Cybersecurity-Practitioner Endpoint Security Practice Test 3 — 15 Questions

Question 1

An endpoint has been flagged in Cortex XDR with multiple high-severity alerts. The security operations team decides to isolate the endpoint immediately to prevent lateral movement. Which network traffic remains permitted by default when an endpoint is placed in isolation mode in Cortex XDR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Communication with the Cortex XDR server and essential DNS/DHCP services.. When a Cortex XDR endpoint is isolated, all network traffic is blocked except for communication with the Cortex XDR server and essential services like DNS and DHCP. This allows the agent to continue receiving instructions and maintain connectivity for management purposes while preventing lateral movement.

Answer

All network protocols without restriction.

Answer

SMB and RDP traffic to internal domain controllers.

Answer

All outbound traffic to external internet websites via HTTPS.

Question 2

An administrator is reviewing endpoint security profiles and notices the term 'BIOC'. What does BIOC stand for in the context of Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise. In Cortex XDR, BIOCs are behavioral rules that detect malicious activity based on sequences of actions or behaviors rather than static signatures. They are used to identify advanced threats that may not have known file hashes or IOCs.

Answer

Blocked Internal Operating Component

Answer

Basic Intelligent Output Control

Answer

Binary Indicator of Code

Question 3

A security analyst notices that WildFire has successfully analyzed a suspicious file uploaded from an endpoint, but the local Cortex XDR agent did not automatically block it upon first encounter. What is the most likely explanation for this behavior?

Accepted Answer

The file was unknown to WildFire at execution time and was subsequently sent for analysis, resulting in a retroactive verdict.. The most likely explanation is that the file was unknown to WildFire at execution time, so the local agent allowed it to run while submitting it for cloud analysis; WildFire then returned a malicious verdict, enabling retroactive blocking. This is the standard WildFire workflow: unknown files are detonated in the cloud, and the verdict is applied after analysis completes.

Answer

WildFire only analyzes network traffic passing through a Palo Alto Networks Next-Generation Firewall.

Answer

Local analysis blocks all files by default without cloud consultation.

Answer

The Cortex XDR agent does not integrate with WildFire cloud intelligence.

Question 4

A security analyst wants to configure a custom alert rule in Cortex XDR that triggers whenever a specific command-line pattern is observed across multiple endpoints. Which feature should the analyst use to create this behavioral alert?

Accepted Answer

Custom BIOC (Behavioral Indicator of Compromise) rules. Custom BIOC (Behavioral Indicator of Compromise) rules in Cortex XDR let analysts define behavioral logic using the Causality Analysis Engine, matching process, command-line, and file events across all endpoints. A BIOC rule can specify a command-line pattern (e.g., regex on process arguments) and trigger alerts whenever that behavior is observed fleet-wide. This is exactly the feature designed for custom behavioral detection.

Answer

WildFire Signature Generator

Answer

Agent Profile Exploit Exception builder

Answer

Host Insights Scheduled Query task

Question 5

An administrator wants to ensure that end users cannot tamper with or uninstall the Cortex XDR agent from their workstations. Which feature provides this protection?

Accepted Answer

Anti-Tamper Protection. Cortex XDR's Anti-Tamper Protection prevents end users and non-privileged processes from stopping, uninstalling, or modifying the agent, ensuring continuous endpoint visibility and enforcement. It works by protecting the agent's processes, files, and registry keys from tampering, and requires administrative or uninstall-password authorization to remove. This is the built-in feature designed specifically for agent self-protection.

Answer

Active Directory Software Restriction Policies

Answer

GlobalProtect Client Lockdown

Answer

Windows User Account Control (UAC)

Question 6

An administrator is configuring disk encryption management in Cortex XDR for macOS endpoints. Which underlying native macOS technology does Cortex XDR manage and report on for disk encryption?

Accepted Answer

FileVault. Cortex XDR manages and reports on FileVault, which is the native full-disk encryption technology built into macOS. FileVault encrypts the startup disk using XTS-AES-128 with a 256-bit key, and Cortex XDR can enforce, monitor, and report on its status across managed macOS endpoints. This integration allows administrators to ensure compliance with disk encryption policies.

Answer

Apple Disk Utility RAID encryption

Answer

DM-Crypt / LUKS

Answer

BitLocker to Go

Question 7

Where in the Cortex XDR management console can an administrator view the operational health, connection status, and version of all deployed agents?

