XSIAM-Analyst Endpoint Security Management — 10 Questions

Question 1

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 2

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. In XSIAM, the Endpoint Security > Dashboards section provides pre-built summary dashboards that include agent version distribution and deployment health across the organization. This is the intended location for analysts to quickly assess which endpoints have out-of-date Cortex XDR agent versions. The dashboards aggregate data from all managed endpoints and present it in a visual, filterable format.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 3

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Accepted Answer

Endpoint Security > Assets > Agent Details. The Endpoint Security > Assets > Agent Details view in XSIAM shows the operational status of the Cortex XDR agent, including its connected broker/gateway, last heartbeat time, and applied security profiles. This is the first place to check when telemetry is delayed or profiles aren't applying, because it directly surfaces connectivity and configuration state.

Answer

Incident Viewer > Alerts timeline

Answer

Query Library using dataset xdr_data

Answer

Settings > Agent Settings > Global Status

Question 4

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Isolate. Network isolation for an individual asset in XSIAM is performed from the Endpoint Security > Assets page. After selecting the specific asset, the Action menu provides the Isolate option, which immediately isolates the endpoint from the network. This is the direct, asset-centric workflow for containment.

Answer

Data Collection > Configurations > Network Isolation

Answer

Response > Playbooks > Manual Triggers > Isolate

Answer

Settings > Agent Settings > Containment Rules

Question 5

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Accepted Answer

Endpoint Security > Assets > Installers. The latest signed Cortex XDR agent installer package and transform file for Group Policy deployment are available under Endpoint Security > Assets > Installers in the XSIAM management console. This section provides the MSI and MST files needed for GPO-based deployment.

Answer

Data Collection > Sources > Agents

Answer

Settings > Configurations > Agents > Installers

Answer

Response > Content > Packages

Question 6

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Accepted Answer

Endpoint Security > Settings > Agent Settings > Heartbeat interval. Agent connectivity settings and offline alerting thresholds are managed within Agent Settings or specific Alert Rules in XSIAM.

Answer

Data Collection > Broker VM > Polling parameters

Answer

Settings > Integrations > Cortex XDR Agent > Sync Timer

Answer

Incidents > Automation > Heartbeat Playbook

Question 7

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Lift Isolation. To lift network isolation in XSIAM, the analyst navigates to Endpoint Security > Assets, selects the specific asset, and chooses Action > Lift Isolation. This restores network connectivity for the host after containment. The action is performed directly on the asset record, ensuring the correct endpoint is targeted.

Answer

Settings > Network > Firewall > Unblock Host

Answer

Response > Playbooks > Restart Agent

Answer

Data Collection > Endpoints > Reconnect

Question 8

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Accepted Answer

Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. The agent uninstallation/tamper protection password in XSIAM is configured under Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. This setting allows administrators to set a password that prevents unauthorized users or malware from stopping the agent service or modifying its configuration locally. It is a critical security control for endpoint agents.

Answer

Data Collection > Agent Deployment > Security Passwords

Answer

Settings > Access Management > Endpoint Users

Answer

Response > Containment > Agent Passwords

Question 9

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Accepted Answer

Configuring multiple gateway addresses within agent deployment settings for failover.. Option A is correct because XSIAM agents support configuring multiple gateway addresses in the agent deployment settings, allowing endpoints to fail over to an alternate gateway if the primary is unreachable, which maintains reporting continuity and distributes load across gateways. Option E is correct because Broker VMs are deployed locally within network segments to act as event collectors and agent proxies, so agents report to a nearby broker instead of crossing segment boundaries to the main XSIAM tenant, improving availability and load distribution. Options B, C, and D are incorrect: spanning tree protocol is a Layer 2 loop-prevention mechanism unrelated to XSIAM agent reporting; replacing agents with manual syslog over UDP 514 removes the agent architecture and provides no high availability or load distribution; and turning Windows workstations into cluster node controllers is not a supported XSIAM design and would not serve as an agent reporting tier.

Answer

Enabling spanning tree protocol across all endpoint network interface cards.

Answer

Replacing all endpoint agents with manual syslog forwarding rules via UDP port 514.

Answer

Converting every Windows workstation into an active cluster node controller.

Question 10

An administrator is configuring the automatic uninstallation protection and security settings for the Cortex XDR agent. Which THREE protection features can be enforced via the Agent Settings profile to secure the agent against tampering? (Choose three)

Accepted Answer

Prevent local termination or stopping of the Cortex XDR background services.. The Agent Settings profile in Cortex XDR includes a dedicated "Agent Tampering Protection" or uninstall-protection section that enforces exactly these three controls. Option A is correct because the profile can enable protection of the Cortex XDR background services (e.g., the Cytool and agent services) so that local users cannot stop or terminate them via Task Manager, net stop, or sc stop. Option B is correct because the profile can require an uninstall password (or authorization token) before the agent can be removed, preventing unauthorized uninstallation. Option C is correct because the same tampering protection hardens the agent's installation directory, registry keys, and driver binaries against modification or deletion by non-authorized processes. Option D is not part of agent tampering protection; disk wiping on failed logins is a full-disk encryption/endpoint policy feature, not an Agent Settings option. Option E is also unrelated, as resetting a BIOS password on service restart is not a Cortex XDR agent setting and is not a supported enforcement mechanism.

Answer

Automatically wipe the endpoint hard drive upon three failed login attempts.

Answer

Force a BIOS password reset whenever the agent service restarts.