Cybersecurity-Apprentice Endpoint Security — Timed 10 Questions

Question 1

An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?

Accepted Answer

Approve the system extension and network filter configurations via Mobile Device Management (MDM) policy or local system settings.. On macOS Catalina (10.15) and later, kernel extensions are deprecated in favor of System Extensions, and loading them requires explicit user or MDM approval. The Cortex XDR agent installs a system extension plus a network content filter, both of which must be approved via the Privacy & Security pane or pushed silently through an MDM profile using the 'SystemPolicyAllFiles' and 'NetworkFilter' payloads. Without this approval, the extension is blocked and the agent cannot fully load.

Answer

Disable SIP (System Integrity Protection) permanently on all Mac endpoints.

Answer

Reformat the drive using the APFS file system format.

Answer

Configure the Endpoint Security client to run as a root daemon via launchd.

Question 2

A security administrator at a mid-sized company is preparing to protect employee laptops that run Windows 10. The administrator wants to ensure that malicious files are blocked before they can execute and also wants the ability to roll back any changes made by ransomware. Which Cortex XDR agent capability directly addresses these requirements?

Accepted Answer

Malware prevention with local analysis and WildFire integration. Malware prevention with local analysis and WildFire integration blocks malicious files before execution and can roll back ransomware changes. This combination directly addresses the need to stop file-based threats and reverse damage, unlike other modules focused on network, behavior, or exploits.

Answer

Exploit mitigation and kernel-level protection

Answer

Host firewall and device control

Answer

Behavioral threat protection and analytics

Question 3

A security administrator at a mid-sized company notices that a Cortex XDR-protected Windows workstation has a file named invoice_2024.doc.exe sitting in the user's Downloads folder. The file was downloaded from an external email link, and the user claims nothing happened when they double-clicked it. The administrator wants to determine whether Cortex XDR has already taken action on this file. Which console location should the administrator check first to see the agent's verdict and any resulting action on that specific file?

Accepted Answer

The Incident Response view, filtered by the endpoint name and the file hash, to see the agent's verdict and any quarantine or block action.. The Incident Response view is the correct place because it records agent verdicts and the resulting enforcement actions per endpoint and file. Reviewing it filtered by endpoint and hash reveals whether the file was quarantined, blocked, or allowed, which is exactly what the administrator needs to determine before deciding on further response steps.

Answer

The Endpoint Management view, filtered by the endpoint name, to inspect the agent version and last heartbeat timestamp.

Answer

The Policy Management view, filtered by the endpoint's assigned policy, to review which prevention modules are enabled.

Answer

The Threat Intelligence view, filtered by the file name, to look up the file's reputation score across WildFire.

Question 4

A helpdesk technician receives a call from a user whose Windows 10 laptop is running slowly and showing pop-up ads. The technician suspects malware and wants to use the Cortex XDR agent to perform a full scan of the endpoint. Which action should the technician take from the Cortex XDR management console to initiate a full malware scan on the endpoint?

Accepted Answer

Navigate to Endpoints > All Endpoints, select the endpoint, and click 'Scan'.. To initiate a full malware scan on an endpoint, the technician should use the Endpoints page in the Cortex XDR management console. Selecting the endpoint and clicking 'Scan' triggers the agent to perform a scan based on the configured scan profile. This is the direct and correct method.

Answer

Navigate to Action Center > Scans, select the endpoint, and click 'Scan'.

Answer

Navigate to Policies > Endpoint Protection, select the policy, and click 'Scan'.

Answer

Navigate to Incidents > All Incidents, select the incident, and click 'Scan'.

Question 5

A security operations center (SOC) analyst is investigating a Cortex XDR alert indicating that a process attempted to access the LSASS memory on a Windows server. The analyst wants to determine whether the attempt was successful and what data might have been accessed. Which Cortex XDR capability provides the most detailed forensic information for this investigation?

