Cybersecurity-Practitioner Endpoint Security Practice Test 5 — 15 Questions

Question 1

A Cortex XDR administrator is configuring a Malware profile to prevent the execution of known malicious files. The administrator wants the agent to block files based on hash reputation from WildFire and local analysis, but also wants to allow a specific internally developed tool that is sometimes flagged as a false positive. Which Cortex XDR feature should the administrator use to exclude the tool from being blocked while keeping the rest of the Malware profile active?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the tool's hash to the Allow List in the Malware profile.. The Allow List in a Malware profile is designed to exclude specific files or hashes from being blocked, even if they are flagged as malicious. This allows the administrator to keep the Malware profile active for all other files while ensuring the internally developed tool runs without interference. It is the most targeted and secure method for handling false positives.

Answer

Add the tool's hash to the Block List in the Malware profile.

Answer

Disable the Malware profile on the endpoint.

Answer

Create a new Malware profile with a lower action level and assign it to the endpoint.

Question 2

A Cortex XDR administrator is configuring a device control policy to restrict USB mass storage usage on Windows endpoints while still allowing approved encrypted drives. Which TWO policy elements must be configured to enforce this requirement? (Choose two.)

Accepted Answer

Define a device control rule that blocks the USB mass storage device class. A device control rule that blocks the USB mass storage device class establishes the restriction, and an exception for approved encrypted drives by vendor and product ID permits only authorized devices. Exploit protection, report-only mode, and malware profile blocklists do not enforce device access control, so they cannot satisfy the requirement.

Answer

Set the agent to report-only mode for device control

Answer

Enable the exploit protection module for USB drivers

Answer

Add the USB mass storage class to the malware profile blocklist

Question 3

A Cortex XDR administrator needs to prevent users on a specific endpoint group from disabling the Cortex XDR agent through the Windows system tray. The administrator wants the agent to remain running and protected even if a user has local administrator rights. Which Cortex XDR agent setting should the administrator configure to achieve this?

Accepted Answer

Enable agent tamper protection in the endpoint policy. Tamper protection is the Cortex XDR agent capability designed to stop users from disabling, uninstalling, or modifying the agent, even with local administrator rights. Enabling it in the endpoint policy ensures the agent's services and files are protected, so attempts via the system tray or other local tools fail. This directly fulfills the requirement to keep the agent running and protected.

Answer

Apply a Windows Group Policy that removes the user's local administrator rights

Answer

Configure a BIOC rule to alert when the agent service stops

Answer

Set the agent to run in kernel mode instead of user mode

Question 4

An administrator is deploying Cortex XDR agents to a large fleet of Windows servers. A small subset of servers runs a legacy application that the Behavioral Threat protection module repeatedly terminates. The administrator wants to keep the module active on these servers but stop the false positives, and must ensure the exception is applied before the application runs again. What is the most appropriate approach?

Accepted Answer

Create a Behavioral Threat protection exception scoped by the legacy application's file path and signer, then verify the policy was applied on the endpoints.. The false positives come from Behavioral Threat protection, so the exception must target that module. Scoping it by the legacy application's path and signer limits the allowance to that binary while keeping the module active for all other processes, and verifying policy application ensures the exception is enforced before the application runs again.

Answer

Add the legacy application's hash to the Malware protection allow list and wait for the next content update to propagate.

Answer

Disable the legacy application's auto-start service and restart it manually after the exception is created.

Answer

Move the affected servers into a separate policy group with Behavioral Threat protection set to report-only mode.

Question 5

A security engineer is investigating a Cortex XDR alert on a Windows endpoint. The alert indicates that a process attempted to create a scheduled task, which is a common persistence technique. The engineer wants to see the exact command line and parent process that initiated this action. Which Cortex XDR artifact should the engineer examine?

Accepted Answer

The Alert Details pane, which includes the process image path and command line.. The Alert Details pane is the primary interface for understanding the context of a Cortex XDR alert. It includes the process image path, command line, and parent process, which are essential for determining how a scheduled task was created. This directly provides the information the engineer needs without requiring additional queries.

Answer

The Threat Intelligence report, which provides reputation scores for files.

Answer

The Policy Audit log, which records changes to security policies.

