Cybersecurity-Practitioner Endpoint Security Practice Test 4 — 15 Questions

Question 1

Which THREE conditions or indicators typically trigger an automated endpoint isolation action in Cortex XDR? (Choose three)

Accepted Answer

Critical Behavioral Indicator of Compromise (BIOC) match indicating active data exfiltration.. Option A is correct because a critical Behavioral Indicator of Compromise (BIOC) match that indicates active data exfiltration represents a high-severity, in-progress threat, which is exactly the kind of condition Cortex XDR uses to automatically isolate an endpoint and stop the data loss. Option B is correct because high-confidence Command and Control (C2) communication detected through behavioral analysis signals an active attacker channel, and automated isolation is a standard response to cut off that C2 traffic. Option D is correct because confirmed ransomware execution encrypting local files is an active, destructive attack requiring immediate containment, so Cortex XDR triggers automated endpoint isolation to halt further encryption. Option C is not correct because a failed Windows Update is a routine software/patch management issue, not a security incident that warrants isolating the endpoint. Option E is not correct because a user visiting an unauthorized social media site is a policy violation at most, not a malicious threat indicator that would trigger automated isolation.

Answer

A standard software update failing to install via Windows Update.

Answer

A user attempting to access an unauthorized social media website during lunch.

Question 2

Which THREE types of data are gathered and ingested by Cortex XDR to provide comprehensive endpoint visibility? (Choose three)

Accepted Answer

Registry modification events.. Cortex XDR ingests endpoint telemetry from the Palo Alto Networks Cortex XDR agent, which includes process execution and termination telemetry (Option C) — the agent records process creation, command lines, parent-child relationships, and termination events to build the causality chain used in the Cortex XDR causality analysis engine. It also collects network connection and socket activity logs (Option D), capturing details such as source/destination IP addresses, ports, protocols, and the processes that opened sockets, which are essential for detecting command-and-control and lateral movement. Registry modification events (Option A) are likewise gathered, since the agent monitors Windows registry key/value changes (e.g., Run keys, services, and persistence locations) to surface malicious persistence and configuration tampering. Options B and E are not endpoint security telemetry: personal email bodies and browser photo uploads are user content that Cortex XDR does not ingest, and cafeteria menu preferences are entirely unrelated to endpoint visibility.

Answer

Personal user email message bodies and browser photo uploads.

Answer

Internal corporate cafeteria menu preferences.

Question 3

A Cortex XDR administrator needs to prevent users on managed Windows endpoints from launching an unauthorized peer-to-peer file-sharing tool. The administrator wants the Cortex XDR agent to block the executable and record the attempt in the console without relying on file hash values that change with every update. Which Cortex XDR agent capability should the administrator configure?

Accepted Answer

Restrictions Profile with a Block List rule on the executable path or name. Application execution control on Cortex XDR endpoints is delivered through the Restrictions Profile, where Block List rules deny execution of specified executables. Because the rule targets the executable name or path, it remains effective after the vendor ships an updated binary, and every denial is logged as an agent event that appears in the console for auditing.

Answer

Malware Profile with WildFire inline verdicts

Answer

Exploit Protection module with a browser plugin rule

Answer

Device Control module with a USB mass storage rule

Question 4

A Cortex XDR administrator is tuning the Behavioral Threat Protection module because several legitimate administrative scripts are generating false positives on managed endpoints. The administrator wants to keep the protection active while suppressing alerts only for the specific script paths involved, without disabling the module globally. What is the correct approach?

Accepted Answer

Create a Behavioral Threat Protection exception for the specific script paths in the Malware Profile.. Behavioral Threat Protection watches process behaviour for indicators such as script interpreters spawning unusual children. When trusted administrative scripts are misclassified, the precise fix is a scoped exception that names those script paths in the Malware Profile. This preserves behavioural coverage for all other activity while eliminating the specific false positives the administrator identified.

Answer

Add the script file hashes to the WildFire allow list in the Cortex XDR console.

Answer

Disable the Behavioral Threat Protection module in the Malware Profile for the affected endpoint group.

Answer

Lower the Behavioral Threat Protection severity threshold on the agent policy.

Question 5

A security team wants to prevent a specific known-malicious executable from running on all Windows endpoints managed by Cortex XDR. The file's SHA-256 hash is known, but the filename may vary. They must ensure the block is enforced even if the file is renamed. Which Cortex XDR capability should they use?

Accepted Answer

Create a Malware profile with a hash-based blocklist entry for the SHA-256 hash.. Malware profiles support hash-based blocklists, allowing precise identification of malicious files by SHA-256. This method is effective even if the file is renamed or moved, because the hash remains constant. Other options either rely on mutable attributes like filename or path, or are designed for different purposes such as exploit mitigation or execution restrictions.

