Cybersecurity-Apprentice Endpoint Security Practice Test 4 — 15 Questions

Question 1

A security analyst notices that a Cortex XDR agent on a Windows server has blocked a legitimate administrative tool because it matched a behavioral threat signature. The analyst wants to prevent this tool from being blocked in the future without disabling Behavioral Threat Protection entirely. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an exception rule in the Cortex XDR console for the specific tool's file hash or path.. The analyst should create an exception rule for the legitimate tool, specifying its hash or path, within the Cortex XDR console. This whitelists the tool for Behavioral Threat Protection while keeping the module enabled. Disabling the module is overly broad, and Device Control or Exploit Prevention exceptions are irrelevant because they address different security functions.

Answer

Add the tool to the Device Control allow list.

Answer

Disable Behavioral Threat Protection on the server.

Answer

Modify the Exploit Prevention policy to exclude the tool.

Question 2

A security administrator is configuring a Cortex XDR agent policy to protect against exploit techniques such as memory corruption and return-oriented programming (ROP). Which two protection modules should be enabled to mitigate these threats? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention and Kernel Exploit Protection are designed to block exploitation techniques like memory corruption and ROP. Exploit Prevention covers user-mode applications, while Kernel Exploit Protection addresses kernel-level attacks. Together they provide comprehensive mitigation against the described threats.

Answer

Malware Prevention

Answer

Behavioral Threat Protection

Answer

Host Firewall

Question 3

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to modify the memory of another process on a critical server. The analyst wants to determine whether the Cortex XDR agent blocked the attempt or only logged it. Which field in the Cortex XDR alert details should the analyst examine to confirm the action taken by the agent?

Accepted Answer

The 'Action' field in the alert details, which shows 'Blocked' or 'Reported'.. In Cortex XDR, the 'Action' field in alert details explicitly states whether the agent blocked or merely reported the activity. For a memory modification attempt, this field will show 'Blocked' if prevention was enforced, or 'Reported' if the module was in monitor mode. This is the authoritative indicator of the agent's response, making it the correct field to examine.

Answer

The 'Severity' field in the alert details, which indicates the potential impact.

Answer

The 'MITRE Technique' field in the alert details, which maps the activity to a tactic.

Answer

The 'Process Name' field in the alert details, which identifies the offending process.

Question 4

A security analyst is reviewing Cortex XDR endpoint alerts and wants to confirm that the agent's exploit protection module is actively preventing known exploitation techniques on a Windows workstation. Which Cortex XDR agent capability should the analyst verify is enabled for this endpoint?

Accepted Answer

Exploit Protection. Exploit Protection is the Cortex XDR agent module specifically designed to block known exploitation techniques at the memory and system-call level. Malware Protection handles file-based threats, Behavioral Threat Protection watches process behavior, and Device Control manages peripherals. To verify that known exploitation methods are prevented on the Windows endpoint, the analyst must confirm Exploit Protection is enabled.

Answer

Behavioral Threat Protection

Answer

Malware Protection

Answer

Device Control

Question 5

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent service stopped unexpectedly. The administrator restarts the Cortex XDR agent service, but the endpoint still shows as disconnected in the console several minutes later. The endpoint has valid network connectivity to other internal resources, and the agent logs show repeated failures during the initial handshake with the cloud tenant. Which action should the administrator take to resolve the agent-to-cloud communication failure?

Accepted Answer

Verify that the endpoint can reach the required Cortex XDR cloud service endpoints and that any TLS-inspecting proxy presents a trusted certificate chain.. The repeated handshake failures despite working internal connectivity point to a trust or reachability problem on the path to the Cortex XDR cloud service endpoints. Verifying outbound reachability and ensuring any TLS-inspecting proxy presents a trusted certificate chain resolves the most common cause of this symptom without weakening endpoint security or making disruptive changes.

Answer

Disable the Windows Defender Firewall on the endpoint to eliminate all filtering that could interfere with the agent.

