Cybersecurity-Practitioner Endpoint Security Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing the Cortex XDR agent's capabilities for endpoint data collection. The analyst needs to verify that the agent is capturing the necessary telemetry to detect fileless attacks. Which TWO data sources does the Cortex XDR agent collect that are specifically useful for detecting fileless malware? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kernel-level process execution events. Fileless malware often executes in memory and uses system tools like PowerShell, leaving traces in process execution events and registry modifications. These two data sources are key for detecting such threats. The other options are either not collected by the agent or irrelevant to fileless attack detection, making them incorrect.

Answer

User keystroke logging

Answer

Periodic full disk image backups

Answer

Full packet capture of all network traffic

Question 2

A security administrator is deploying Cortex XDR agents to a fleet of Windows servers that must communicate with the Cortex XDR management console exclusively through an outbound HTTPS proxy. The proxy requires authentication and is not configured at the operating system level. Where should the administrator configure the proxy settings so the agent can register successfully?

Accepted Answer

In the Cortex XDR management console under Endpoints > Endpoint Management > Agent Configuration, by applying a proxy policy to the target endpoint group. Cortex XDR agents obtain proxy configuration through agent settings policies pushed from the management console and applied to endpoint groups. This central approach supports authenticated proxies, ensures consistent configuration across large fleets, and avoids unsupported manual registry or OS-level changes. It is the documented method for enabling agent communication through a corporate HTTP proxy.

Answer

By editing the Windows Registry key HKLM\SOFTWARE\PaloAltoNetworks\CortexXDR\Proxy after installation and restarting the agent service

Answer

By enabling Windows WinHTTP proxy settings with netsh winhttp set proxy, which the agent automatically inherits

Answer

In the Cortex XDR agent installation package's msiexec PROXY_ADDRESS and PROXY_USER properties at install time

Question 3

A security administrator needs to ensure that Cortex XDR agents on Windows endpoints can receive policy updates and send telemetry to the Cortex XDR management console. The environment uses a proxy for internet access. Where should the administrator configure the proxy settings for the agents?

Accepted Answer

In the Cortex XDR management console under Endpoints > Endpoint Management > Agent Configuration.. Proxy settings for Cortex XDR agents are configured centrally in the management console, allowing administrators to push the configuration to all endpoints. This ensures consistent communication through the corporate proxy. Other methods are either unsupported, not scalable, or not available in the agent UI.

Answer

In the Cortex XDR agent installation package using the PROXY_SERVER parameter.

Answer

In the local agent UI by right-clicking the tray icon and selecting Proxy Settings.

Answer

In the Windows Registry under HKLM\Software\Palo Alto Networks\Cortex XDR\Proxy.

Question 4

A Cortex XDR administrator is preparing to onboard a new set of macOS endpoints into the environment. The administrator wants to verify that the agent has the necessary system permissions to monitor process activity and network connections on macOS. Which TWO macOS privacy permissions must the Cortex XDR agent be granted to provide full endpoint visibility? (Choose two.)

Accepted Answer

System Extension approval. Cortex XDR on macOS requires Full Disk Access so the agent can read protected system and user data, and System Extension approval so its kernel-level monitoring component can load. Together these permissions enable process, file, and network visibility that macOS otherwise restricts. Without either, the agent operates with significant blind spots and cannot deliver complete endpoint telemetry.

Answer

Screen Recording

Answer

Accessibility

Answer

Camera

Question 5

A Cortex XDR administrator is configuring a new Malware Protection profile for a group of Windows servers that run a proprietary line-of-business application. The application's vendor has confirmed that a specific DLL it loads is unsigned and is frequently flagged by reputation services, causing the application to fail at startup. The administrator needs to allow this application to run while keeping protection enabled for all other software. Which TWO configuration actions should the administrator take in the Malware Protection profile? (Choose two.)

Accepted Answer

Add the DLL's file hash to the allow list so it is excluded from malware scanning and reputation checks.. The goal is to exempt only the known-good unsigned DLL while preserving protection everywhere else. A file-hash allow list entry is the most precise exception, and a full-path allow list entry also scopes the exception to that exact file location. Both keep Malware Protection active for all other software. Disabling the module, switching to Report mode, or relying on a signer-based rule would either remove protection broadly or fail because the DLL is unsigned.

Answer

Disable the Malware Protection module entirely for the server group so the application can start.

Answer

Configure the profile to run in Report mode instead of Block mode so nothing is prevented.

Answer

Create an exception rule that allows the DLL based on its digital signer certificate.

