Cybersecurity-Apprentice Endpoint Security Practice Test 3 — 15 Questions

Question 1

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

Accepted Answer

Apple macOS. The standard Cortex XDR agent is officially supported on Apple macOS (option C), since Palo Alto Networks provides a native macOS endpoint agent for both Intel and Apple Silicon systems. It is also officially supported on Microsoft Windows 10 and Windows 11 (option D), which are core supported desktop platforms for the Cortex XDR agent. Options A and B are incorrect because embedded automotive CAN bus microcontrollers and commercial airliner avionics flight control firmware are specialized real-time/embedded environments not supported by the standard Cortex XDR agent. Option E is incorrect because consumer smart refrigerator operating systems are embedded IoT platforms outside the agent's supported OS matrix.

Answer

Embedded automotive CAN bus microcontrollers

Answer

Commercial airliner avionics flight control firmware

Answer

Consumer smart refrigerator operating systems

Question 2

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

Accepted Answer

Endpoint management platforms such as Microsoft Intune or SCCM.. Option C is correct because Cortex XDR agent MSI packages can be distributed through enterprise endpoint management tools like Microsoft Intune or SCCM, which push the installer to managed Windows endpoints and run it with the required system privileges. Option D is correct because the agent package can be installed manually by running the MSI interactively with administrator rights, which is a supported deployment method for individual or small-scale installs. Option E is correct because Active Directory Group Policy Object software installation can assign or publish the Cortex XDR MSI to domain-joined Windows computers, installing it automatically at startup with elevated rights. Option A is not a valid software deployment mechanism, since FM radio broadcasts cannot deliver or execute an MSI package on Windows endpoints. Option B is also invalid and unsafe, as unauthenticated printer port scans cannot inject an MSI payload and do not represent any supported Cortex XDR deployment method.

Answer

Broadcasting the installation package over commercial FM radio frequencies.

Answer

Injecting the MSI payload via unauthenticated network printer port scans.

Question 3

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

Accepted Answer

Suspicious Microsoft Office documents containing embedded macros or scripts.. WildFire is Palo Alto Networks' cloud-based malware analysis and threat prevention service, and when integrated with Cortex XDR it automatically submits suspicious files for detonation and behavioral analysis. Option C is correct because malicious Microsoft Office documents with embedded macros or scripts (e.g., VBA, PowerShell, or OLE objects) are a primary WildFire target, since these files are commonly used in phishing and must be analyzed for malicious macro behavior. Option D is correct because unknown or zero-day executable binaries and PE files are the core artifacts WildFire detonates in its sandboxed VMs to observe process, registry, file system, and network activity and generate verdicts and signatures. Option A does not belong because benign PNG wallpaper images are static image files with no executable or macro content and are not typical WildFire inspection targets. Option B does not belong because ordinary MP3 audio recordings are non-executable media files that do not warrant cloud sandbox analysis. Option E does not belong because plain text files contain no executable code or scriptable content and are not analyzed by WildFire.

Answer

Default operating system desktop background wallpaper images in PNG format.

Answer

Uncompressed family vacation audio MP3 recordings.

Answer

Standard plain text grocery shopping lists without executable content.

Question 4

Which THREE actions occur when an endpoint is placed into 'Isolation' mode using Cortex XDR? (Choose three)

Accepted Answer

Configured isolation exceptions can allow specific forensic servers to communicate with the host.. Option A is correct because Cortex XDR isolation supports isolation exceptions that whitelist specific destinations (such as forensic or remediation servers) so they can still reach the isolated host. Option C is correct because the agent must maintain its connection to the Cortex XDR management backend, which is permitted through predefined exceptions so the console can still manage and release the endpoint. Option D is correct because isolation works by blocking all network traffic except the defined exceptions, effectively dropping all non-exempt inbound and outbound communication. Option B is wrong because isolation is a network containment action, not a disk-wiping or zeroing operation. Option E is wrong because isolation never cuts physical power; the endpoint remains powered on and running so the agent can enforce the isolation policy.

Answer

The endpoint hard drive is securely wiped and zeroed out.

Answer

The endpoint physical hardware power supply is automatically cut off.

