XSIAM-Analyst Endpoint Security Management — 10 Questions

Question 1

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. Exclusions and scan settings within the Malware Profile allow tuning of paths, processes, and scan frequencies to alleviate resource bottlenecks on specialized systems.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 2

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Accepted Answer

Inspect the local agent log files on the endpoint to identify communication or buffering errors with the XSIAM backend.. Reviewing local agent log files (such as cyserver.log) on the endpoint or checking broker VM communication logs helps determine if telemetry is blocked or failing to upload.

Answer

Modify the XQL ingestion parser rules for the endpoint asset dataset.

Answer

Purge all historical alerts from the Incident Viewer to free up ingestion buffers.

Answer

Run an immediate software upgrade of the XSIAM tenant license key.

Question 3

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 4

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. Endpoint Security > Dashboards or Assets provides overview widgets displaying agent version distribution and compliance status.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 5

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Accepted Answer

Endpoint Security > Assets > Agent Details. The Agent Details view within Endpoint Security > Assets provides deep visibility into the specific endpoint's operational status, connection health, and applied profiles.

Answer

Incident Viewer > Alerts timeline

Answer

Query Library using dataset xdr_data

Answer

Settings > Agent Settings > Global Status

Question 6

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Isolate. Network Isolation can be triggered directly from the Asset Details view or Incident response actions in XSIAM.

Answer

Data Collection > Configurations > Network Isolation

Answer

Response > Playbooks > Manual Triggers > Isolate

Answer

Settings > Agent Settings > Containment Rules

Question 7

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Accepted Answer

The endpoints have not yet completed their polling interval to download the updated profile configuration from the XSIAM cloud.. Cortex XDR agents check in periodically based on the heartbeat interval, or configurations require an explicit agent sync/update cycle to take effect immediately.

Answer

The agent must be manually uninstalled and reinstalled with the new profile embedded in the installer.

Answer

Profile changes are only applied during scheduled OS maintenance windows configured in XSIAM.

Answer

POS terminals are locked by XSIAM and cannot accept policy changes without an enterprise root token override.

Question 8

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Accepted Answer

Endpoint Security > Assets > Installers. Agent installers are located under Endpoint Security > Assets > Installers in the XSIAM console, where administrators can select the appropriate operating system and package type.

Answer

Data Collection > Sources > Agents

Answer

Settings > Configurations > Agents > Installers

Answer

Response > Content > Packages

Question 9

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Accepted Answer

Endpoint Security > Settings > Agent Settings > Heartbeat interval. Agent connectivity settings and offline alerting thresholds are managed within Agent Settings or specific Alert Rules in XSIAM.

Answer

Data Collection > Broker VM > Polling parameters

Answer

Settings > Integrations > Cortex XDR Agent > Sync Timer

Answer

Incidents > Automation > Heartbeat Playbook

Question 10

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Accepted Answer

Endpoint Security > Assets filtered by Operating System columns. Endpoint Security asset inventory and filtering capabilities allow sorting and grouping by operating system attributes.

Answer

Response > Asset Discovery Reports

Answer

Data Lake > Parsing Rules > OS Summary

Answer

Settings > Endpoint Management > OS Matrix