Cybersecurity-Apprentice Endpoint Security Practice Test 2 — 15 Questions

Question 1

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An intervening proxy or firewall is decrypting TLS traffic without the Cortex XDR root certificate installed in the agent trust store.. TLS handshake failures between the Cortex XDR agent and the management server almost always point to a trust or interception issue. If a proxy or firewall performs TLS inspection (decryption) and the Cortex XDR root certificate is not installed in the agent's trust store, the agent rejects the proxy's re-signed certificate and the handshake fails, which matches the observed symptoms.

Answer

The endpoint's local time is synchronized with an NTP server outside the local subnet.

Answer

The agent license key has reached its maximum daily log ingestion limit.

Answer

The Cortex XDR agent version is newer than the cloud backend tenant version.

Question 2

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

Accepted Answer

To automatically analyze unknown files and samples submitted by endpoints to determine if they are malicious.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat intelligence service. Within Cortex XDR, it automatically detonates and analyzes unknown files and samples submitted by endpoints in a sandboxed environment, returning verdicts (malicious, benign, grayware) and generating signatures that are shared across the ecosystem. This gives endpoints protection against zero-day and evasive malware that signature-based detection would miss.

Answer

To provide local disk defragmentation services.

Answer

To enforce multi-factor authentication for endpoint login sessions.

Answer

To manage firewall security policies across multiple tenants.

Question 3

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Accepted Answer

Configure Syslog forwarding or use the Cortex XDR streaming API to export alerts and BIOC data to the SIEM.. Cortex XDR supports real-time log and alert forwarding to external SIEMs through two native mechanisms: Syslog forwarding (configured in the Cortex XDR console) and the Cortex XDR streaming API, which exports alerts, BIOC (Behavioral Indicator of Compromise) events, and endpoint telemetry. These are the documented, supported paths for meeting a policy that requires real-time centralised log ingestion. They preserve event fidelity and timeliness, unlike batch exports.

Answer

Configure NetFlow export on the local endpoint network interface card.

Answer

Export daily CSV reports from the Cortex XDR console via email.

Answer

Enable SNMP trap generation inside the local Windows Event Viewer settings.

Question 4

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

Accepted Answer

Cortex XDR agent. The Cortex XDR agent is the lightweight software installed on endpoints (workstations, servers) that continuously collects telemetry, enforces prevention policies, and performs local analysis directly on the host OS. It is the component responsible for on-host data collection and threat prevention.

Answer

Panorama management server

Answer

Prisma Access cloud security service

Answer

WildFire cloud analysis engine

Question 5

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

Accepted Answer

Enable Anti-Tamper protection with a designated administrator password.. Anti-Tamper protection in the Cortex XDR agent settings locks the agent's files, services, and registry keys so that local users—even those with local administrator rights—cannot stop, modify, or uninstall the agent. It is enabled in the agent configuration profile and protected by a designated uninstall password that only the security team knows. This directly satisfies the requirement of preventing tampering or uninstallation on Windows workstations.

Answer

Configure Windows BitLocker drive encryption on the system drive.

Answer

Enable User Account Control (UAC) at the default notification level.

Answer

Set the endpoint network profile to Public domain.

Question 6

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

Accepted Answer

Exploit Protection module monitoring common application memory spaces and blocking anomalous execution flows.. The Exploit Protection module in Cortex XDR monitors common application memory spaces (e.g., browsers, Office, Java) and blocks exploitation techniques such as memory corruption, ROP chains, and shellcode execution before a file is dropped. Because fileless attacks execute directly in memory via vulnerable services, Exploit Protection is specifically designed to detect and block these anomalous execution flows at the exploitation stage.

Answer

Scheduled weekly full disk scans using YARA rules.

Answer

Antivirus signature database matching against known file hashes.

Answer

Browser extension security hardening policies.

Question 7

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

Accepted Answer

Use the Cortex XDR upgrade feature in Endpoint Management to push the new agent version to selected endpoint groups.. The Cortex XDR management console includes an Endpoint Management section with an upgrade feature that lets administrators push a new agent version to selected endpoint groups. This is the recommended, scalable method because it handles version targeting, scheduling, and reporting across the enterprise without touching each endpoint manually.

Answer

Reinstall the operating system on all endpoints using a clean golden image.

Answer

Manually log into every individual endpoint and run the uninstall wizard.

Answer

Modify the DNS records to point agents to a secondary upgrade server.

Question 8

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

Accepted Answer

Causation Analysis view showing the graphical chain of events originating from the root cause process.. Cortex XDR's Causation Analysis view reconstructs the attack chain by graphically linking events to the root cause process, showing how initial access led to lateral movement and persistence. It is specifically designed to answer 'how did this happen?' by tracing process ancestry and related activity across endpoints, which is exactly what the incident response team needs to visualize the full APT lifecycle.

Answer

Windows Event Viewer custom filtered operational logs.

Answer

Network packet capture waveform analyzer.

Answer

Global Threat Intelligence map showing country-of-origin IP addresses.

Question 9

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

Accepted Answer

BIOC alerts detect suspicious sequences of system events and behaviors rather than matching known file signatures.. BIOC (Behavioral Indicator of Compromise) alerts are generated by the Cortex XDR Behavioral Analytics engine, which correlates sequences of endpoint events (process creation, file writes, registry changes, network connections) against behavioral rules rather than static file signatures. This allows detection of fileless malware, living-off-the-land techniques, and novel attack chains that signature-based AV would miss. Standard malware alerts, by contrast, rely on hash or signature matching.