Question 5

An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)

Accepted Answer

Endpoint Groups to categorize workstations based on criteria such as department or OS.. The scenario requires granular endpoint configuration per department, which Cortex XDR achieves through three components. Option A, Endpoint Groups, is correct because groups let the administrator categorize endpoints by criteria such as department, OS, or tags, providing the scoping mechanism that makes settings granular per department. Option C, Installation Settings, is correct because these define the initial agent configuration parameters (e.g., distribution, registration, and default settings) applied when the agent is first installed, ensuring endpoints start with the appropriate baseline. Option E, Agent Settings profiles, is correct because these profiles define operational parameters and prevention module states (e.g., Malware, Exploit, Behavioral threat protection) and are assigned to endpoint groups, delivering the department-specific behavior. Options B and D are incorrect: WPA3 enterprise RADIUS shared secrets are a wireless authentication concern unrelated to Cortex XDR endpoint policy, and BGP ASN path configuration is a network routing function with no role in endpoint settings management.

Answer

Global Wi-Fi WPA3 enterprise RADIUS shared secrets.

Answer

BGP Autonomous System Number (ASN) path configuration tables.

Question 6

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

Accepted Answer

Provides a standardized industry terminology for describing adversary tactics and techniques.. Option B is correct because MITRE ATT&CK supplies a common, vendor-neutral vocabulary of adversary tactics and techniques, so Cortex XDR analysts can describe and compare alerts consistently across teams and tools. Option C is correct because mapping alerts to ATT&CK techniques lets analysts see which techniques have no corresponding detection rules, exposing coverage gaps in security controls that can then be remediated. Option E is correct because ATT&CK techniques are organized under tactics that correspond to phases of the attack lifecycle, enabling analysts to place each alert in context such as initial access, execution, or exfiltration. Option A is incorrect because Cortex XDR does not recompile malicious binaries into safe patches; that is not a function of ATT&CK mapping or any endpoint protection platform. Option D is incorrect because ATT&CK is a knowledge framework for classifying adversary behavior, not a replacement for preventive controls like endpoint firewalls or network segmentation.

Answer

Automatically recompiles malicious binary code into safe executable patches.

Answer

Directly replaces the need for endpoint firewalls and network segmentation.

Question 7

A security analyst is reviewing a Cortex XDR alert on a Windows workstation where the agent reported a process that spawned from a Microsoft Word document, wrote a copy of itself into the user's Startup folder, and then contacted an external IP address. The analyst confirms the file hash is not present in any threat intelligence feed and the file signature is unsigned. Which Cortex XDR capability most directly generated this detection?

Accepted Answer

Behavioral Threat Protection monitoring process activity on the endpoint. The alert describes a behavior chain rather than a known file or an exploit technique. Behavioral Threat Protection is the Cortex XDR module that continuously monitors process, file, and network activity on the endpoint and correlates suspicious sequences such as an Office process spawning a child that achieves persistence and then beacons externally. Because the hash is unknown and unsigned, signature and reputation-based modules cannot explain the detection.

Answer

Exploit Protection blocking a memory corruption attempt in Word

Answer

Malware Protection matching the dropped file against a local signature database

Answer

WildFire cloud analysis of the dropped executable

Question 8

A Cortex XDR administrator is configuring an endpoint protection policy for a group of Windows servers that host a custom in-house database application. The application frequently writes large temporary files and spawns child processes during batch jobs. The administrator wants to reduce false positives without disabling protection entirely. Which TWO policy actions should the administrator take? (Choose two.)

Accepted Answer

Add the application's executable and its working directory to the Behavioral Threat Protection exclusions for the server policy. Reducing false positives on a trusted server requires narrowly scoped exclusions rather than weakening protection globally. Excluding the specific application executable and its working directory from Behavioral Threat Protection stops the benign process-spawning and file-writing pattern from being flagged, while a malware exclusion on the temporary directory prevents repeated scanning of churning trusted files. Both actions preserve the modules for all other activity on the host.

Answer

Disable the Malware, Exploit, and Behavioral Threat Protection modules entirely on the server policy

Answer

Set the agent to Report mode for all modules so detections are logged but nothing is blocked

Answer

Lower the agent's scan schedule frequency so temporary files are only scanned once per day

Question 9

A security analyst is reviewing Cortex XDR endpoint alerts and notices a pattern where the same executable is repeatedly flagged for creating suspicious child processes, but the file hash is not present in any threat intelligence feed. The analyst wants to prevent this behavior from executing on all endpoints without blocking other legitimate applications that use similar process creation. Which Cortex XDR prevention module should the analyst configure to address this specific behavioral pattern?

Accepted Answer

Behavioral Threat Protection. Behavioral Threat Protection is the Cortex XDR module that detects and blocks malicious process behaviors, such as an unknown executable repeatedly creating suspicious child processes. Unlike signature-based malware prevention, BTP operates on behavioral indicators and can stop threats without prior knowledge of the file hash. Configuring BTP rules allows targeted prevention without impacting legitimate applications.

