Cybersecurity-Practitioner Endpoint Security Practice Test 2 — 15 Questions

Question 1

An administrator needs to temporarily disable the Cortex XDR agent on an endpoint for troubleshooting purposes. What mechanism is used to authorize this action locally using the command line?

Accepted Answer

An Anti-Tamper password generated from the Cortex XDR management console.. Disabling the agent locally requires an anti-tamper password generated from the Cortex XDR management console.

Answer

A local administrator password configured during OS installation.

Answer

A registry override key set by group policy.

Answer

A network firewall bypass token.

Question 2

An administrator wants to configure the frequency at which the Cortex XDR agent checks in with the management server. Where is this heartbeat interval configured?

Accepted Answer

In the Agent Settings profile under Communication parameters.. Agent communication settings, including heartbeat intervals, are managed within the Agent Settings profile.

Answer

Directly within the local Windows registry on each endpoint.

Answer

In the Malware Prevention profile settings.

Answer

In the Global Protect Gateway configuration.

Question 3

A security analyst is investigating a threat where a legitimate administrative tool (Living off the Land) was used maliciously. Cortex XDR generated an alert via Local Analysis. Which mechanism powers the Local Analysis engine to detect this type of threat without requiring an internet connection?

Accepted Answer

Embedded machine learning classifiers executed directly on the endpoint.. Local Analysis uses embedded machine learning models running locally on the endpoint to evaluate file features.

Answer

Periodic scheduled scans against the Palo Alto Networks threat intelligence cloud.

Answer

Real-time signature matching against a local antivirus definition database.

Answer

Continuous DNS tunneling queries sent to WildFire.

Question 4

An administrator needs to upgrade Cortex XDR agents across a large enterprise environment. To minimize network congestion and control the rollout, how should the administrator manage the upgrade process?

Accepted Answer

Configure automatic scheduled agent upgrades within the Distributions and Software management view.. Upgrades are managed by uploading new agent versions to the console and deploying them via scheduled upgrade tasks in the Distributions view.

Answer

Execute 'cytool upgrade force' remotely using a PowerShell remoting script.

Answer

Enable the 'Auto-Update' feature in the Windows Update service settings.

Answer

Manually download the MSI and push it via group policy to all endpoints simultaneously.

Question 5

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

Accepted Answer

Communication with the Cortex XDR server and essential DNS/DHCP services.. When an endpoint is isolated, network access is blocked except for communication with the Cortex XDR management server and specified DNS/DHCP services.

Answer

All network protocols without restriction.

Answer

SMB and RDP traffic to internal domain controllers.

Answer

All outbound traffic to external internet websites via HTTPS.

Question 6

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise, representing rules that detect suspicious behaviors.

Answer

Blocked Internal Operating Component

Answer

Basic Intelligent Output Control

Answer

Binary Indicator of Code

Question 7

An organization requires compliance reporting showing that all endpoints are actively protected by Cortex XDR modules (Anti-Malware, Exploit Prevention, Behavioral Threat Protection). Where can an administrator generate this comprehensive compliance report in the Cortex XDR management console?

Accepted Answer

Navigate to Cortex XDR Dashboards and Reports > Report Builder / Compliance views.. Reporting and dashboard views provide status summaries and compliance reporting for agent protection modules.

Answer

Run 'cytool report generate' on each endpoint locally.

Answer

Check the Windows Security Center dashboard on individual machines.

Answer

Export the raw endpoint inventory to CSV and correlate with firewall logs.

Question 8

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

Accepted Answer

The file was unknown to WildFire at execution time and was subsequently sent for analysis, resulting in a retroactive verdict.. If a file is entirely novel, local analysis or global intelligence may require dynamic analysis before a verdict is reached, or the file was executed before the verdict populated.

Answer

WildFire only analyzes network traffic passing through a Palo Alto Networks Next-Generation Firewall.

Answer

Local analysis blocks all files by default without cloud consultation.

Answer

The Cortex XDR agent does not integrate with WildFire cloud intelligence.

Question 9

An administrator is troubleshooting an issue where Cortex XDR agent logs need to be gathered and submitted to Palo Alto Networks Support. Which command generates a complete support file package (often referred to as 'collector') containing all necessary logs and debug data?

Accepted Answer

cytool support dump. The cytool dump or support log collection command packages agent diagnostic data for troubleshooting.

Answer

traps-support-collector.exe --full

Answer

pan-xdr-gather-logs.sh

Answer

cytool collect logs --support

Question 10

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

Accepted Answer

Custom BIOC (Behavioral Indicator of Compromise) rules. BIOC (Behavioral Indicator of Compromise) rules allow administrators to define custom detection criteria based on process behaviors and command lines.

Answer

WildFire Signature Generator

Answer

Agent Profile Exploit Exception builder

Answer

Host Insights Scheduled Query task

Question 11

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

Accepted Answer

Anti-Tamper Protection. Anti-Tamper protection prevents unauthorized users from stopping services, modifying files, or uninstalling the agent.

Answer

Active Directory Software Restriction Policies

Answer

GlobalProtect Client Lockdown

Answer

Windows User Account Control (UAC)

Question 12

An administrator is configuring disk encryption management in Cortex XDR for macOS endpoints. Which underlying native macOS technology does Cortex XDR manage and report on for disk encryption?

Accepted Answer

FileVault. FileVault is the native macOS disk encryption technology managed and monitored by Cortex XDR.

Answer

Apple Disk Utility RAID encryption

Answer

DM-Crypt / LUKS

Answer

BitLocker to Go

Question 13

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

Accepted Answer

Endpoint Management view. The Endpoint Management view provides a centralized inventory and status list of all managed endpoints.

Answer

Incident Response workbench

Answer

WildFire Analysis submissions portal

Answer

Threat Intelligence Feed manager

Question 14

Which THREE security modules are included as core components of the Cortex XDR agent architecture? (Choose three)

Accepted Answer

Behavioral Threat Protection (BTP) module. Cortex XDR integrates anti-malware, exploit prevention, and behavioral threat protection as core agent modules.

Answer

Enterprise BGP Routing protocol daemon

Answer

Stateful Packet Inspection Firewall core routing engine

Question 15

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Accepted Answer

Initiate a remote PowerShell session or run triage scripts via Remote Response.. Cortex XDR provides remote response and isolation capabilities directly from the console interface.

Answer

Reflash the physical BIOS firmware remotely to remove persistent bootkits.

Answer

Upgrade the physical RAM hardware configuration.

Answer

Reinstall the host operating system from a golden cloud image.