Question 6

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore network connectivity to an isolated endpoint in Cortex XDR, the administrator goes to Endpoint Management, selects the endpoint, clicks Action, and chooses Remove Isolation. This action lifts the isolation policy and allows the endpoint to communicate on the network again. It is the standard, documented workflow after remediation is verified.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 7

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. The Cortex XDR Remote Response tool allows administrators to execute scripts and retrieve files directly from endpoints in real time, enabling live forensic artifact collection. This capability is designed for interactive response actions on compromised endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 8

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Creating a Profile Exception in the Malware Profile using the SHA-256 hash of the executable is the most granular method to whitelist the application. This approach ensures that only the specific, verified version of the file is allowed, maintaining a strong security posture by not broadly excluding paths or disabling protections. It leverages Cortex XDR's ability to allow known good files based on their unique cryptographic hash.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 9

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

Accepted Answer

Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.. Changing the exploit protection action for the specific technique from 'Terminate' to 'Report' allows the browser plugin to continue running while Cortex XDR logs the exploit attempt, giving the administrator visibility into whether the crash is actually caused by that protection rule. This is the surgical approach: it isolates the offending rule without weakening the rest of the exploit protection profile or disabling memory protection entirely.

Answer

Add the browser executable path to the OS exclusions list in Cortex XDR.

Answer

Disable memory protection features globally in the agent settings profile.

Answer

Enable Agent Self-Protection to prevent local interference.

Question 10

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

Accepted Answer

Create a Behavioral Threat Protection exception specifying the application hash and the triggered rule ID.. Creating a Behavioral Threat Protection exception with the specific application hash and triggered rule ID allows the administrator to suppress the false positive for that exact behavior without affecting other applications. This granular approach maintains the protection of BTP for all other processes. It is the recommended method to handle legitimate applications that trigger BTP alerts.

Answer

Lower the threat severity threshold for Behavioral Threat Protection in the agent profile.

Answer

Set the Cortex XDR Agent to troubleshooting mode for the affected subnet.

Answer

Add the application directory to the system-wide exclusion list in the Malware Profile.

Question 11

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

Configured directly in the Agent Settings profile within the Cortex XDR console.. The proxy configuration for Cortex XDR agents is defined in the Agent Settings profile within the Cortex XDR console. This profile is pushed to agents, allowing them to use the specified proxy for communication.

Answer

Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.

Answer

Configured through the local Windows Internet Options control panel.

Answer

Managed automatically via DNS SRV records without console configuration.

Question 12

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

Accepted Answer

An Anti-Tamper password generated from the Cortex XDR management console.. The Cortex XDR agent is protected by an Anti-Tamper mechanism that prevents unauthorized local users (even administrators) from stopping, uninstalling, or disabling the agent. To temporarily disable it for troubleshooting, the administrator must obtain an Anti-Tamper password (also called an uninstall password) generated from the Cortex XDR management console (Settings > Agent Configurations or endpoint details). This password is then supplied locally via the command line (e.g., using cytool or the agent's CLI) to authorize the action.

Answer

A local administrator password configured during OS installation.

Answer

A registry override key set by group policy.

Answer

A network firewall bypass token.

Question 13

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

Accepted Answer

In the Agent Settings profile under Communication parameters.. The heartbeat interval for the Cortex XDR agent is a communication setting that controls how often the agent polls the management server for policy updates, telemetry uploads, and status checks. This is configured centrally in the Agent Settings profile under Communication parameters, which allows administrators to define the interval (e.g., every 5 minutes) and apply it to endpoint groups. Centralized configuration ensures consistency and avoids manual per-endpoint changes.

Answer

Directly within the local Windows registry on each endpoint.

Answer

In the Malware Prevention profile settings.

Answer

In the Global Protect Gateway configuration.

Question 14

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Cortex XDR's Local Analysis engine uses embedded machine learning classifiers that run directly on the endpoint, enabling detection of malicious behavior such as Living off the Land techniques without needing cloud connectivity. These local models analyze process behavior, command-line arguments, and other telemetry in real time, which is essential for offline or air-gapped environments.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 15

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

Accepted Answer

Configure automatic scheduled agent upgrades within the Distributions and Software management view.. Cortex XDR provides a centralized 'Distributions and Software management' view (under Endpoints > Agent Management) where administrators can configure automatic scheduled agent upgrades. This allows defining a target agent version, a schedule, and distribution rules (e.g., by endpoint group or tag), which minimizes network congestion by controlling the rollout pace and avoiding simultaneous downloads. It also provides reporting on upgrade status.

Answer

Execute 'cytool upgrade force' remotely using a PowerShell remoting script.

Answer

Enable the 'Auto-Update' feature in the Windows Update service settings.

Answer

Manually download the MSI and push it via group policy to all endpoints simultaneously.