Answer

Reinstall the operating system on the endpoint to reset the network stack and trust store.

Answer

Downgrade the agent to an earlier version that uses a different cloud communication protocol.

Question 6

A security administrator is configuring Cortex XDR to protect a fleet of Linux servers. The administrator wants to ensure that the agent can detect and prevent exploitation of vulnerabilities in commonly targeted services such as Apache and SSH. Which Cortex XDR module should be enabled and configured to provide this protection?

Accepted Answer

Exploit Prevention. Exploit Prevention is the Cortex XDR module specifically designed to detect and block exploitation of vulnerabilities in services like Apache and SSH. It monitors for techniques such as memory corruption and command injection, and can prevent the exploit from executing. Configuring this module on Linux servers ensures protection against targeted attacks on exposed services.

Answer

Malware Prevention

Answer

Behavioral Threat Protection

Answer

Device Control

Question 7

A security administrator is configuring Cortex XDR agent settings for a group of Linux servers. The administrator wants to ensure that the agent does not interfere with a custom application that performs legitimate but unusual system calls, which are currently being flagged as malicious by the agent's behavioral threat protection. What should the administrator do to prevent the agent from blocking this application while maintaining security?

Accepted Answer

Create a Behavioral Threat Protection exception for the application's process name and hash.. Creating a Behavioral Threat Protection exception for the application's process name and hash is the correct approach. It allows the legitimate application to run without interference while keeping behavioral threat protection active for other processes. This balances security and functionality.

Answer

Add the application to the allow list in the Exploit Protection module.

Answer

Configure the agent to run in 'Report Only' mode for Behavioral Threat Protection.

Answer

Disable Behavioral Threat Protection entirely on the Linux servers.

Question 8

A Cortex XDR administrator needs to ensure that endpoints in a high-security department can only communicate with a specific set of internal servers and cannot access the internet. Which Cortex XDR agent feature should be configured to enforce this network restriction?

Accepted Answer

Host Firewall policy. The Host Firewall policy is designed to control network traffic on the endpoint, allowing rules that restrict communication to specific internal servers while blocking all other connections, including the internet. Other policies address file, device, or exploit protection, not network restrictions.

Answer

Malware Prevention policy

Answer

Exploit Prevention policy

Answer

Device Control policy

Question 9

A Cortex XDR administrator is configuring endpoint protection for a group of Windows servers that run a custom Java application. The application uses a Just-In-Time (JIT) compiler that frequently generates dynamic code, and the administrator observes that Exploit Protection is blocking the application's normal execution. What is the most appropriate action to resolve this while maintaining security?

Accepted Answer

Create an exception for the Java application's executable in the Exploit Protection module.. A targeted exception for the Java application's executable in Exploit Protection is the correct balance, allowing the legitimate JIT compiler to function while preserving exploit prevention for other processes. Global disable or module changes are too broad and do not address the specific compatibility issue. Upgrading the agent alone may not resolve the JIT-generated code detection. Scoped exceptions are the standard remediation for legitimate applications that trigger exploit prevention.

Answer

Move the servers to a different endpoint group with Behavioral Threat Protection disabled.

Answer

Upgrade the Cortex XDR agent to the latest version.

Answer

Disable Exploit Protection globally for all endpoints in the organization.

Question 10

A security administrator is configuring the Cortex XDR agent on a group of Linux servers. The administrator wants to ensure that the agent can prevent exploitation of known vulnerabilities in common Linux services. Which TWO prevention modules in the Cortex XDR agent profile should the administrator enable to achieve this? (Choose two.)

Accepted Answer

Exploit Protection. To prevent exploitation of known vulnerabilities in Linux services, the administrator should enable Exploit Protection and Kernel Exploit Protection. Exploit Protection blocks user-space exploitation attempts, while Kernel Exploit Protection specifically targets kernel vulnerabilities. Together, they provide comprehensive prevention against exploit-based attacks on Linux servers.