Answer

Add the file path to the Exploit Prevention module's exclusion list.

Answer

Configure a Behavioral Threat protection rule that flags processes with the same original filename.

Answer

Enable the Restriction policy to deny execution of unsigned binaries in the Downloads folder.

Question 6

An administrator is configuring Cortex XDR to allow a legitimate application that performs process injection for accessibility purposes. The application is currently being blocked by the agent's protection modules. Which action should the administrator take to allow the application while minimizing the reduction in security?

Accepted Answer

Create a Behavioral Threat exception for the specific process name and the injection behavior.. Behavioral Threat exceptions are designed to permit specific behaviors for specific processes, providing a surgical way to allow legitimate applications that might otherwise be blocked. This approach maintains protection against the same behavior from other processes, unlike disabling modules or creating global exclusions. It is the most precise and secure method.

Answer

Disable the Exploit Prevention module entirely on the endpoint.

Answer

Create a global exclusion for all process injection events on all endpoints.

Answer

Add the application's digital signature to the allow list in the Malware profile.

Question 7

A security analyst is investigating a Windows endpoint where the Cortex XDR agent has blocked a series of suspicious process executions. The analyst wants to permanently allow a legitimate internal administrative tool that the agent keeps terminating, without weakening protection for other executables. Where should the analyst configure this exception in the Cortex XDR management console?

Accepted Answer

In the Exceptions page, by creating an exception rule that targets the Behavioral Threat protection module with the tool's process path.. Cortex XDR exceptions are applied per protection module, so the analyst must create an exception that targets Behavioral Threat protection. Scoping the exception to the specific process path stops the repeated termination of the legitimate administrative tool while leaving the module active for all other executables, which preserves the endpoint's overall protection posture.

Answer

In the Malware Protection profile under the Restriction settings, by adding the tool's hash to the allow list.

Answer

In the WildFire analysis profile, by adding the tool's file path to the benign file list so it is not detonated.

Answer

In the Agent Settings page, by disabling the Behavioral Threat protection module on the affected endpoint only.

Question 8

A Cortex XDR administrator needs to prevent a specific known-malicious executable from running on all Windows endpoints in the environment, regardless of file name changes. Which Cortex XDR capability should be configured to block the file based on its hash?

Accepted Answer

Malware profile with a hash-based blocklist entry. Configuring a malware profile with a hash-based blocklist entry is the correct approach because Cortex XDR can match files by their SHA-256 hash, which remains constant even when the file name changes. Exploit protection, behavioral threat protection, and path-based restriction policies do not provide hash-based blocking, so they cannot reliably stop a renamed malicious executable.

Answer

Behavioral threat protection policy with a process exception

Answer

Exploit protection module with a custom signature

Answer

Restriction policy with a path-based allow list

Question 9

A security analyst is investigating a Windows endpoint where a user downloaded a legitimate-looking PDF invoice. The file executed a macro that spawned a child process, and Cortex XDR generated a 'Local Analysis Malware' alert. The analyst wants to determine whether the file was also submitted to WildFire for cloud-based verdict. Which Cortex XDR feature should the analyst check to confirm whether the file hash was sent for WildFire analysis?

Accepted Answer

The WildFire Submission Log in the Cortex XDR management console. WildFire submissions—whether automatic from the agent or manual from an analyst—are recorded in the WildFire Submission Log within the Cortex XDR console. Checking this log confirms whether the PDF hash was detonated in the cloud, what verdict was returned, and whether the file was already known. This gives the analyst the definitive cloud-analysis context needed to complete the investigation.

Answer

The Cortex XDR agent installation directory on the endpoint

Answer

The Endpoint Management inventory table filtered by agent version

Answer

The Audit Log filtered by the analyst's administrative actions

Question 10

A security team wants Cortex XDR to automatically terminate a process and quarantine the associated file when a known ransomware behavior is detected on an endpoint, without requiring analyst intervention. Which policy setting must be enabled to achieve automatic response?

Accepted Answer

Configure the behavioral threat protection module with the 'Block and terminate' action. Configuring the behavioral threat protection module with the block-and-terminate action is correct because Cortex XDR can automatically terminate a malicious process and quarantine its file upon detecting known ransomware behavior. Block mode on a malware profile only prevents execution, report-only mode takes no action, and allow-listing the hash would permit the threat, so none of those meet the automatic response requirement.

