XDR-Engineer Cortex XDR Agent Configuration Practice Test 5 — 15 Questions

Question 1

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The agent's heartbeat interval and the management console's fully qualified domain name (FQDN) or IP address.. The agent requires the correct management console FQDN or IP address and a heartbeat interval to establish and maintain communication. Firewalls must permit outbound traffic to that address on the necessary ports. Other settings like cache size, update schedule, and SIEM integration do not determine whether the agent can reach the console through a firewall.

Answer

The agent's malware signature update schedule.

Answer

The agent's local cache size for storing alerts during network outages.

Answer

The agent's integration with third-party SIEM solutions.

Question 2

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

Accepted Answer

Check the agent's local log files for errors related to the malware prevention module.. The most effective next step is to examine the agent's local logs for errors related to the malware prevention module. Logs can reveal signature update failures, licensing problems, or conflicts that explain why enforcement is not occurring. Reinstalling, checking Defender, or toggling the module are either disruptive or not directly diagnostic.

Answer

Verify that the endpoint has the latest Windows Defender definitions.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Answer

Disable and re-enable the malware prevention module in the profile.

Question 3

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Accepted Answer

Configure an Indicators of Compromise (IOC) policy with a hash indicator and set the action to Block.. Cortex XDR provides the Indicators of Compromise (IOC) feature to block or report on specific artifacts such as file hashes. By creating an IOC policy with the SHA-256 hash and setting the action to Block, the administrator can immediately prevent the executable from running on all targeted endpoints. This method is precise and does not rely on signature updates or heuristic detection.

Answer

Create a Malware profile with a custom blocklist that includes the SHA-256 hash.

Answer

Use the Exploit Protection profile to add the executable to the list of blocked processes.

Answer

Add the SHA-256 hash to the Blocklist in the Cortex XDR management console under Endpoints > Blocklist.

Question 4

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

Accepted Answer

Grant the Cortex XDR agent Full Disk Access in macOS System Preferences.. On macOS, the Cortex XDR agent requires Full Disk Access to scan protected locations. This permission is granted in System Preferences or via MDM. Disabling SIP, changing enforcement mode, or using kernel extensions do not address the privacy protection requirement and may introduce other issues.

Answer

Disable System Integrity Protection (SIP) on the macOS endpoint.

Answer

Configure the agent to run in 'Report Only' mode for macOS.

Answer

Install the agent using a kernel extension (kext) instead of a system extension.

Question 5

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

Accepted Answer

Enable 'Agent Tamper Protection' in the agent settings profile.. Agent Tamper Protection is the specific setting designed to prevent users from disabling or tampering with the Cortex XDR agent. It enforces restrictions that block attempts to stop the agent service, modify its files, or uninstall it without proper authorization. Other options either limit UI access, protect only against uninstallation, or serve a different purpose entirely.

Answer

Configure 'Agent Uninstall Password' in the agent settings profile.

Answer

Enable 'Endpoint Isolation' for the endpoint group.

Answer

Set 'User Interface Access' to 'Read Only' in the agent settings profile.

Question 6

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

Accepted Answer

Increase the scan interval for scheduled malware scans.. Increasing the scheduled scan interval and excluding non-critical directories from real-time scanning both reduce agent resource consumption while preserving essential protections. Disabling Behavioral Threat Protection or setting Report Only mode would weaken security, and reducing the heartbeat interval would increase network overhead.

Answer

Disable the Behavioral Threat Protection module.

Answer

Set the agent to 'Report Only' mode for all modules.

Answer

Reduce the heartbeat interval to 5 minutes.

Question 7

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Accepted Answer

A .mobileconfig file containing the agent settings.. For macOS endpoints, Cortex XDR agent settings are delivered via a .mobileconfig file, which is the standard configuration profile format for Apple devices. This file can be generated from the Cortex XDR management console and deployed through MDM. Other file formats like .plist, .json, or .xml are not directly supported for this purpose.

Answer

A .plist file containing the agent settings.

Answer

A .json file containing the agent settings.

Answer

A .xml file containing the agent settings.

Question 8

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

Accepted Answer

Configure a Digital Signature allowlist entry for the trusted vendor's certificate.. Cortex XDR allows administrators to create allowlist entries based on digital signatures. By adding the trusted vendor's certificate to the allowlist, any executable signed by that certificate is permitted to run, bypassing behavioral blocks. This method is secure, scalable, and ensures that legitimate software from trusted vendors is not inadvertently blocked.

Answer

Create an Allowlist entry based on the file's SHA-256 hash.

Answer

Add the executable to the Behavioral Threat protection exception list.

Answer

Disable the Behavioral Threat protection module for the endpoint group.