Answer

The Endpoint Management inventory table, which lists installed agents.

Question 6

A Cortex XDR administrator wants to ensure that endpoints can continue to receive updated threat signatures and policy changes even when they are roaming outside the corporate network. Which agent capability supports this requirement?

Accepted Answer

Direct communication with the Cortex XDR cloud service over the internet. Direct communication with the Cortex XDR cloud service over the internet enables roaming endpoints to receive signature and policy updates without relying on corporate network access. Local caching, manual cytool imports, and internal WSUS synchronization do not provide automatic updates for endpoints outside the corporate perimeter, so they fail to meet the requirement.

Answer

Local analysis with cached signatures only

Answer

Manual signature import via the cytool utility

Answer

Scheduled synchronization through an internal WSUS server

Question 7

A security engineer is deploying Cortex XDR agents to a fleet of Linux servers. The engineer wants to prevent users on those servers from terminating the agent process or unloading its kernel module. Which Cortex XDR feature should the engineer enable to protect the agent from tampering on the Linux endpoints?

Accepted Answer

Enable the agent self-protection setting in the endpoint policy so the agent resists termination and module unloading attempts.. Agent self-protection is the Cortex XDR feature that defends the agent against termination, process killing, and kernel module unloading by local users, including privileged ones. Enabling it in the endpoint policy directly addresses the tampering concern on Linux servers. Host Firewall, Device Control, and Exploit Protection address different security domains and cannot prevent agent tampering.

Answer

Configure a Host Firewall rule that blocks outbound connections from the agent process to the Cortex XDR server.

Answer

Apply a Device Control policy that prevents execution of unsigned binaries on the Linux servers.

Answer

Enable the Exploit Protection module with kernel-level mitigation rules for all processes on the Linux servers.

Question 8

A Cortex XDR administrator notices that a specific Windows endpoint repeatedly triggers behavioral threat alerts for a legitimate internally developed accounting application. The administrator wants the application to run without generating further behavioral alerts while keeping all other protection modules active. What is the MOST appropriate action?

Accepted Answer

Create a Behavioral Threat exception in the Cortex XDR management console that scopes the exception to the application's path or signature. Behavioral Threat exceptions let administrators scope suppression to a specific application using path, signer, or hash while keeping the Behavioral Threat module active for all other processes. This achieves the required outcome of running the legitimate accounting application without alerts, without weakening protection across the endpoint group or disabling unrelated modules.

Answer

Disable the Behavioral Threat protection module on the endpoint group via the agent settings policy

Answer

Move the endpoint into a new endpoint group that has the exploit protection module disabled

Answer

Add the application's file hash to the Block List in the Cortex XDR management console

Question 9

A Cortex XDR administrator is reviewing endpoint protection profiles and notices that a group of endpoints has the Exploit protection module enabled but the Malware protection module disabled. The administrator wants to understand the security implication of this configuration. Which statement best describes the effect?

Accepted Answer

The endpoints are protected against memory corruption attacks but not against known malicious files or behavior-based malware execution.. Exploit protection and Malware protection cover different threat classes. With Exploit protection enabled and Malware protection disabled, the endpoints resist memory corruption attacks but lack the file and behavior-based malware detection that Malware protection provides, leaving a meaningful gap that the administrator should address.

Answer

The endpoints are protected against malware but not against exploitation of vulnerable applications.

Answer

The endpoints cannot receive policy updates until Malware protection is re-enabled.

Answer

The endpoints are fully protected because Exploit protection includes signature-based malware detection.

Question 10

A Cortex XDR administrator is deploying agents to a mix of Windows and macOS endpoints. The administrator needs to ensure that the agents can communicate with the Cortex XDR management server through a forward proxy. Which TWO configuration settings must be specified in the agent configuration to enable proxy communication? (Choose two.)

Accepted Answer

Proxy server address and port.. To enable communication through a forward proxy, the agent configuration must include the proxy server address and port, as well as authentication credentials if the proxy requires them. These settings allow the agent to establish a connection and authenticate with the proxy, ensuring that telemetry and management traffic reach the Cortex XDR management server.

Answer

DNS server addresses for the proxy.

