XSIAM-Analyst Endpoint Security Management — All Questions With Answers

Question 1mediummultiple choice

Read the full Endpoint Security Management explanation →

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Question 2easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Question 3mediummultiple choice

Read the full network assurance explanation →

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Question 4easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Question 5easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Question 6hardmultiple choice

Read the full Endpoint Security Management explanation →

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Question 7mediummultiple choice

Read the full Endpoint Security Management explanation →

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Question 8mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Question 9mediummulti select

Read the full Endpoint Security Management explanation →

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Question 10hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring the automatic uninstallation protection and security settings for the Cortex XDR agent. Which THREE protection features can be enforced via the Agent Settings profile to secure the agent against tampering? (Choose three)

Question 11hardmulti select

Read the full Endpoint Security Management explanation →

An analyst is reviewing the endpoint security posture in XSIAM and notices several Windows endpoints showing a status of 'Protection Disabled'. The analyst needs to determine which TWO conditions could cause the Cortex XDR agent to enter this state without generating a malware alert. (Choose two.)

Question 12mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a Windows endpoint is showing in XSIAM with a status of 'Unprotected' and the Cortex XDR agent service is not running. The analyst wants to remotely start the agent service and collect a support file without interrupting the user session. Which action in the XSIAM endpoint management console should the analyst perform first?

Question 13hardmultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring the Cortex XDR agent's malware protection settings for a group of Linux servers. The administrator wants to ensure that when a malicious file is detected, the agent quarantines the file and also logs the original file path and hash for forensic analysis. Which agent configuration option should the administrator enable to meet these requirements?

Question 14hardmultiple choice

Read the full network assurance explanation →

An analyst is reviewing a Cortex XSIAM endpoint where the Cortex XDR agent has stopped reporting telemetry. The endpoint still shows as connected in the console, but no new events have arrived for several hours. The analyst suspects the agent is in a state that suppresses event forwarding while still maintaining its heartbeat. Which agent state should the analyst investigate first?

Question 15mediummultiple choice

Read the full Endpoint Security Management explanation →

A Cortex XDR agent on a Windows server is installed with the content update policy set to 'Scheduled'. The administrator notices that new behavioral threat signatures are not being applied even though the agent is online and the schedule is configured to run nightly. Which action should the administrator take to ensure content updates are applied when the agent checks in, without reinstalling the agent?

Question 16mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a suspicious process on a Windows endpoint. The analyst wants to view the process tree, command-line arguments, and loaded modules for a specific process directly from the XSIAM console without logging into the endpoint. Which XSIAM feature should the analyst use?

Question 17mediummultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring endpoint security policies in XSIAM. The administrator wants to ensure that when a malware incident is detected on an endpoint, the Cortex XDR agent automatically isolates the endpoint from the network except for communication with the XSIAM management server. Which policy action should the administrator configure to achieve this?

Question 18mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is reviewing the endpoint security management capabilities in XSIAM. The administrator needs to perform a bulk action on multiple endpoints to apply a new security policy and then verify the policy application status. Which TWO actions can be performed directly from the Endpoints page in the XSIAM console? (Choose two.)

Question 19hardmultiple choice

Read the full Endpoint Security Management explanation →

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Question 20hardmultiple choice

Read the full network assurance explanation →

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Question 21mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Question 22easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Question 23mediummultiple choice

Read the full Endpoint Security Management explanation →

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

Question 24mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Question 25easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Question 26easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

Question 27hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Question 28hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Question 29hardmultiple choice

Read the full Endpoint Security Management explanation →

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Question 30mediummultiple choice

Read the full network assurance explanation →

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Question 31hardmultiple choice

Read the full Endpoint Security Management explanation →

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Question 32easymultiple choice

Read the full network assurance explanation →

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Question 33mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Question 34hardmulti select

Read the full Endpoint Security Management explanation →

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Question 35mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Question 36easymulti select

Read the full Endpoint Security Management explanation →

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

Question 37mediummulti select

Read the full Endpoint Security Management explanation →

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

Question 38hardmulti select

Read the full Endpoint Security Management explanation →

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Question 39hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Question 40easymulti select

Read the full Endpoint Security Management explanation →

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Question 41mediummulti select

Read the full Endpoint Security Management explanation →

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

Question 42easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Question 43mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

Question 44mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

Question 45mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

Question 46easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

Question 47hardmulti select

Read the full Endpoint Security Management explanation →

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

Question 48mediummultiple choice

Read the full Endpoint Security Management explanation →

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

Question 49easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

Question 50easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

Question 51mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

Question 52mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

Question 53mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

Question 54hardmultiple choice

Read the full Endpoint Security Management explanation →

A Cortex XDR agent on a Linux server is repeatedly triggering behavioral threat protection alerts for a legitimate backup script that spawns shell commands and reads many files. The administrator wants to suppress these false positives without weakening protection against actual malicious behavior. Which action is most appropriate?