Question 9

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

Accepted Answer

The Cortex XDR agent's certificate and registration status with the console.. When an agent is disconnected but network connectivity is confirmed, the next logical step is to verify the agent's certificate and registration status. Cortex XDR agents use certificates for secure communication with the console; an expired or revoked certificate, or a registration issue, will prevent the agent from connecting. Checking this component is essential for resolving the disconnection.

Answer

The Cortex XDR agent's local database for corruption.

Answer

The Cortex XDR management console's license status.

Answer

The Windows Firewall rules on the endpoint.

Question 10

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

Accepted Answer

Verify that the endpoint group is correctly associated with the policy and that the agents are connected.. The most common reason for endpoints not receiving a policy is that the policy is not correctly assigned to their endpoint group, or the agents are not connected to the console. The administrator should first verify the assignment and agent connectivity. Once these are confirmed, the policy will be delivered. Other steps are less likely to resolve the issue.

Answer

Restart the Cortex XDR management console service.

Answer

Check that the macOS endpoints have the latest agent version installed.

Answer

Ensure that the policy is set as the default policy for the tenant.

Question 11

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

Accepted Answer

Enable Live Terminal. Live Terminal is an agent-side capability that must be permitted before the console can open an interactive session on an endpoint. When the requirement is that the capability be preconfigured at install time, the installation package wizard exposes a dedicated toggle for it. Enabling that toggle during package creation ensures every endpoint receiving the package can be administered through live terminal without a later policy edit.

Answer

Enable Behavioral Threat Protection

Answer

Enable Content Update

Answer

Enable Device Control

Question 12

An administrator manages a Cortex XDR deployment where endpoints connect to the Cortex XDR server through an internal proxy. The security team requires that all agent-to-server communication use the proxy, but also wants the agent to bypass the proxy when reaching internal Cortex XDR appliances on the local network. Which configuration in the agent installation package achieves this?

Accepted Answer

Configure the proxy address and port, then add the internal Cortex XDR appliance addresses to the proxy bypass list.. Meeting both conditions requires two distinct settings in the package: the proxy server the agent should use for general server communication, and an explicit bypass list naming the internal Cortex XDR appliances that must be reached directly. Specifying only the proxy leaves local appliance traffic proxied, while system proxy or PAC options do not give the granular per-address exemption the team needs.

Answer

Configure the proxy address and port only, and rely on the agent to automatically detect local appliance addresses.

Answer

Configure the proxy address and port, and enable the Use system proxy settings option.

Answer

Configure the proxy address and port, and set the agent to use a PAC file hosted on the internal network.

Question 13

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

Accepted Answer

Enable agent tamper protection in the Agent Settings profile so users cannot stop or uninstall the agent without a valid uninstall password.. Tamper protection is the Cortex XDR mechanism designed specifically to stop unauthorized users and processes from terminating or removing the agent while preserving an administrative override via the uninstall password. Report-only mode, Malware profiles, and Data Collection profiles address detection, prevention policy, and telemetry respectively, none of which prevent a local user from disabling the agent service.

Answer

Configure a Data Collection profile to capture agent stop events and alert the SOC when the agent is terminated.

Answer

Assign the endpoints to a stricter Malware profile that disables the local agent UI entirely.

Answer

Set the agent to run in report-only mode via the Agent Settings profile so users cannot alter prevention modules.

Question 14

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

Accepted Answer

Enable automatic agent upgrade in the Agent Settings profile so the agent checks for and installs approved versions.. Automatic agent upgrade is the dedicated setting that allows Cortex XDR agents to detect and install approved newer agent versions on their own. Scan schedules, Malware profiles, and content updates affect scanning behavior, prevention actions, and detection content respectively, and none of them replace the agent binary with a newer version.

Answer

Enable content update downloads only, since agent binary updates are bundled with content releases.

Answer

Set the Malware profile to block unknown executables, which forces the agent to update its engine.

Answer

Configure the agent to run a scheduled full scan every 24 hours, which also triggers a version check.

Question 15

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

Accepted Answer

The agent's registration token or server address embedded in the installation package is incorrect for the target tenant.. An agent that runs but never appears in the console most often has a registration problem, typically an incorrect server address or registration token embedded during installation, which prevents authentication to the intended tenant. Malware profile actions, Data Collection scope, and scan schedules all affect post-registration behavior and cannot by themselves keep a healthy endpoint from registering.

Answer

The endpoint's Data Collection profile is set to collect only critical events.

Answer

The agent's scan schedule is set to run weekly instead of daily.

Answer

The endpoint's assigned Malware profile has prevention modules set to block instead of report.