Answer

Broker VM address and port.

Answer

SSL/TLS certificate for the proxy.

Question 11

A security analyst observes that a Cortex XDR agent on a Windows server is not enforcing exploit protection rules even though the policy is assigned. The agent status shows as connected and other modules are working. Which action should the analyst take first to diagnose the issue?

Accepted Answer

Verify that the exploit protection module is enabled in the assigned policy and that the server's operating system is supported. Verifying that exploit protection is enabled in the assigned policy and that the server OS is supported is the correct first step because non-enforcement often stems from a disabled module setting or an unsupported platform. Reinstalling, disabling other modules, or changing proxy settings do not address these likely causes and may introduce unnecessary disruption.

Answer

Reinstall the Cortex XDR agent on the server

Answer

Disable all other protection modules to isolate exploit protection

Answer

Change the agent's communication proxy settings

Question 12

An organization wants to prevent users on managed Windows endpoints from writing data to unapproved USB mass storage devices while still allowing approved encrypted USB drives to be used. Which Cortex XDR capability should the administrator configure to meet this requirement?

Accepted Answer

Device Control policy in the Cortex XDR management console with rules that allow specific device IDs and block the rest. Cortex XDR Device Control provides policy-based allow-listing and blocking of removable devices by class, vendor, product, and serial number. Configuring rules that permit only approved encrypted USB drives and block all other mass storage devices satisfies the requirement while keeping USB ports available for sanctioned peripherals, and it is applied through the management console to the relevant endpoint groups.

Answer

Host Firewall policy in the Cortex XDR management console with rules blocking outbound SMB traffic

Answer

Disk Encryption policy in the Cortex XDR management console enforced on all removable media

Answer

Exploit Protection policy in the Cortex XDR management console with browser plugin protections enabled

Question 13

A Cortex XDR administrator is investigating an alert where a process attempted to inject code into a legitimate system process. The administrator wants to understand the sequence of events that led to the alert. Which Cortex XDR feature provides a visual representation of related events and process lineage to aid in this investigation?

Accepted Answer

Causality Analysis view.. Causality Analysis view is designed to visualize the chain of events and process relationships, making it the correct tool for investigating how an alert occurred. It shows the process tree and associated activities, enabling analysts to trace the sequence of events. The other options are either lists without visual context or unrelated to event investigation.

Answer

Alerts table with filtering by alert name.

Answer

Policy Audit log.

Answer

Endpoint Management inventory.

Question 14

A Cortex XDR administrator is reviewing endpoint protection settings for a group of macOS laptops used by the finance department. The organization wants to ensure that only approved applications can execute on these laptops and that any attempt to run unapproved software is blocked and reported. Which Cortex XDR capability should the administrator configure to meet this requirement?

Accepted Answer

Application Control policy using an allow list of approved applications with block and report actions for unapproved executables. Application Control in Cortex XDR enforces execution of only approved applications through allow lists, with block and report actions for anything unapproved. This matches the requirement to permit only approved software on the macOS laptops and to log blocked attempts. WildFire, malware scanning, and Host Firewall address different threats and do not enforce application approval status.

Answer

Malware Protection profile with Real-Time Scanning and quarantine actions for detected threats

Answer

WildFire file analysis with automatic verdict enforcement on all executables

Answer

Host Firewall policy that restricts outbound network connections from the macOS laptops

Question 15

A Cortex XDR administrator needs to confirm that a newly deployed Windows endpoint has successfully registered with the management console and is receiving policy updates. Which indicator in the Cortex XDR management console confirms that the endpoint is actively managed?

Accepted Answer

The endpoint appears in the Endpoint Management inventory with a status of Connected and a recent Last Seen timestamp. The Endpoint Management inventory is the authoritative source for confirming agent registration and connectivity. An endpoint listed with a Connected status and a recent Last Seen timestamp demonstrates that the agent has registered and is checking in, which means it is receiving policy updates from the management console as intended.

Answer

The endpoint's hostname is resolvable via DNS from the administrator's workstation

Answer

The endpoint responds to an ICMP ping from the management console's network segment

Answer

A user on the endpoint confirms that the Cortex XDR tray icon is visible in the system notification area