console via email.

Answer

Enable SNMP trap generation inside the local Windows Event Viewer settings.

Question 13

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

Accepted Answer

Cortex XDR agent. The Cortex XDR agent is installed directly on endpoints to execute prevention and gather telemetry.

Answer

Panorama management server

Answer

Prisma Access cloud security service

Answer

WildFire cloud analysis engine

Question 14

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

Accepted Answer

Enable Anti-Tamper protection with a designated administrator password.. Anti-tamper protection prevents unauthorized users or malware from stopping services, deleting files, or uninstalling the agent.

Answer

Configure Windows BitLocker drive encryption on the system drive.

Answer

Enable User Account Control (UAC) at the default notification level.

Answer

Set the endpoint network profile to Public domain.

Question 15

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. Local Analysis and Exploit Protection prevent memory-based and fileless attack techniques like heap spraying or DLL injection.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.

Question 16

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

Accepted Answer

Use the Cortex XDR upgrade feature in Endpoint Management to push the new agent version to selected endpoint groups.. Cortex XDR provides centralized agent version management where administrators can schedule or push upgrades to endpoint groups.

Answer

Reinstall the operating system on all endpoints using a clean golden image.

Answer

Manually log into every individual endpoint and run the uninstall wizard.

Answer

Modify the DNS records to point agents to a secondary upgrade server.

Question 17

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

Accepted Answer

Causation Analysis view showing the graphical chain of events originating from the root cause process.. Cortex XDR Causation Analysis provides a graphical causality chain showing the relationship between processes, files, registry modifications, and network connections.

Answer

Windows Event Viewer custom filtered operational logs.

Answer

Network packet capture waveform analyzer.

Answer

Global Threat Intelligence map showing country-of-origin IP addresses.

Question 18

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

Accepted Answer

BIOC alerts detect suspicious sequences of system events and behaviors rather than matching known file signatures.. BIOC alerts identify malicious sequences of events or techniques rather than relying solely on file signatures.

Answer

BIOC alerts are generated exclusively by network firewall threat logs.

Answer

BIOC alerts only trigger when a user manually initiates a full system scan.

Answer

BIOC alerts require an active WildFire cloud subscription to function locally.

Question 19

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Accepted Answer

Isolate the endpoint from the network to prevent lateral movement.. Administrators can isolate compromised hosts and initiate remote remediation actions such as file quarantine and script execution.

Answer

Reboot the physical datacenter HVAC cooling systems.

Answer

Modify core BGP routing tables on enterprise core routers.

Answer

Reset enterprise Wi-Fi SSID pre-shared keys.

Question 20

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR supports legacy operating systems with specific legacy agent versions that provide core prevention capabilities supported by those OS architectures.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.