Cybersecurity-Apprentice Endpoint Security — 20 Questions

Question 1

An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?

Accepted Answer

Approve the system extension and network filter configurations via Mobile Device Management (MDM) policy or local system settings.. On macOS Catalina (10.15) and later, kernel extensions are deprecated in favor of System Extensions, and loading them requires explicit user or MDM approval. The Cortex XDR agent installs a system extension plus a network content filter, both of which must be approved via the Privacy & Security pane or pushed silently through an MDM profile using the 'SystemPolicyAllFiles' and 'NetworkFilter' payloads. Without this approval, the extension is blocked and the agent cannot fully load.

Answer

Disable SIP (System Integrity Protection) permanently on all Mac endpoints.

Answer

Reformat the drive using the APFS file system format.

Answer

Configure the Endpoint Security client to run as a root daemon via launchd.

Question 2

A security administrator at a mid-sized company is preparing to protect employee laptops that run Windows 10. The administrator wants to ensure that malicious files are blocked before they can execute and also wants the ability to roll back any changes made by ransomware. Which Cortex XDR agent capability directly addresses these requirements?

Accepted Answer

Malware prevention with local analysis and WildFire integration. Malware prevention with local analysis and WildFire integration blocks malicious files before execution and can roll back ransomware changes. This combination directly addresses the need to stop file-based threats and reverse damage, unlike other modules focused on network, behavior, or exploits.

Answer

Exploit mitigation and kernel-level protection

Answer

Host firewall and device control

Answer

Behavioral threat protection and analytics

Question 3

A security administrator at a mid-sized company notices that a Cortex XDR-protected Windows workstation has a file named invoice_2024.doc.exe sitting in the user's Downloads folder. The file was downloaded from an external email link, and the user claims nothing happened when they double-clicked it. The administrator wants to determine whether Cortex XDR has already taken action on this file. Which console location should the administrator check first to see the agent's verdict and any resulting action on that specific file?

Accepted Answer

The Incident Response view, filtered by the endpoint name and the file hash, to see the agent's verdict and any quarantine or block action.. The Incident Response view is the correct place because it records agent verdicts and the resulting enforcement actions per endpoint and file. Reviewing it filtered by endpoint and hash reveals whether the file was quarantined, blocked, or allowed, which is exactly what the administrator needs to determine before deciding on further response steps.

Answer

The Endpoint Management view, filtered by the endpoint name, to inspect the agent version and last heartbeat timestamp.

Answer

The Policy Management view, filtered by the endpoint's assigned policy, to review which prevention modules are enabled.

Answer

The Threat Intelligence view, filtered by the file name, to look up the file's reputation score across WildFire.

Question 4

A helpdesk technician receives a call from a user whose Windows 10 laptop is running slowly and showing pop-up ads. The technician suspects malware and wants to use the Cortex XDR agent to perform a full scan of the endpoint. Which action should the technician take from the Cortex XDR management console to initiate a full malware scan on the endpoint?

Accepted Answer

Navigate to Endpoints > All Endpoints, select the endpoint, and click 'Scan'.. To initiate a full malware scan on an endpoint, the technician should use the Endpoints page in the Cortex XDR management console. Selecting the endpoint and clicking 'Scan' triggers the agent to perform a scan based on the configured scan profile. This is the direct and correct method.

Answer

Navigate to Action Center > Scans, select the endpoint, and click 'Scan'.

Answer

Navigate to Policies > Endpoint Protection, select the policy, and click 'Scan'.

Answer

Navigate to Incidents > All Incidents, select the incident, and click 'Scan'.

Question 5

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to access the LSASS memory on a Windows server. The analyst wants to determine whether the attempt was successful and what data might have been accessed. Which Cortex XDR capability provides the most detailed forensic information for this investigation?

Accepted Answer

Causality Chain with Telemetry. The Causality Chain with Telemetry in Cortex XDR includes granular telemetry on process interactions, including memory access events. It can reveal the accessing process, the target process (LSASS), and whether the access was successful, along with the memory regions involved. This is the most detailed forensic view for investigating credential dumping attempts.

