Cybersecurity-Practitioner Endpoint Security — Timed 10 Questions

Question 1

A security analyst is investigating a suspicious process execution chain in the Cortex XDR Incident Viewer. The analyst wants to understand the exact sequence of child processes spawned by a malicious PowerShell script. Which Cortex XDR feature provides a graphical representation of the attack lifecycle and process relationships?

10 minute time limit — choose an answer to begin.

Accepted Answer

Causality Chain (BIOC view) in the Incident View. BIOC and Causality Analysis provide a visual causality chain showing process spawning trees and related artifacts.

Answer

Global Protect Network Topology graph

Answer

Advanced Endpoint Query builder

Answer

Threat Intelligence Cloud lookup tool

Question 2

An administrator wants to verify which Cortex XDR agent version is installed on a specific Windows endpoint using the command line. Which command should be executed?

Accepted Answer

cytool version query. The 'cytool' command-line utility provides administrative functions, including checking the exact version of the installed agent.

Answer

cytool agent-version

Answer

cytool operacional status

Answer

cytool info query

Question 3

A security engineer needs to investigate endpoint telemetry data for a suspicious fileless attack that executed PowerShell commands out of memory. Which Cortex XDR component provides deep forensic visibility into command-line arguments, registry modifications, and network connections without relying solely on traditional logs?

Accepted Answer

Cortex XDR Host Insights data collection and querying engine. Host Insights provides comprehensive endpoint telemetry and forensic data storage for deep hunting and investigation.

Answer

Cortex XDR Malware Prevention module

Answer

Local Analysis engine utilizing machine learning models

Answer

WildFire cloud-based static and dynamic analysis sandbox

Question 4

An administrator needs to check the status of the Exploit Prevention module on a Windows endpoint running Cortex XDR. Which command should be used?

Accepted Answer

cytool protection query. The cytool command-line utility includes specific subcommands to inspect module states, such as exploit prevention.

Answer

cytool anti-exploit query

Answer

cytool module-check --exploit

Answer

cytool exploit status

Question 5

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore connectivity, the administrator must navigate to the Endpoint Management view, select the isolated endpoint, and issue the Remove Isolation action.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 6

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. Remote Response is the Cortex XDR feature that provides a secure interactive shell and script execution capability on managed endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 7

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

Accepted Answer

Use the /INSTALLTOKEN= parameter followed by the unique registration token string.. The INSTALLTOKEN parameter is required during unattended or mass installations to associate the agent instance with the correct tenant in Cortex XDR.

Answer

Use the /REGKEY= parameter followed by the tenant activation password.

Answer

Use the /SERVER= parameter to define the cloud instance URL.

Answer

Use the /TENANTID= parameter followed by the fully qualified domain name.

Question 8

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Hashing the specific file or using a signed certificate exception provides targeted remediation without compromising endpoint security.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 9

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

Accepted Answer

Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.. Putting the exploit protection module into Report (Audit) mode allows verification of potential blocks without disrupting user productivity.

Answer

Add the browser executable path to the OS exclusions list in Cortex XDR.

Answer

Disable memory protection features globally in the agent settings profile.

Answer

Enable Agent Self-Protection to prevent local interference.

Question 10

An administrator is preparing to deploy Cortex XDR agents to 500 remote endpoints using a software deployment tool. Where can the administrator download the latest installation packages and transforms?

Accepted Answer

Navigate to Cortex XDR management console > Settings > Distributions.. Installation packages are generated and downloaded directly from the Cortex XDR management console under the Distributions page.

Answer

Run the 'cytool download-installer' command on an existing endpoint.

Answer

Access the Palo Alto Networks Customer Support Portal under Software Updates.

Answer

Log in to the Prisma Access management portal and select Endpoints.