Cybersecurity-Practitioner Endpoint Security — 25 Questions

Question 1

A security analyst is investigating a suspicious process execution chain in the Cortex XDR Incident Viewer. The analyst wants to understand the exact sequence of child processes spawned by a malicious PowerShell script. Which Cortex XDR feature provides a graphical representation of the attack lifecycle and process relationships?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Causality Chain (BIOC view) in the Incident View. BIOC and Causality Analysis provide a visual causality chain showing process spawning trees and related artifacts.

Answer

Global Protect Network Topology graph

Answer

Advanced Endpoint Query builder

Answer

Threat Intelligence Cloud lookup tool

Question 2

An administrator wants to verify which Cortex XDR agent version is installed on a specific Windows endpoint using the command line. Which command should be executed?

Accepted Answer

cytool version query. The 'cytool' command-line utility provides administrative functions, including checking the exact version of the installed agent.

Answer

cytool agent-version

Answer

cytool operacional status

Answer

cytool info query

Question 3

A security engineer needs to investigate endpoint telemetry data for a suspicious fileless attack that executed PowerShell commands out of memory. Which Cortex XDR component provides deep forensic visibility into command-line arguments, registry modifications, and network connections without relying solely on traditional logs?

Accepted Answer

Cortex XDR Host Insights data collection and querying engine. Host Insights provides comprehensive endpoint telemetry and forensic data storage for deep hunting and investigation.

Answer

Cortex XDR Malware Prevention module

Answer

Local Analysis engine utilizing machine learning models

Answer

WildFire cloud-based static and dynamic analysis sandbox

Question 4

An administrator needs to check the status of the Exploit Prevention module on a Windows endpoint running Cortex XDR. Which command should be used?

Accepted Answer

cytool protection query. The cytool command-line utility includes specific subcommands to inspect module states, such as exploit prevention.

Answer

cytool anti-exploit query

Answer

cytool module-check --exploit

Answer

cytool exploit status

Question 5

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore connectivity, the administrator must navigate to the Endpoint Management view, select the isolated endpoint, and issue the Remove Isolation action.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 6

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. Remote Response is the Cortex XDR feature that provides a secure interactive shell and script execution capability on managed endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 7

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

Accepted Answer

Use the /INSTALLTOKEN= parameter followed by the unique registration token string.. The INSTALLTOKEN parameter is required during unattended or mass installations to associate the agent instance with the correct tenant in Cortex XDR.

Answer

Use the /REGKEY= parameter followed by the tenant activation password.

Answer

Use the /SERVER= parameter to define the cloud instance URL.

Answer

Use the /TENANTID= parameter followed by the fully qualified domain name.

Question 8

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Hashing the specific file or using a signed certificate exception provides targeted remediation without compromising endpoint security.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 9

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

Accepted Answer

Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.. Putting the exploit protection module into Report (Audit) mode allows verification of potential blocks without disrupting user productivity.

Answer

Add the browser executable path to the OS exclusions list in Cortex XDR.

Answer

Disable memory protection features globally in the agent settings profile.

Answer

Enable Agent Self-Protection to prevent local interference.

Question 10

An administrator is preparing to deploy Cortex XDR agents to 500 remote endpoints using a software deployment tool. Where can the administrator download the latest installation packages and transforms?

Accepted Answer

Navigate to Cortex XDR management console > Settings > Distributions.. Installation packages are generated and downloaded directly from the Cortex XDR management console under the Distributions page.

Answer

Run the 'cytool download-installer' command on an existing endpoint.

Answer

Access the Palo Alto Networks Customer Support Portal under Software Updates.

Answer

Log in to the Prisma Access management portal and select Endpoints.

Question 11

An administrator needs to verify that the Cortex XDR agent services are running properly on a macOS endpoint. Which command-line utility should be used to check the agent status?

Accepted Answer

Run 'cytool query status' in the Terminal application.. The Cytool utility is the primary command-line tool for managing and troubleshooting Cortex XDR agents across platforms including macOS.

Answer

Run 'traps status' using administrative privileges.

Answer

Run 'launchctl list | grep paloalto' to check daemon health.

Answer

Run 'pan-xdr-cli check' in the system console.

Question 12

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

Accepted Answer

Create a Behavioral Threat Protection exception specifying the application hash and the triggered rule ID.. Creating an exception based on the BIOC rule ID or signature hash prevents specific false positives while keeping behavioral monitoring active.

Answer

Lower the threat severity threshold for Behavioral Threat Protection in the agent profile.

Answer

Set the Cortex XDR Agent to troubleshooting mode for the affected subnet.

Answer

Add the application directory to the system-wide exclusion list in the Malware Profile.

Question 13

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

Configured directly in the Agent Settings profile within the Cortex XDR console.. Proxy settings for the agent are typically defined within the installation parameters or agent settings profile within the console.

Answer

Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.

Answer

Configured through the local Windows Internet Options control panel.

Answer

Managed automatically via DNS SRV records without console configuration.

Question 14

An administrator observes that several Cortex XDR agents are showing a 'Disconnected' status in the management console. After verifying network connectivity, the administrator suspects that communication is blocked by an intermediate firewall. Which TCP port must be open outbound from the endpoints to the Cortex XDR server?

Accepted Answer

TCP port 443 exclusively. Cortex XDR agents communicate outbound to the cloud tenant primarily over TCP port 443.

Answer

TCP port 22 and TCP port 23 for remote management

Answer

TCP port 389 and TCP port 636 for directory sync

Answer

TCP port 80 and TCP port 443

Question 15

An organization deploys Cortex XDR disk encryption management. An endpoint fails to escrow its BitLocker recovery key to the Cortex XDR console. What is the most effective troubleshooting step to verify escrow status using the agent command-line tool?

Accepted Answer

Run 'cytool encryption status' to check BitLocker integration and key escrow status.. The cytool command-line interface provides specific commands to query disk encryption and key escrow status.

Answer

Run 'manage-bde -status' from an elevated command prompt.

Answer

Review the Windows Application event log for BitLocker Group Policy errors.

Answer

Run 'cytool set-token' to re-register the encryption keys.

Question 16

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

Accepted Answer

An Anti-Tamper password generated from the Cortex XDR management console.. Disabling the agent locally requires an anti-tamper password generated from the Cortex XDR management console.

Answer

A local administrator password configured during OS installation.

Answer

A registry override key set by group policy.

Answer

A network firewall bypass token.

Question 17

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

Accepted Answer

In the Agent Settings profile under Communication parameters.. Agent communication settings, including heartbeat intervals, are managed within the Agent Settings profile.

Answer

Directly within the local Windows registry on each endpoint.

Answer

In the Malware Prevention profile settings.

Answer

In the Global Protect Gateway configuration.

Question 18

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Local Analysis uses embedded machine learning models running locally on the endpoint to evaluate file features.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 19

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

Accepted Answer

Configure automatic scheduled agent upgrades within the Distributions and Software management view.. Upgrades are managed by uploading new agent versions to the console and deploying them via scheduled upgrade tasks in the Distributions view.

Answer

Execute 'cytool upgrade force' remotely using a PowerShell remoting script.

Answer

Enable the 'Auto-Update' feature in the Windows Update service settings.

Answer

Manually download the MSI and push it via group policy to all endpoints simultaneously.

Question 20

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

Accepted Answer

Communication with the Cortex XDR server and essential DNS/DHCP services.. When an endpoint is isolated, network access is blocked except for communication with the Cortex XDR management server and specified DNS/DHCP services.

Answer

All network protocols without restriction.

Answer

SMB and RDP traffic to internal domain controllers.

Answer

All outbound traffic to external internet websites via HTTPS.