Accepted Answer

Causality Chain with Telemetry. The Causality Chain with Telemetry in Cortex XDR includes granular telemetry on process interactions, including memory access events. It can reveal the accessing process, the target process (LSASS), and whether the access was successful, along with the memory regions involved. This is the most detailed forensic view for investigating credential dumping attempts.

Answer

Endpoint Data Collection (EDC)

Answer

Memory Protection Events

Answer

Process Execution History

Question 6

A Cortex XDR administrator is reviewing endpoint protection settings for a group of Windows servers that host a custom line-of-business application. The application writes to unusual registry keys and spawns child processes that resemble suspicious behavior, causing repeated blocks. The administrator wants to reduce false positives while retaining meaningful protection against real threats. Which TWO configuration actions should the administrator take in Cortex XDR? (Choose two.)

Accepted Answer

Create a Behavioral Threat Protection exception scoped to the application's file path and the specific behavior causing the block.. Scoped exceptions and publisher trust exceptions both reduce false positives narrowly. A behavior-specific exception targets the exact blocked action for the known application path, while trusting the signed publisher prevents its binaries from being treated as suspicious. Together they preserve the Behavioral Threat Protection and Malware modules for genuine threats instead of disabling protection group-wide.

Answer

Disable the Malware prevention module entirely on the server group to stop all file-based blocks.

Answer

Uninstall the Cortex XDR agent from the affected servers and rely on the operating system firewall instead.

Answer

Set the agent to Report mode for the entire server group so no prevention actions occur.

Question 7

A security analyst notices that a Cortex XDR agent on a Linux server has stopped reporting to the management console. The analyst wants to verify the agent's status and connectivity locally on the server. Which command should the analyst run?

Accepted Answer

sudo /opt/traps/bin/cytool status. The cytool status command provides a comprehensive local status of the Cortex XDR agent, including connectivity to the management console. Other commands either check service state, logs, or network connections, but do not offer the same direct diagnostic summary.

Answer

sudo tail -f /var/log/cortex-xdr.log

Answer

sudo netstat -tulpn | grep cortex

Answer

sudo systemctl status cortex-xdr-agent

Question 8

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

Accepted Answer

Configure IP-based isolation exceptions in the Cortex XDR profile to allow traffic from the designated forensic server IP.. Cortex XDR network isolation blocks all traffic except management communication by default. To allow a specific forensic server to reach an isolated endpoint, the responder configures IP-based isolation exceptions in the Cortex XDR profile (or via the isolation policy), whitelisting the forensic server's IP so its traffic is permitted while all other traffic remains blocked. This preserves containment while enabling evidence collection.

Answer

Delete the endpoint from the Cortex XDR asset list and re-add it.

Answer

Modify the endpoint routing table locally via a startup script.

Answer

Temporarily disable the Host Firewall module on the endpoint via the CLI.

Question 9

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

Accepted Answer

Ensure the operation mode parameter is set to prevent rather than detect or disable.. The Cortex XDR agent's operation mode determines whether it only detects/reports or actively blocks malicious activity. To run in full prevention mode without user intervention, the installation profile must set the operation mode to 'prevent' (as opposed to 'detect' or 'disable'), which is configured in the agent installation package/profile before deployment. This ensures the endpoint enforces policy from the moment the agent registers.

Answer

Disable the self-defense mechanism during MSI deployment.

Answer

Configure the proxy bypass list for local loopback communication.

Answer

Set the heartbeat interval to 60 seconds.

Question 10

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

Accepted Answer

Behavioral Threat Protection. Behavioral Threat Protection (BTP) is the Cortex XDR module that monitors process behavior in real time and detects post-exploitation techniques such as process injection, credential dumping, and shellcode execution. Because polymorphic malware changes its file signature but still performs the same malicious behaviors (e.g., injecting into legitimate Windows processes), BTP catches it by analyzing the sequence of actions rather than static indicators. This makes it the primary module responsible for blocking process injection attempts.

Answer

URL Filtering profile

Answer

Data Loss Prevention (DLP) engine

Answer

DNS Security subscription