Cybersecurity-Practitioner Endpoint Security — Timed 15 Questions

Question 1

A security analyst is investigating a suspicious process execution chain in the Cortex XDR Incident Viewer. The analyst wants to understand the exact sequence of child processes spawned by a malicious PowerShell script. Which Cortex XDR feature provides a graphical representation of the attack lifecycle and process relationships?

15 minute time limit — choose an answer to begin.

Accepted Answer

Causality Chain (BIOC view) in the Incident View. BIOC and Causality Analysis provide a visual causality chain showing process spawning trees and related artifacts.

Answer

Global Protect Network Topology graph

Answer

Advanced Endpoint Query builder

Answer

Threat Intelligence Cloud lookup tool

Question 2

An administrator wants to verify which Cortex XDR agent version is installed on a specific Windows endpoint using the command line. Which command should be executed?

Accepted Answer

cytool version query. The 'cytool' command-line utility provides administrative functions, including checking the exact version of the installed agent.

Answer

cytool agent-version

Answer

cytool operacional status

Answer

cytool info query

Question 3

A security engineer needs to investigate endpoint telemetry data for a suspicious fileless attack that executed PowerShell commands out of memory. Which Cortex XDR component provides deep forensic visibility into command-line arguments, registry modifications, and network connections without relying solely on traditional logs?

Accepted Answer

Cortex XDR Host Insights data collection and querying engine. Host Insights provides comprehensive endpoint telemetry and forensic data storage for deep hunting and investigation.

Answer

Cortex XDR Malware Prevention module

Answer

Local Analysis engine utilizing machine learning models

Answer

WildFire cloud-based static and dynamic analysis sandbox

Question 4

An administrator needs to check the status of the Exploit Prevention module on a Windows endpoint running Cortex XDR. Which command should be used?

Accepted Answer

cytool protection query. The cytool command-line utility includes specific subcommands to inspect module states, such as exploit prevention.

Answer

cytool anti-exploit query

Answer

cytool module-check --exploit

Answer

cytool exploit status

Question 5

An endpoint running the Cortex XDR Agent is experiencing aggressive behavior isolation triggered by a confirmed ransomware attack. The administrator successfully remediates the threat and verifies the endpoint is clean. How should the administrator restore network connectivity to the isolated endpoint from the Cortex XDR management console?

Accepted Answer

Navigate to Endpoint Management, select the endpoint, click Action, and select Remove Isolation.. To restore connectivity, the administrator must navigate to the Endpoint Management view, select the isolated endpoint, and issue the Remove Isolation action.

Answer

Disable the firewall profile associated with the endpoint group in Policy Management.

Answer

Delete the endpoint record from the Cortex XDR asset inventory and reinstall the agent.

Answer

Reboot the endpoint twice using the remote action menu to clear the isolation driver state.

Question 6

An administrator needs to run a live forensic artifact collection on a suspected compromised endpoint using Cortex XDR. Which capability allows the administrator to execute scripts and retrieve files directly from the endpoint in real time?

Accepted Answer

Cortex XDR Remote Response tool. Remote Response is the Cortex XDR feature that provides a secure interactive shell and script execution capability on managed endpoints.

Answer

Host Insights Response Actions

Answer

Agent Profile Distribution task

Answer

BIOC automated remediation playbooks

Question 7

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

Accepted Answer

Use the /INSTALLTOKEN= parameter followed by the unique registration token string.. The INSTALLTOKEN parameter is required during unattended or mass installations to associate the agent instance with the correct tenant in Cortex XDR.

Answer

Use the /REGKEY= parameter followed by the tenant activation password.

Answer

Use the /SERVER= parameter to define the cloud instance URL.

Answer

Use the /TENANTID= parameter followed by the fully qualified domain name.

Question 8

A security analyst notices that a benign internal software development tool is being incorrectly blocked by Cortex XDR Prevent as malware. What is the most granular method to whitelist this application while maintaining maximum security posture?

Accepted Answer

Create a Profile Exception in the Malware Profile using the SHA-256 hash of the executable.. Hashing the specific file or using a signed certificate exception provides targeted remediation without compromising endpoint security.

Answer

Add the file path as an exclusion in the OS-level Windows Defender settings.

