Endpoint Security

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

An administrator is configuring disk encryption management in Cortex XDR for macOS endpoints. Which underlying native macOS technology does Cortex XDR manage and report on for disk encryption?

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

Which THREE security modules are included as core components of the Cortex XDR agent architecture? (Choose three)

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Which TWO methods can be utilized to distribute Cortex XDR agent installation packages across an enterprise Windows environment? (Choose two)

Which TWO platforms are officially supported for deploying the Cortex XDR Agent? (Choose two)

Which TWO pieces of information are displayed in the Cortex XDR Endpoint Management inventory table for a managed agent? (Choose two)

Which THREE mechanisms are employed by Cortex XDR to protect endpoints against unknown zero-day file-based malware? (Choose three)

Which THREE diagnostic or troubleshooting steps can be performed using the 'cytool' command-line utility on a local endpoint? (Choose three)

Which TWO actions should an administrator take when a legitimate software application is falsely blocked by Cortex XDR Behavioral Threat Protection (BTP)? (Choose two)

Which THREE conditions or indicators typically trigger an automated endpoint isolation action in Cortex XDR? (Choose three)

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

A Cortex XDR administrator needs to prevent users on managed Windows endpoints from launching an unauthorized peer-to-peer file-sharing tool. The administrator wants the Cortex XDR agent to block the executable and record the attempt in the console without relying on file hash values that change with every update. Which Cortex XDR agent capability should the administrator configure?

A Cortex XDR administrator is tuning the Behavioral Threat Protection module because several legitimate administrative scripts are generating false positives on managed endpoints. The administrator wants to keep the protection active while suppressing alerts only for the specific script paths involved, without disabling the module globally. What is the correct approach?

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

An administrator is configuring Cortex XDR to allow a legitimate application that performs process injection for accessibility purposes. The application is currently being blocked by the agent's protection modules. Which action should the administrator take to allow the application while minimizing the reduction in security?

A security analyst is investigating a Windows endpoint where the Cortex XDR agent has blocked a series of suspicious process executions. The analyst wants to permanently allow a legitimate internal administrative tool that the agent keeps terminating, without weakening protection for other executables. Where should the analyst configure this exception in the Cortex XDR management console?

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

A security analyst is investigating a Windows endpoint where a user downloaded a legitimate-looking PDF invoice. The file executed a macro that spawned a child process, and Cortex XDR generated a 'Local Analysis Malware' alert. The analyst wants to determine whether the file was also submitted to WildFire for cloud-based verdict. Which Cortex XDR feature should the analyst check to confirm whether the file hash was sent for WildFire analysis?

A security team wants Cortex XDR to automatically terminate a process and quarantine the associated file when a known ransomware behavior is detected on an endpoint, without requiring analyst intervention. Which policy setting must be enabled to achieve automatic response?

A newly hired administrator needs to confirm that a Windows endpoint's Cortex XDR agent is healthy and communicating with the management server. The administrator opens the endpoint's local agent console. Which status indicator should the administrator expect to see when the agent is fully operational and connected?

A security administrator is configuring a Cortex XDR agent policy for a group of Windows workstations that run a proprietary line-of-business application. The application frequently triggers behavioral threat alerts because it spawns command interpreters and writes to system directories. The administrator wants to suppress these known-good alerts without disabling behavioral threat protection for the rest of the endpoint. What should the administrator configure?

A Cortex XDR administrator is configuring a Behavioral Threat protection policy for a finance department. The policy must prevent credential theft attempts where a non-browser process reads LSASS memory on Windows endpoints. The administrator wants the agent to block the behavior without terminating the parent process. Which Cortex XDR configuration should the administrator apply to meet this requirement?

A security team is hardening Windows endpoints managed by Cortex XDR and wants to reduce the attack surface exploited by common malware techniques. Which TWO capabilities does the Cortex XDR agent provide to restrict malicious behavior at the endpoint? (Choose two.)

A security operations analyst wants to verify that Cortex XDR agents on managed endpoints are actively communicating with the Cortex XDR server and receiving policy updates. Which Cortex XDR component is responsible for maintaining this communication channel between the agent and the management server?