Accepted Answer

Endpoint Management view. The Endpoint Management view in the Cortex XDR management console provides a centralized dashboard to monitor the operational health, connection status, and version of all deployed agents. Administrators can see which endpoints are online, which agents need updates, and any issues affecting agent communication.

Answer

Incident Response workbench

Answer

WildFire Analysis submissions portal

Answer

Threat Intelligence Feed manager

Question 8

Which THREE security modules are included as core components of the Cortex XDR agent architecture? (Choose three)

Accepted Answer

Behavioral Threat Protection (BTP) module. The Cortex XDR agent architecture includes the Behavioral Threat Protection (BTP) module (A), which analyzes process behavior and chains of events locally to detect and block malicious activity such as ransomware and fileless attacks. The Exploit Prevention module (C) is also a core component, protecting endpoints against exploitation of software vulnerabilities by techniques like memory corruption and ROP, independent of signature updates. The Anti-Malware prevention module (E) is likewise core, providing signature- and heuristic-based scanning and blocking of known and unknown malware on the endpoint. Options B and D are incorrect because an Enterprise BGP Routing protocol daemon and a Stateful Packet Inspection Firewall core routing engine are network infrastructure functions, not components of the Cortex XDR endpoint agent.

Answer

Enterprise BGP Routing protocol daemon

Answer

Stateful Packet Inspection Firewall core routing engine

Question 9

Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)

Accepted Answer

Initiate a remote PowerShell session or run triage scripts via Remote Response.. Option B is correct because Cortex XDR's Remote Response capability lets analysts open a live terminal (including a remote PowerShell session on Windows) and execute triage scripts or commands directly on the compromised endpoint from the management console. Option E is correct because the console provides a one-click Endpoint Isolation action that severs the host's network connectivity (except to the Cortex XDR management channel) to contain the threat and prevent lateral movement. Options A, C, and D are incorrect because reflashing BIOS firmware, upgrading physical RAM, and reinstalling the OS from a golden image are hardware/firmware or imaging operations that fall outside the Cortex XDR console's agent-based response actions and would require separate tools or physical/out-of-band access.

Answer

Reflash the physical BIOS firmware remotely to remove persistent bootkits.

Answer

Upgrade the physical RAM hardware configuration.

Answer

Reinstall the host operating system from a golden cloud image.

Question 10

Which TWO methods can be utilized to distribute Cortex XDR agent installation packages across an enterprise Windows environment? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) software installation.. Option C is correct because Active Directory Group Policy Object (GPO) software installation is a native Windows mechanism that lets administrators assign or publish MSI packages to domain-joined computers, so the Cortex XDR agent installer can be pushed automatically at startup or logon across the enterprise. Option E is correct because centralized software deployment platforms such as Microsoft Endpoint Configuration Manager (SCCM) and Microsoft Intune are designed for large-scale, managed distribution of applications and can deploy the Cortex XDR agent package to Windows endpoints with reporting and targeting. Option A is not appropriate because Cortex XDR agent packages are not distributed through public app stores for self-service installation, and that would not provide centralized enterprise control. Option B is not appropriate because broadcasting an unencrypted installer over subnet broadcast domains is insecure and unreliable, and it is not a supported enterprise deployment method. Option D is not appropriate because emailing installer binaries as attachments exposes the package to interception and relies on manual user execution, which is neither secure nor scalable for enterprise-wide deployment.

Answer

Direct user self-service installation via public app store downloads.

Answer

Broadcasting the installer binary unencrypted over local subnet broadcast domains.

Answer

Embedding the installer inside incoming corporate email attachments for users to execute.

Question 11

Which TWO platforms are officially supported for deploying the Cortex XDR Agent? (Choose two)

Accepted Answer

Apple macOS endpoints.. Option B (Apple macOS endpoints) is correct because the Cortex XDR agent officially supports macOS (e.g., macOS 10.15 Catalina and later Intel/Apple Silicon builds), allowing endpoint protection, EDR telemetry, and policy enforcement on Mac workstations. Option C (Microsoft Windows workstations and servers) is correct because the agent officially supports Windows client and server editions (such as Windows 10/11 and Windows Server 2016/2019/2022), which are core supported platforms for Cortex XDR deployment. The unmarked options do not belong: personal gaming consoles (A) run closed console OSes with no supported agent package, legacy 1980s mainframe operating systems (D) are not supported endpoint platforms, and consumer smart home IoT routers (E) run embedded proprietary firmware that cannot host the Cortex XDR agent.