Answer

Endpoint Data Collection (EDC)

Answer

Memory Protection Events

Answer

Process Execution History

Question 6

A Cortex XDR administrator is reviewing endpoint protection settings for a group of Windows servers that host a custom line-of-business application. The application writes to unusual registry keys and spawns child processes that resemble suspicious behavior, causing repeated blocks. The administrator wants to reduce false positives while retaining meaningful protection against real threats. Which TWO configuration actions should the administrator take in Cortex XDR? (Choose two.)

Accepted Answer

Create a Behavioral Threat Protection exception scoped to the application's file path and the specific behavior causing the block.. Scoped exceptions and publisher trust exceptions both reduce false positives narrowly. A behavior-specific exception targets the exact blocked action for the known application path, while trusting the signed publisher prevents its binaries from being treated as suspicious. Together they preserve the Behavioral Threat Protection and Malware modules for genuine threats instead of disabling protection group-wide.

Answer

Disable the Malware prevention module entirely on the server group to stop all file-based blocks.

Answer

Uninstall the Cortex XDR agent from the affected servers and rely on the operating system firewall instead.

Answer

Set the agent to Report mode for the entire server group so no prevention actions occur.

Question 7

A security analyst notices that a Cortex XDR agent on a Linux server has stopped reporting to the management console. The analyst wants to verify the agent's status and connectivity locally on the server. Which command should the analyst run?

Accepted Answer

sudo /opt/traps/bin/cytool status. The cytool status command provides a comprehensive local status of the Cortex XDR agent, including connectivity to the management console. Other commands either check service state, logs, or network connections, but do not offer the same direct diagnostic summary.

Answer

sudo tail -f /var/log/cortex-xdr.log

Answer

sudo netstat -tulpn | grep cortex

Answer

sudo systemctl status cortex-xdr-agent

Question 8

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR network isolation blocks all traffic except management communication by default. To allow a specific forensic server to reach an isolated endpoint, the responder configures IP-based isolation exceptions in the Cortex XDR profile (or via the isolation policy), whitelisting the forensic server's IP so its traffic is permitted while all other traffic remains blocked. This preserves containment while enabling evidence collection.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 9

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

Accepted Answer

Ensure the operation mode parameter is set to prevent rather than detect or disable.. The Cortex XDR agent's operation mode determines whether it only detects/reports or actively blocks malicious activity. To run in full prevention mode without user intervention, the installation profile must set the operation mode to 'prevent' (as opposed to 'detect' or 'disable'), which is configured in the agent installation package/profile before deployment. This ensures the endpoint enforces policy from the moment the agent registers.

Answer

Disable the self-defense mechanism during MSI deployment.

Answer

Configure the proxy bypass list for local loopback communication.

Answer

Set the heartbeat interval to 60 seconds.

Question 10

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

Accepted Answer

Behavioral Threat Protection. Behavioral Threat Protection (BTP) is the Cortex XDR module that monitors process behavior in real time and detects post-exploitation techniques such as process injection, credential dumping, and shellcode execution. Because polymorphic malware changes its file signature but still performs the same malicious behaviors (e.g., injecting into legitimate Windows processes), BTP catches it by analyzing the sequence of actions rather than static indicators. This makes it the primary module responsible for blocking process injection attempts.

Answer

URL Filtering profile

Answer

Data Loss Prevention (DLP) engine

Answer

DNS Security subscription

Question 11

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

Accepted Answer

In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.. Behavioral threat protection exceptions in Cortex XDR are created in the management console under Profiles, where you can specify the script by file hash (or other indicators) to allow execution while keeping behavioral monitoring active for other threats. This is the surgical approach that preserves security posture.

Answer

Change the Agent settings to bypass all SSL decryption rules.

Answer

Disable the Local Analysis module entirely for the target endpoint group.

Answer

Modify the Windows Firewall inbound rules on the local endpoint.

Question 12

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

Accepted Answer

Check that the connection status shows Connected with a recent heartbeat timestamp.. In the Cortex XDR Endpoint Management view, the definitive indicator that an agent is actively communicating with the cloud tenant is the connection status showing 'Connected' alongside a recent heartbeat timestamp. The heartbeat is a periodic check-in (typically every few minutes) that confirms live bidirectional communication between the agent and the Cortex XDR cloud. A stale or missing heartbeat indicates the agent is offline or blocked.

Answer

Ensure the endpoint operating system is running the latest patch level.

Answer

Confirm that the kernel module version matches the BIOS version.

