An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?
A security administrator at a mid-sized company is preparing to protect employee laptops that run Windows 10. The administrator wants to ensure that malicious files are blocked before they can execute and also wants the ability to roll back any changes made by ransomware. Which Cortex XDR agent capability directly addresses these requirements?
A security administrator at a mid-sized company notices that a Cortex XDR-protected Windows workstation has a file named invoice_2024.doc.exe sitting in the user's Downloads folder. The file was downloaded from an external email link, and the user claims nothing happened when they double-clicked it. The administrator wants to determine whether Cortex XDR has already taken action on this file. Which console location should the administrator check first to see the agent's verdict and any resulting action on that specific file?
A helpdesk technician receives a call from a user whose Windows 10 laptop is running slowly and showing pop-up ads. The technician suspects malware and wants to use the Cortex XDR agent to perform a full scan of the endpoint. Which action should the technician take from the Cortex XDR management console to initiate a full malware scan on the endpoint?
A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to access the LSASS memory on a Windows server. The analyst wants to determine whether the attempt was successful and what data might have been accessed. Which Cortex XDR capability provides the most detailed forensic information for this investigation?
A Cortex XDR administrator is reviewing endpoint protection settings for a group of Windows servers that host a custom line-of-business application. The application writes to unusual registry keys and spawns child processes that resemble suspicious behavior, causing repeated blocks. The administrator wants to reduce false positives while retaining meaningful protection against real threats. Which TWO configuration actions should the administrator take in Cortex XDR? (Choose two.)
A security analyst notices that a Cortex XDR agent on a Linux server has stopped reporting to the management console. The analyst wants to verify the agent's status and connectivity locally on the server. Which command should the analyst run?
An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?
An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?
A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?
A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?
An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?
An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?
An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?
An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?
An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?
An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?
Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?
An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?
An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?
An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?
An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?
A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?
Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)
An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?
An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?
An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?
An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)
An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)
An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)
A security analyst is reviewing a Cortex XDR alert on a Windows workstation where the agent reported a process that spawned from a Microsoft Word document, wrote a copy of itself into the user's Startup folder, and then contacted an external IP address. The analyst confirms the file hash is not present in any threat intelligence feed and the file signature is unsigned. Which Cortex XDR capability most directly generated this detection?
A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)
A security analyst is reviewing Cortex XDR endpoint alerts and notices a pattern where the same executable is repeatedly flagged for creating suspicious child processes, but the file hash is not present in any threat intelligence feed. The analyst wants to prevent this behavior from executing on all endpoints without blocking other legitimate applications that use similar process creation. Which Cortex XDR prevention module should the analyst configure to address this specific behavioral pattern?
A security analyst at a financial firm notices that a Cortex XDR agent on a Windows 10 endpoint quarantined a file named 'invoice.pdf.exe' that was downloaded from a phishing email. The analyst wants to confirm the file's reputation and see if it has been seen across other organizations. Which Cortex XDR component should the analyst use to check the file's global reputation and threat intelligence?
A security administrator is configuring the Cortex XDR agent on a new Windows endpoint. The administrator wants to ensure that the agent can detect and block known malicious files by comparing file hashes against a cloud-based database. Which prevention module should be enabled?
A junior security administrator is configuring the Cortex XDR agent on a Windows endpoint and wants to ensure that the agent can block malicious files based on signatures and heuristics without requiring cloud connectivity. Which agent component is responsible for this local prevention capability?
A security analyst is investigating a suspicious process on a Windows endpoint protected by Cortex XDR. The analyst wants to see the full command line, parent process, and network connections associated with that process. Which Cortex XDR console feature should the analyst use?
A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?
A help desk technician receives a ticket from a user whose Windows laptop is running the Cortex XDR agent. The user reports that a business-critical line-of-business application now fails to launch, and the agent tray icon shows a red status. Before escalating, the technician wants to capture the reason the agent interfered with the application. Which Cortex XDR action should the technician perform first?
A security analyst notices that a Cortex XDR agent on a Windows server has blocked a legitimate administrative tool because it matched a behavioral threat signature. The analyst wants to prevent this tool from being blocked in the future without disabling Behavioral Threat Protection entirely. What should the analyst do?