Answer

Disable the local analysis module entirely for the affected endpoint group.

Answer

Change the agent profile operating mode from Prevention to Audit mode globally.

Question 9

An organization is configuring exploit prevention rules in Cortex XDR to protect legacy browser plugins. An application crashes repeatedly due to an overly aggressive protection profile. Which action should the administrator take to troubleshoot without completely disabling exploit protection?

Accepted Answer

Change the exploit protection behavior for the specific technique to 'Report' instead of 'Terminate'.. Putting the exploit protection module into Report (Audit) mode allows verification of potential blocks without disrupting user productivity.

Answer

Add the browser executable path to the OS exclusions list in Cortex XDR.

Answer

Disable memory protection features globally in the agent settings profile.

Answer

Enable Agent Self-Protection to prevent local interference.

Question 10

An administrator is preparing to deploy Cortex XDR agents to 500 remote endpoints using a software deployment tool. Where can the administrator download the latest installation packages and transforms?

Accepted Answer

Navigate to Cortex XDR management console > Settings > Distributions.. Installation packages are generated and downloaded directly from the Cortex XDR management console under the Distributions page.

Answer

Run the 'cytool download-installer' command on an existing endpoint.

Answer

Access the Palo Alto Networks Customer Support Portal under Software Updates.

Answer

Log in to the Prisma Access management portal and select Endpoints.

Question 11

An administrator needs to verify that the Cortex XDR agent services are running properly on a macOS endpoint. Which command-line utility should be used to check the agent status?

Accepted Answer

Run 'cytool query status' in the Terminal application.. The Cytool utility is the primary command-line tool for managing and troubleshooting Cortex XDR agents across platforms including macOS.

Answer

Run 'traps status' using administrative privileges.

Answer

Run 'launchctl list | grep paloalto' to check daemon health.

Answer

Run 'pan-xdr-cli check' in the system console.

Question 12

An enterprise security team discovers that a custom line-of-business application is triggering a Behavioral Threat Protection (BTP) alert in Cortex XDR. The behavior involves unusual process injection techniques that are legitimate for this application. How can the administrator suppress this specific alert without disabling BTP for other applications?

Accepted Answer

Create a Behavioral Threat Protection exception specifying the application hash and the triggered rule ID.. Creating an exception based on the BIOC rule ID or signature hash prevents specific false positives while keeping behavioral monitoring active.

Answer

Lower the threat severity threshold for Behavioral Threat Protection in the agent profile.

Answer

Set the Cortex XDR Agent to troubleshooting mode for the affected subnet.

Answer

Add the application directory to the system-wide exclusion list in the Malware Profile.

Question 13

An organization requires that Cortex XDR agents verify their connection to the Cortex XDR server through a corporate HTTP proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

Configured directly in the Agent Settings profile within the Cortex XDR console.. Proxy settings for the agent are typically defined within the installation parameters or agent settings profile within the console.

Answer

Configured via the Windows Registry under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\Proxy.

Answer

Configured through the local Windows Internet Options control panel.

Answer

Managed automatically via DNS SRV records without console configuration.

Question 14

An administrator observes that several Cortex XDR agents are showing a 'Disconnected' status in the management console. After verifying network connectivity, the administrator suspects that communication is blocked by an intermediate firewall. Which TCP port must be open outbound from the endpoints to the Cortex XDR server?

Accepted Answer

TCP port 443 exclusively. Cortex XDR agents communicate outbound to the cloud tenant primarily over TCP port 443.

Answer

TCP port 22 and TCP port 23 for remote management

Answer

TCP port 389 and TCP port 636 for directory sync

Answer

TCP port 80 and TCP port 443

Question 15

An organization deploys Cortex XDR disk encryption management. An endpoint fails to escrow its BitLocker recovery key to the Cortex XDR console. What is the most effective troubleshooting step to verify escrow status using the agent command-line tool?

Accepted Answer

Run 'cytool encryption status' to check BitLocker integration and key escrow status.. The cytool command-line interface provides specific commands to query disk encryption and key escrow status.

Answer

Run 'manage-bde -status' from an elevated command prompt.

Answer

Review the Windows Application event log for BitLocker Group Policy errors.

Answer

Run 'cytool set-token' to re-register the encryption keys.