Answer

Enable the malware profile in block mode

Answer

Add the ransomware hash to the allow list

Answer

Set the agent to report-only mode for behavioral threats

Question 11

A newly hired administrator needs to confirm that a Windows endpoint's Cortex XDR agent is healthy and communicating with the management server. The administrator opens the endpoint's local agent console. Which status indicator should the administrator expect to see when the agent is fully operational and connected?

Accepted Answer

A green status showing the agent is connected and all protection modules are enabled.. When a Cortex XDR agent is fully operational, the local console shows a connected status with protection modules enabled, commonly represented in green. This indicates the agent is enrolled, communicating with the management server, and enforcing policy, which is the confirmation the administrator needs for a healthy endpoint.

Answer

A red status indicating the agent cannot reach the management server and is buffering events locally.

Answer

An amber status showing the agent is connected but one or more protection modules are disabled.

Answer

A gray status indicating the agent is in a pending registration state awaiting approval.

Question 12

A security administrator is configuring a Cortex XDR agent policy for a group of Windows workstations that run a proprietary line-of-business application. The application frequently triggers behavioral threat alerts because it spawns command interpreters and writes to system directories. The administrator wants to suppress these known-good alerts without disabling behavioral threat protection for the rest of the endpoint. What should the administrator configure?

Accepted Answer

Add the application's executable to the allow list in the Behavioral Threat protection module and specify the relevant behavioral indicators.. Behavioral Threat protection in Cortex XDR can be tuned with an allow list that scopes exemptions to specific executables and behavioral indicators. This preserves detection coverage for all other processes while eliminating the noisy known-good alerts generated by the line-of-business application. Group-wide module disabling, BIOC ignores, and malware scanning exclusions do not target the behavioral detection engine correctly.

Answer

Exclude the application's installation directory from Real-Time Scanning in the Malware protection profile and restart the agent.

Answer

Create a BIOC rule that matches the application's process name and set its action to Ignore in the Cortex XDR management console.

Answer

Disable the Behavioral Threat protection module in the agent policy and rely solely on Malware protection for the workstation group.

Question 13

A Cortex XDR administrator is configuring a Behavioral Threat protection policy for a finance department. The policy must prevent credential theft attempts where a non-browser process reads LSASS memory on Windows endpoints. The administrator wants the agent to block the behavior without terminating the parent process. Which Cortex XDR configuration should the administrator apply to meet this requirement?

Accepted Answer

Enable the 'Credential Gathering' behavior in the Behavioral Threat module with action set to Block. The Behavioral Threat module includes a Credential Gathering category specifically designed to detect and block unauthorized reads of LSASS memory. Setting the action to Block stops the credential theft attempt at the memory-access stage while leaving the calling process intact. This aligns with the requirement to prevent the behavior without terminating the parent process, preserving business continuity while stopping the attack.

Answer

Enable the 'Process Execution' behavior with action set to Report for all non-browser processes

Answer

Create a BIOC rule that matches lsass.exe as the target process and set the action to Terminate

Answer

Add lsass.exe to the Exploit Protection exclusions list for the finance department policy

Question 14

A security team is hardening Windows endpoints managed by Cortex XDR and wants to reduce the attack surface exploited by common malware techniques. Which TWO capabilities does the Cortex XDR agent provide to restrict malicious behavior at the endpoint? (Choose two.)

Accepted Answer

Exploit protection that intercepts memory corruption attempts against vulnerable applications.. Cortex XDR restricts attacker behavior on the endpoint through Behavioral Threat protection, which blocks malicious activity chains, and Exploit protection, which mitigates memory corruption attempts against vulnerable applications. Together these enforcement modules reduce the techniques malware commonly relies on, which is the hardening outcome the team is pursuing.

Answer

Vulnerability scanning that inventories missing patches across the managed fleet.

Answer

Network-based intrusion prevention that inspects traffic at the perimeter firewall.

Answer

Full disk encryption management that secures data at rest on the endpoint drive.

Question 15

A security operations analyst wants to verify that Cortex XDR agents on managed endpoints are actively communicating with the Cortex XDR server and receiving policy updates. Which Cortex XDR component is responsible for maintaining this communication channel between the agent and the management server?

Accepted Answer

The Cortex XDR agent's communication service that connects to the Cortex XDR server over the configured port. The Cortex XDR agent includes a dedicated communication service that maintains the channel to the management server, handling registration, heartbeats, and policy synchronization. Checking that this service is running and can reach the server confirms active connectivity. The management console, WildFire, and external dynamic lists serve different roles and do not provide the agent-to-server transport.

Answer

The external dynamic list service that synchronizes indicators from third-party feeds

Answer

The Cortex XDR management console web interface

Answer

The WildFire cloud analysis service that inspects files submitted from endpoints