A security administrator is configuring a Cortex XDR agent policy to protect against exploit techniques such as memory corruption and return-oriented programming (ROP). Which two protection modules should be enabled to mitigate these threats? (Choose two.)
A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to modify the memory of another process on a critical server. The analyst wants to determine whether the Cortex XDR agent blocked the attempt or only logged it. Which field in the Cortex XDR alert details should the analyst examine to confirm the action taken by the agent?
A security analyst is reviewing Cortex XDR endpoint alerts and wants to confirm that the agent's exploit protection module is actively preventing known exploitation techniques on a Windows workstation. Which Cortex XDR agent capability should the analyst verify is enabled for this endpoint?
A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent service stopped unexpectedly. The administrator restarts the Cortex XDR agent service, but the endpoint still shows as disconnected in the console several minutes later. The endpoint has valid network connectivity to other internal resources, and the agent logs show repeated failures during the initial handshake with the cloud tenant. Which action should the administrator take to resolve the agent-to-cloud communication failure?
A security administrator is configuring Cortex XDR to protect a fleet of Linux servers. The administrator wants to ensure that the agent can detect and prevent exploitation of vulnerabilities in commonly targeted services such as Apache and SSH. Which Cortex XDR module should be enabled and configured to provide this protection?
A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?
A Cortex XDR administrator needs to ensure that endpoints in a high-security department can only communicate with a specific set of internal servers and cannot access the internet. Which Cortex XDR agent feature should be configured to enforce this network restriction?
A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?
A security administrator is configuring the Cortex XDR agent on a group of Linux servers. The administrator wants to ensure that the agent can prevent exploitation of known vulnerabilities in common Linux services. Which TWO prevention modules in the Cortex XDR agent profile should the administrator enable to achieve this? (Choose two.)
A security analyst is investigating a potential data exfiltration incident on a Windows endpoint. The analyst wants to collect forensic data from the endpoint, including running processes, network connections, and registry keys, without disrupting the user's work. Which Cortex XDR response action should the analyst use to gather this information remotely?
A Cortex XDR administrator is reviewing the agent's self-protection capabilities on Windows endpoints. The administrator wants to ensure that the agent cannot be easily disabled or tampered with by malicious actors. Which TWO mechanisms does the Cortex XDR agent use to protect itself from being stopped or modified? (Choose two.)
A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?
A security administrator is configuring Cortex XDR agent installation packages for a mixed environment of Windows and macOS endpoints. The administrator needs to ensure that the agent can communicate with the Cortex XDR cloud tenant and that endpoints are protected immediately after installation. Which TWO configuration settings are required in the installation package to achieve this? (Choose two.)
A Cortex XDR administrator needs to prevent users from copying sensitive files to unauthorized USB storage devices on a group of Windows endpoints. The administrator wants to allow only specific encrypted USB drives that are registered with the organization. Which Cortex XDR agent module should be configured to achieve this?
A help desk technician receives a ticket stating that a Cortex XDR agent on a Windows laptop displays a red status in the console and the user cannot access the corporate VPN. The technician confirms the laptop has internet access and can browse external websites. The technician needs to restore the agent's management connection so the security team can see the device again. Which step should the technician take first?
A security analyst is reviewing Cortex XDR endpoint alerts and notices that a process on a Windows endpoint performed a series of actions: it created a child process from a Microsoft Office application, then attempted to write to the memory of that child process. The analyst suspects a multi-stage attack. Which TWO Cortex XDR agent modules would most likely generate alerts for these actions? (Choose two.)
A Cortex XDR administrator is investigating a Windows endpoint where the agent reported an exploit attempt against a document reader process. The exploit was blocked, but the administrator wants to understand the exact memory manipulation technique used before the block. Which Cortex XDR capability should the administrator use to examine the sequence of events and process behavior captured around the exploit?
A Cortex XDR administrator needs to prevent a specific known-malicious SHA-256 hash from executing on all Windows endpoints in a research lab, even if the file is renamed or copied to a new path. The administrator wants the block to take effect as quickly as possible without waiting for a full scan. Which Cortex XDR feature should be used?
A Cortex XDR administrator is preparing to deploy the agent to a group of Windows endpoints. The administrator wants to ensure that the agent can communicate with the Cortex XDR management console and receive policy updates. Which TWO network requirements must be met? (Choose two.)