Answer

Malware Protection

Answer

Behavioral Threat Protection

Answer

File Integrity Monitoring

Question 11

A security analyst is investigating a potential data exfiltration incident on a Windows endpoint. The analyst wants to collect forensic data from the endpoint, including running processes, network connections, and registry keys, without disrupting the user's work. Which Cortex XDR response action should the analyst use to gather this information remotely?

Accepted Answer

Collect endpoint forensic data. The 'Collect endpoint forensic data' response action is specifically built for remotely gathering forensic artifacts from an endpoint without disrupting the user. It collects a predefined set of data including processes, network connections, and registry keys, making it ideal for this scenario.

Answer

Initiate a live terminal session

Answer

Isolate the endpoint

Answer

Run a script

Question 12

A Cortex XDR administrator is reviewing the agent's self-protection capabilities on Windows endpoints. The administrator wants to ensure that the agent cannot be easily disabled or tampered with by malicious actors. Which TWO mechanisms does the Cortex XDR agent use to protect itself from being stopped or modified? (Choose two.)

Accepted Answer

Watchdog service that monitors the agent's health and restarts it if stopped.. The Cortex XDR agent employs tamper protection to prevent unauthorized modification of its files and registry keys, and a watchdog service that restarts the agent if it is stopped. These two mechanisms work together to ensure the agent remains operational and resistant to tampering. They are core components of the agent's self-protection strategy on Windows endpoints.

Answer

Automatic quarantine of any process that attempts to access the agent's installation directory.

Answer

Cloud-based revocation that disables the endpoint's network access if the agent is stopped.

Answer

Kernel-level driver that blocks all process termination requests for the agent.

Question 13

A Cortex XDR administrator is investigating an alert where a process attempted to write to the memory of another process on a Windows endpoint. The alert was generated by the Cortex XDR agent's Behavioral Threat Protection module. The administrator wants to understand which technique this behavior most likely represents and what the agent did in response. Which statement accurately describes the technique and the agent's action?

Accepted Answer

The technique is code injection, and the agent blocked the write operation and may have terminated the injecting process.. Writing to another process's memory is a hallmark of code injection, often used by malware to execute code in the context of a trusted process. Behavioral Threat Protection detects this activity and can block the write operation, preventing the injection. Depending on the configured policy, the agent may also terminate the injecting process. The other options misidentify the technique or the agent's response.

Answer

The technique is privilege escalation, and the agent escalated the alert to the cloud for analysis.

Answer

The technique is DLL side-loading, and the agent quarantined the DLL file.

Answer

The technique is process hollowing, and the agent terminated the target process.

Question 14

A security administrator is configuring Cortex XDR agent installation packages for a mixed environment of Windows and macOS endpoints. The administrator needs to ensure that the agent can communicate with the Cortex XDR cloud tenant and that endpoints are protected immediately after installation. Which TWO configuration settings are required in the installation package to achieve this? (Choose two.)

Accepted Answer

Registration token. The tenant ID and registration token are the two required settings for the Cortex XDR agent to communicate with the cloud tenant and register successfully. The tenant ID identifies the correct tenant, and the registration token authenticates the agent. Without these, the agent cannot establish a connection or receive policies, leaving the endpoint unprotected.

Answer

WildFire API key

Answer

Endpoint group name

Answer

Proxy server address

Question 15

A Cortex XDR administrator needs to prevent users from copying sensitive files to unauthorized USB storage devices on a group of Windows endpoints. The administrator wants to allow only specific encrypted USB drives that are registered with the organization. Which Cortex XDR agent module should be configured to achieve this?

Accepted Answer

Device Control. Device Control is the Cortex XDR agent module designed to manage peripheral access, including USB storage devices. It supports granular policies that can allow only approved devices based on identifiers like vendor ID or serial number. Malware Protection, Exploit Protection, and Behavioral Threat Protection focus on software threats and do not control hardware device usage. Thus Device Control is the correct choice.

Answer

Malware Protection

Answer

Behavioral Threat Protection

Answer

Exploit Protection