Endpoint Security Management

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

A Cortex XDR agent on a Linux server is repeatedly triggering behavioral threat protection alerts for a legitimate backup script that spawns shell commands and reads many files. The administrator wants to suppress these false positives without weakening protection against actual malicious behavior. Which action is most appropriate?

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

An analyst is reviewing the endpoint security status in XSIAM and notices that a Linux server has the Cortex XDR agent installed but is reporting a 'Disconnected' status. The server is critical and runs a custom application that requires specific kernel modules. The analyst suspects that the agent is not functioning correctly due to a compatibility issue. Which of the following is the most appropriate first step to troubleshoot this issue?

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

An analyst notices that a Cortex XDR agent on a macOS endpoint is repeatedly disconnecting from the XSIAM tenant. The endpoint is behind a proxy that requires authentication. Which configuration should the analyst verify on the agent to ensure it can authenticate to the proxy and maintain connectivity?

An administrator is configuring a new Cortex XDR agent installation on a group of macOS endpoints managed through Cortex XSIAM. The administrator needs to ensure the agent has the required macOS permissions to monitor and block malicious activity. Which TWO actions must be performed? (Choose two.)

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent installed successfully but the endpoint never appears in the XSIAM Endpoints inventory. The endpoint has internet access. Which two conditions should the administrator verify to resolve the missing registration? (Choose two.)

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent fails to start after a system update. The administrator needs to collect diagnostic information to determine the cause. Which two actions can be performed from the XSIAM management console to assist with this troubleshooting? (Choose two.)

An administrator is preparing to upgrade the Cortex XDR agent across a large fleet and wants the ability to revert endpoints to the previous agent version if the new build causes stability problems. Which capability should the administrator rely on in XSIAM?

A security analyst receives an alert that a Cortex XDR agent on a Windows server has not checked in with Cortex XSIAM for over 24 hours. The analyst wants to confirm whether the endpoint is still registered and view its last known status. Where in the XSIAM console should the analyst look?

An analyst notices that a specific Windows server's Cortex XDR agent is consuming unusually high CPU and the endpoint occasionally stops sending telemetry. The analyst suspects a scanning-related performance issue caused by the agent monitoring a large, rapidly changing data directory. Which action should the analyst take to reduce agent overhead while retaining threat detection elsewhere on the server?

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

An analyst is investigating a Windows endpoint that was recently compromised. The attacker used a legitimate signed driver to disable the Cortex XDR agent's kernel-mode protection. The analyst wants to prevent this technique from succeeding on other endpoints without blocking the legitimate business application that relies on the driver. Which XSIAM endpoint security capability should the analyst configure?

A security team is using XSIAM to manage endpoint security across a mixed fleet of Windows and macOS devices. They need to ensure that the Cortex XDR agent enforces malware prevention and that endpoints can be isolated from the network if a threat is detected. Which two actions should the administrator take to meet these requirements? (Choose two.)