A Cortex XDR administrator is configuring a Malware profile to prevent the execution of known malicious files. The administrator wants the agent to block files based on hash reputation from WildFire and local analysis, but also wants to allow a specific internally developed tool that is sometimes flagged as a false positive. Which Cortex XDR feature should the administrator use to exclude the tool from being blocked while keeping the rest of the Malware profile active?

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

A Cortex XDR administrator needs to prevent users on a specific endpoint group from disabling the Cortex XDR agent through the Windows system tray. The administrator wants the agent to remain running and protected even if a user has local administrator rights. Which Cortex XDR agent setting should the administrator configure to achieve this?

An administrator is deploying Cortex XDR agents to a large fleet of Windows servers. A small subset of servers runs a legacy application that the Behavioral Threat protection module repeatedly terminates. The administrator wants to keep the module active on these servers but stop the false positives, and must ensure the exception is applied before the application runs again. What is the most appropriate approach?

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

A Cortex XDR administrator wants to ensure that endpoints can continue to receive updated threat signatures and policy changes even when they are roaming outside the corporate network. Which agent capability supports this requirement?

A security engineer is deploying Cortex XDR agents to a fleet of Linux servers. The engineer wants to prevent users on those servers from terminating the agent process or unloading its kernel module. Which Cortex XDR feature should the engineer enable to protect the agent from tampering on the Linux endpoints?

A Cortex XDR administrator notices that a specific Windows endpoint repeatedly triggers behavioral threat alerts for a legitimate internally developed accounting application. The administrator wants the application to run without generating further behavioral alerts while keeping all other protection modules active. What is the MOST appropriate action?

A Cortex XDR administrator is reviewing endpoint protection profiles and notices that a group of endpoints has the Exploit protection module enabled but the Malware protection module disabled. The administrator wants to understand the security implication of this configuration. Which statement best describes the effect?

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

A security analyst observes that a Cortex XDR agent on a Windows server is not enforcing exploit protection rules even though the policy is assigned. The agent status shows as connected and other modules are working. Which action should the analyst take first to diagnose the issue?

An organization wants to prevent users on managed Windows endpoints from writing data to unapproved USB mass storage devices while still allowing approved encrypted USB drives to be used. Which Cortex XDR capability should the administrator configure to meet this requirement?

A Cortex XDR administrator is investigating an alert where a process attempted to inject code into a legitimate system process. The administrator wants to understand the sequence of events that led to the alert. Which Cortex XDR feature provides a visual representation of related events and process lineage to aid in this investigation?

A Cortex XDR administrator is reviewing endpoint protection settings for a group of macOS laptops used by the finance department. The organization wants to ensure that only approved applications can execute on these laptops and that any attempt to run unapproved software is blocked and reported. Which Cortex XDR capability should the administrator configure to meet this requirement?

A Cortex XDR administrator needs to confirm that a newly deployed Windows endpoint has successfully registered with the management console and is receiving policy updates. Which indicator in the Cortex XDR management console confirms that the endpoint is actively managed?

A Cortex XDR administrator wants to reduce alert noise from a custom internal application that legitimately writes to the Windows registry Run key during installation. The administrator needs to suppress future alerts for this specific behavior on a defined group of developer endpoints without disabling the Behavioral Threat module globally. Which Cortex XDR capability should the administrator use?

A Cortex XDR administrator is preparing to enable the Device Control module for a group of Windows endpoints. The organization wants to prevent data exfiltration via removable media while still allowing approved USB storage devices used by the IT team. Which TWO actions must the administrator take to achieve this with Device Control? (Choose two.)

A security analyst at a manufacturing company is reviewing a Cortex XDR alert on a Windows endpoint. The alert shows that a user-space process with a non-Microsoft digital signature attempted to allocate executable memory in the address space of a signed Microsoft Office process. The analyst wants to confirm which Cortex XDR agent protection module generated this specific detection before writing the incident report. Which protection module is responsible for detecting this behavior?

A Cortex XDR administrator is preparing a response playbook for endpoints that lose contact with the management console. The administrator wants to understand what the agent does locally with threat intelligence and policy enforcement when it cannot reach the Cortex XDR service. Which statement correctly describes the agent's behavior while disconnected?

A Cortex XDR administrator is rolling out the agent to a set of Linux servers that host a containerized workload. The administrator wants the agent to detect malicious activity occurring inside containers without requiring a separate agent deployment per container. Which Cortex XDR capability should the administrator enable to meet this requirement?