Answer

Verify that the local disk usage is below 10 percent.

Question 13

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

Accepted Answer

In the Cortex XDR management console under Incident Response, view the Action Center or Endpoint Management quarantine tab.. Cortex XDR agents report quarantine actions to the Cortex XDR management console, where administrators can review them under Incident Response > Action Center or the Endpoint Management quarantine tab. These views show the file hash, path, endpoint, and the action taken (quarantined, blocked, allowed), providing full auditability of endpoint response actions.

Answer

In the DNS Security query logs.

Answer

In the WildFire analysis report repository exclusively.

Answer

In the global firewall traffic log.

Question 14

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

Accepted Answer

Ensure the required Windows OS servicing stack updates and Universal C Runtime dependencies are installed on target endpoints.. Cortex XDR agent installation on Windows requires specific OS-level prerequisites, including servicing stack updates and the Universal C Runtime (UCRT) libraries, which many older or unpatched Windows builds lack. When a GPO push fails with a missing-prerequisites error, verifying these dependencies on target endpoints is the correct first step.

Answer

Verify that the endpoint BIOS has Secure Boot enabled and TPM 2.0 active.

Answer

Check that the local Administrator account password matches the domain admin password.

Answer

Configure the endpoint to use DHCP reservation instead of static IP addresses.

Question 15

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?

Accepted Answer

Enable Causation Analysis and expanded forensic data collection in the Agent Settings profile for that endpoint group.. Cortex XDR's Causation Analysis and expanded forensic data collection, configured in the Agent Settings profile for the endpoint group, is the feature designed to capture detailed process, file, and network telemetry around a specific application's behavior. This gives the administrator the forensic data needed to determine whether the application's behavior is truly malicious or a false positive.

Answer

Increase the firewall packet capture buffer size to 1 GB.

Answer

Configure a URL filtering block page bypass.

Answer

Enable administrative debug logging on the local syslog server.

Question 16

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures between the Cortex XDR agent and the management server almost always point to a trust or interception issue. If a proxy or firewall performs TLS inspection (decryption) and the Cortex XDR root certificate is not installed in the agent's trust store, the agent rejects the proxy's re-signed certificate and the handshake fails, which matches the observed symptoms.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 17

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service. Within Cortex XDR, it automatically detonates and analyzes unknown files and samples submitted by endpoints in a sandboxed environment, returning verdicts (malicious, benign, grayware) and generating signatures that are shared across the ecosystem. This gives endpoints protection against zero-day and evasive malware that signature-based detection would miss.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 18

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Accepted Answer

Configure Syslog forwarding or use the Cortex XDR streaming API to export alerts and BIOC data to the SIEM.. Cortex XDR supports real-time log and alert forwarding to external SIEMs through two native mechanisms: Syslog forwarding (configured in the Cortex XDR console) and the Cortex XDR streaming API, which exports alerts, BIOC (Behavioral Indicator of Compromise) events, and endpoint telemetry. These are the documented, supported paths for meeting a policy that requires real-time centralised log ingestion. They preserve event fidelity and timeliness, unlike batch exports.

Answer

Configure NetFlow export on the local endpoint network interface card.

Answer

Export daily CSV reports from the Cortex XDR console via email.

Answer

Enable SNMP trap generation inside the local Windows Event Viewer settings.

Question 19

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

Accepted Answer

Cortex XDR agent. The Cortex XDR agent is the lightweight software installed on endpoints (workstations, servers) that continuously collects telemetry, enforces prevention policies, and performs local analysis directly on the host OS. It is the component responsible for on-host data collection and threat prevention.

Answer

Panorama management server

Answer

Prisma Access cloud security service

Answer

WildFire cloud analysis engine

Question 20

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

Accepted Answer

Enable Anti-Tamper protection with a designated administrator password.. Anti-Tamper protection in the Cortex XDR agent settings locks the agent's files, services, and registry keys so that local users—even those with local administrator rights—cannot stop, modify, or uninstall the agent. It is enabled in the agent configuration profile and protected by a designated uninstall password that only the security team knows. This directly satisfies the requirement of preventing tampering or uninstallation on Windows workstations.

Answer

Configure Windows BitLocker drive encryption on the system drive.

Answer

Enable User Account Control (UAC) at the default notification level.

Answer

Set the endpoint network profile to Public domain.