Answer

Device Control

Answer

Malware Prevention

Answer

Exploit Prevention

Question 10

A security analyst at a financial firm notices that a Cortex XDR agent on a Windows 10 endpoint quarantined a file named 'invoice.pdf.exe' that was downloaded from a phishing email. The analyst wants to confirm the file's reputation and see if it has been seen across other organizations. Which Cortex XDR component should the analyst use to check the file's global reputation and threat intelligence?

Accepted Answer

WildFire cloud service. WildFire cloud service is the correct component because it provides global file reputation and threat intelligence by analyzing files from multiple organizations. It integrates with Cortex XDR to enhance detection and response. The other options are internal Cortex XDR features that do not offer external threat intelligence or global file reputation.

Answer

Cortex XDR Query Center

Answer

Cortex XDR Device Control

Answer

Cortex XDR Incident Response Center

Question 11

A security administrator is configuring the Cortex XDR agent on a new Windows endpoint. The administrator wants to ensure that the agent can detect and block known malicious files by comparing file hashes against a cloud-based database. Which prevention module should be enabled?

Accepted Answer

Malware Prevention. Malware Prevention is the Cortex XDR module specifically designed to detect and block known malicious files using signature and hash-based checks, including cloud lookups. The other modules address different threat vectors: Exploit Prevention targets memory exploits, Behavioral Threat Protection analyzes process behavior, and Device Control manages peripherals. Only Malware Prevention directly satisfies the requirement to compare file hashes against a cloud database.

Answer

Behavioral Threat Protection

Answer

Exploit Prevention

Answer

Device Control

Question 12

A junior security administrator is configuring the Cortex XDR agent on a Windows endpoint and wants to ensure that the agent can block malicious files based on signatures and heuristics without requiring cloud connectivity. Which agent component is responsible for this local prevention capability?

Accepted Answer

Local Analysis. Local Analysis is the Cortex XDR agent module that scans files locally using signatures, heuristics, and machine learning. It provides offline protection by identifying and blocking malicious files without needing to send them to the cloud. This ensures immediate response even when the endpoint is disconnected.

Answer

WildFire Cloud

Answer

Behavioral Threat Protection

Answer

Exploit Protection

Question 13

A security analyst is investigating a suspicious process on a Windows endpoint protected by Cortex XDR. The analyst wants to see the full command line, parent process, and network connections associated with that process. Which Cortex XDR console feature should the analyst use?

Accepted Answer

Incident response investigation view. The incident response investigation view offers a detailed process tree with command lines, parent processes, and network connections, enabling deep forensic analysis. Other console areas provide summary or configuration data, not the granular process details required.

Answer

Alerts table

Answer

Policy audit log

Answer

Threat intelligence dashboard

Question 14

A junior security administrator is asked to verify that the Cortex XDR agent on a Windows endpoint is able to receive updated prevention policies from the cloud. The administrator checks the agent status in the Cortex XDR console and sees that the endpoint is listed as 'Connected' but the last policy update was over 30 days ago. Which action should the administrator take first to ensure the agent receives the latest policies?

Accepted Answer

Check the endpoint's group assignment and policy rules in the Cortex XDR console.. Policy updates in Cortex XDR are managed through endpoint groups and the policies applied to them. If an endpoint is connected but not receiving updates, the most likely cause is misassignment to a group with outdated or no policies. Checking the group and policy configuration is the correct first troubleshooting step, as it is non-disruptive and targets the actual mechanism for policy distribution.

Answer

Manually update the agent software to the latest version.

Answer

Restart the Windows endpoint to force a policy sync.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Question 15

A help desk technician receives a ticket from a user whose Windows laptop is running the Cortex XDR agent. The user reports that a business-critical line-of-business application now fails to launch, and the agent tray icon shows a red status. Before escalating, the technician wants to capture the reason the agent interfered with the application. Which Cortex XDR action should the technician perform first?

Accepted Answer

Review the endpoint's action center and agent logs in the Cortex XDR console to identify the blocking module and event. When an application is blocked, the fastest reliable path is to read the recorded detection. The action center and agent logs in the Cortex XDR console show which protection module acted, the triggering rule, and the process details. With that evidence the administrator can apply a narrowly scoped exclusion or adjust the policy, rather than disabling protection or reinstalling the agent and losing the diagnostic trail.

Answer

Uninstall and reinstall the Cortex XDR agent to clear the red status

Answer

Stop the Cortex XDR agent service on the endpoint and instruct the user to relaunch the application

Answer

Add the application folder to the malware exclusion list immediately and ask the user to retry