Answer

Personal gaming consoles.

Answer

Legacy mainframe operating systems from the 1980s.

Answer

Consumer smart home IoT routers running embedded proprietary firmware.

Question 12

Which TWO pieces of information are displayed in the Cortex XDR Endpoint Management inventory table for a managed agent? (Choose two)

Accepted Answer

Operating system type and version.. Option D is correct because the Cortex XDR Endpoint Management inventory table reports each managed endpoint's operating system type and version, which is core asset data used for filtering and compliance. Option E is correct because the same inventory view lists the installed Cortex XDR agent version number, allowing administrators to verify agent builds and plan upgrades. These two fields are standard columns in the Endpoint Management inventory for a managed agent. Options A, B, and C are not part of that inventory table: printer queue status, BIOS manufacturer serial number/asset tag, and Wi-Fi SSID signal strength are not agent inventory attributes displayed there.

Answer

Local user printer queue statuses.

Answer

Current BIOS manufacturer serial number and asset tag.

Answer

Wi-Fi router SSID signal strength percentage.

Question 13

Which THREE mechanisms are employed by Cortex XDR to protect endpoints against unknown zero-day file-based malware? (Choose three)

Accepted Answer

Cloud-based WildFire static and dynamic analysis sandbox.. Option A is correct because Cortex XDR submits unknown files to the cloud-based WildFire sandbox, which performs static and dynamic analysis to detect never-before-seen zero-day malware without relying on prior signatures. Option C is correct because Behavioral Threat Protection (BTP) monitors execution chains and process behaviors in real time, allowing it to identify malicious activity from unknown files based on behavior rather than known hashes. Option E is correct because Cortex XDR runs local machine learning models directly on the endpoint, enabling it to classify and block unknown file-based malware even when offline or before cloud verdicts return. Option B is not correct because MD5 hash blocklists are signature-based and cannot detect unknown zero-day files that have no known hash. Option D is not correct because prompting users for manual verification on every file execution is not a Cortex XDR malware protection mechanism and would not reliably stop zero-day threats.

Answer

Traditional static MD5 hash blocklists updated hourly.

Answer

Manual user verification prompts upon every file execution.

Question 14

Which THREE diagnostic or troubleshooting steps can be performed using the 'cytool' command-line utility on a local endpoint? (Choose three)

Accepted Answer

Generating support logs and diagnostic dumps ('cytool support dump').. Option A is correct because 'cytool support dump' is a documented cytool subcommand that collects support logs and diagnostic dumps from the local endpoint for troubleshooting. Option B is correct because 'cytool protection query' reports the state of the protection modules (such as the various sensor/defense components) on that endpoint, which is a core diagnostic use of the utility. Option D is correct because 'cytool query status' returns the agent's overall status and operational health, letting an administrator verify whether the endpoint agent is functioning normally. Option C does not belong because LDAP domain controller replication schedules are configured in directory services (e.g., AD Sites and Services or repadmin), not by cytool. Option E does not belong because NAT routing tables on a core switch are managed on network infrastructure via switch/router configuration, not by a local endpoint command-line utility.

Answer

Configuring enterprise LDAP domain controller replication schedules.

Answer

Modifying global firewall NAT routing tables on the core switch.

Question 15

Which TWO actions should an administrator take when a legitimate software application is falsely blocked by Cortex XDR Behavioral Threat Protection (BTP)? (Choose two)

Accepted Answer

Create a Behavioral Threat Protection exception rule specifying the relevant criteria and file attributes.. Option A is correct because Cortex XDR Behavioral Threat Protection supports exception rules that let administrators whitelist a legitimate process by specifying criteria such as the module name, process path, signer, or hash, so the benign application is no longer falsely blocked while BTP remains active. Option C is correct because submitting the false-positive sample to Palo Alto Networks allows the threat research team to analyze the file and adjust the BTP logic or signatures, preventing the same false detection for other endpoints in the future. Option B is wrong because disabling the operating system firewall globally removes a critical security control and has no bearing on a Cortex XDR BTP false positive. Option D is wrong because uninstalling the Cortex XDR agent from all endpoints would eliminate endpoint protection entirely rather than resolve the specific false positive. Option E is wrong because formatting and reinstalling the OS is a destructive, disproportionate action that does not address the BTP detection logic.

Answer

Disable operating system firewall services globally.

Answer

Completely uninstall the Cortex XDR agent from all corporate endpoints.

Answer

Format the hard drive and reinstall the operating system.