Answer

BIOC alerts are generated exclusively by network firewall threat logs.

Answer

BIOC alerts only trigger when a user manually initiates a full system scan.

Answer

BIOC alerts require an active WildFire cloud subscription to function locally.

Question 10

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Accepted Answer

Isolate the endpoint from the network to prevent lateral movement.. Option A is correct because the Cortex XDR management console provides a network isolation action that cuts an endpoint off from the network (while typically preserving the management channel to the console) to stop lateral movement during an active incident. Option E is correct because Cortex XDR allows administrators to quarantine malicious or suspicious files/artifacts directly from the console as part of the response workflow, preventing execution or spread. Option B is wrong because HVAC cooling systems are physical facility infrastructure, not something managed by Cortex XDR. Option C is wrong because BGP routing tables on core routers are network-layer configurations outside the endpoint security console's scope. Option D is wrong because resetting Wi-Fi SSID pre-shared keys is a wireless infrastructure task, not an endpoint response action in Cortex XDR.

Answer

Reboot the physical datacenter HVAC cooling systems.

Answer

Modify core BGP routing tables on enterprise core routers.

Answer

Reset enterprise Wi-Fi SSID pre-shared keys.

Question 11

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Accepted Answer

By deploying a compatible legacy agent version that supports older OS APIs while providing core malware and exploit prevention.. Cortex XDR provides support for legacy Windows operating systems by offering compatible agent versions that are designed to work with older OS APIs. These legacy agents still deliver core protection features such as malware prevention and exploit mitigation, ensuring that older servers remain protected without requiring OS upgrades.

Answer

By forcing an automatic in-place upgrade of the legacy Windows server to Windows 11.

Answer

By routing all legacy server traffic through a next-generation firewall proxy instead of installing an agent.

Answer

By disabling all security checks for servers older than five years.

Question 12

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

Accepted Answer

In the Cortex XDR management console under Endpoint Management > Agent Settings.. Cortex XDR agent prevention modules (Malware, Exploit, Behavioral Threat Protection, etc.) are configured centrally in the Cortex XDR management console under Endpoint Management > Agent Settings, where administrators can view and modify the protection profiles applied to endpoint groups. This is the authoritative location because the agent receives its policy from the management backend, not from local OS settings. Checking here confirms exactly which modules are active for a given set of workstations.

Answer

In the Active Directory Domain Controller Group Policy Management Editor.

Answer

In the firewall Security Policy rulebase.

Answer

In the global DNS Server configuration utility.

Question 13

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

Accepted Answer

Create a profile exception using the specific file hash or behavioral signature parameters identified in the alert.. The correct best practice is to create a profile exception scoped to the specific file hash or behavioral signature identified in the alert. This suppresses the false positive without weakening protection for other files or behaviors. Cortex XDR supports exceptions at the profile level (e.g., Malware, Exploit, Restriction profiles) so the legitimate admin tool is allowlisted only where needed. This preserves detection fidelity while eliminating recurring noise.

Answer

Uninstall the Cortex XDR agent from all endpoints in that department.

Answer

Delete the alert from the incident queue without taking action.

Answer

Set the entire Cortex XDR agent fleet to Audit mode permanently.

Question 14

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

Accepted Answer

Local Analysis utilizing machine learning models to detect unknown malware.. Option A is correct because the Cortex XDR agent performs Local Analysis on the endpoint using machine learning models (including static and behavioral ML) to identify and block previously unknown malware without relying on cloud connectivity. Option B is correct because Behavioral Threat Protection monitors process and system activity in real time to detect post-exploitation techniques such as credential dumping, lateral movement, and ransomware behavior mapped to the MITRE ATT&CK framework. Option C is correct because Exploit Protection applies exploit mitigation techniques (e.g., DEP, ASLR enforcement, and injection prevention) to stop memory corruption and code-injection attacks targeting vulnerable applications. Option D is incorrect because Deep Packet Inspection for BGP routing convergence is a network routing function, not an endpoint agent capability, and BGP is irrelevant to endpoint malware defense. Option E is incorrect because RAID array generation is a storage/hardware fault-tolerance feature, not a security protection provided by the Cortex XDR agent.

Answer

Deep Packet Inspection for BGP routing protocol convergence.

Answer

Automatic generation of RAID disk arrays for local fault tolerance.

Question 15

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

Accepted Answer

Ensure outbound TCP port 443 traffic is permitted to the Cortex XDR backend FQDNs.. Option B is correct because Cortex XDR agents communicate with the cloud console over outbound TCP 443 (HTTPS/TLS) to the Cortex XDR backend FQDNs, so any firewall or proxy blocking that traffic will prevent incident data from being reported. Option C is correct because the agent must resolve the tenant-specific service endpoints (e.g., the tenant's Cortex XDR FQDN) via DNS; if local DNS servers cannot resolve these endpoints, the agent cannot establish its connection to the cloud. Option A is not relevant because DHCP lease renewal timing has no bearing on agent-to-cloud reporting. Option D is incorrect because inbound SSH port 22 is for administrative access, not for agent telemetry, which is outbound-initiated. Option E is incorrect because SNMP v3 traps on port 162 are for network monitoring and are unrelated to Cortex XDR agent communication.

Answer

Check that local DHCP leases are renewed every 30 seconds.

Answer

Confirm that inbound SSH port 22 is open on all endpoint host firewalls.

Answer

Verify that SNMP v3 trap listeners are active on port 162.