Question 55easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

Question 56easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

Question 57mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

Question 58mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

Question 59hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing the endpoint security status in XSIAM and notices that a Linux server has the Cortex XDR agent installed but is reporting a 'Disconnected' status. The server is critical and runs a custom application that requires specific kernel modules. The analyst suspects that the agent is not functioning correctly due to a compatibility issue. Which of the following is the most appropriate first step to troubleshoot this issue?

Question 60mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Question 61hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

Question 62hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

Question 63easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

Question 64easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a Cortex XDR agent on a macOS endpoint is repeatedly disconnecting from the XSIAM tenant. The endpoint is behind a proxy that requires authentication. Which configuration should the analyst verify on the agent to ensure it can authenticate to the proxy and maintain connectivity?

Question 65mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring a new Cortex XDR agent installation on a group of macOS endpoints managed through Cortex XSIAM. The administrator needs to ensure the agent has the required macOS permissions to monitor and block malicious activity. Which TWO actions must be performed? (Choose two.)

Question 66hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent installed successfully but the endpoint never appears in the XSIAM Endpoints inventory. The endpoint has internet access. Which two conditions should the administrator verify to resolve the missing registration? (Choose two.)

Question 67hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent fails to start after a system update. The administrator needs to collect diagnostic information to determine the cause. Which two actions can be performed from the XSIAM management console to assist with this troubleshooting? (Choose two.)

Question 68mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to upgrade the Cortex XDR agent across a large fleet and wants the ability to revert endpoints to the previous agent version if the new build causes stability problems. Which capability should the administrator rely on in XSIAM?

Question 69easymultiple choice

Read the full Endpoint Security Management explanation →

A security analyst receives an alert that a Cortex XDR agent on a Windows server has not checked in with Cortex XSIAM for over 24 hours. The analyst wants to confirm whether the endpoint is still registered and view its last known status. Where in the XSIAM console should the analyst look?

Question 70hardmultiple choice

Read the full network assurance explanation →

An analyst notices that a specific Windows server's Cortex XDR agent is consuming unusually high CPU and the endpoint occasionally stops sending telemetry. The analyst suspects a scanning-related performance issue caused by the agent monitoring a large, rapidly changing data directory. Which action should the analyst take to reduce agent overhead while retaining threat detection elsewhere on the server?

Question 71hardmultiple choice

Read the full Endpoint Security Management explanation →

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

Question 72mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Windows endpoint that was recently compromised. The attacker used a legitimate signed driver to disable the Cortex XDR agent's kernel-mode protection. The analyst wants to prevent this technique from succeeding on other endpoints without blocking the legitimate business application that relies on the driver. Which XSIAM endpoint security capability should the analyst configure?

Question 73hardmulti select

Read the full Endpoint Security Management explanation →

A security team is using XSIAM to manage endpoint security across a mixed fleet of Windows and macOS devices. They need to ensure that the Cortex XDR agent enforces malware prevention and that endpoints can be isolated from the network if a threat is detected. Which two actions should the administrator take to meet these requirements? (Choose two.)

Question 1mediummultiple choice

Read the full Endpoint Security Management explanation →

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Question 2easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Question 3mediummultiple choice

Read the full network assurance explanation →

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Question 4easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Question 5easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Question 6hardmultiple choice

Read the full Endpoint Security Management explanation →

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Question 7mediummultiple choice

Read the full Endpoint Security Management explanation →

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Question 8mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Question 9mediummulti select

Read the full Endpoint Security Management explanation →

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Question 10hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring the automatic uninstallation protection and security settings for the Cortex XDR agent. Which THREE protection features can be enforced via the Agent Settings profile to secure the agent against tampering? (Choose three)

Question 11hardmulti select

Read the full Endpoint Security Management explanation →

An analyst is reviewing the endpoint security posture in XSIAM and notices several Windows endpoints showing a status of 'Protection Disabled'. The analyst needs to determine which TWO conditions could cause the Cortex XDR agent to enter this state without generating a malware alert. (Choose two.)

Question 12mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a Windows endpoint is showing in XSIAM with a status of 'Unprotected' and the Cortex XDR agent service is not running. The analyst wants to remotely start the agent service and collect a support file without interrupting the user session. Which action in the XSIAM endpoint management console should the analyst perform first?

Question 13hardmultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring the Cortex XDR agent's malware protection settings for a group of Linux servers. The administrator wants to ensure that when a malicious file is detected, the agent quarantines the file and also logs the original file path and hash for forensic analysis. Which agent configuration option should the administrator enable to meet these requirements?

Question 14hardmultiple choice

Read the full network assurance explanation →

An analyst is reviewing a Cortex XSIAM endpoint where the Cortex XDR agent has stopped reporting telemetry. The endpoint still shows as connected in the console, but no new events have arrived for several hours. The analyst suspects the agent is in a state that suppresses event forwarding while still maintaining its heartbeat. Which agent state should the analyst investigate first?

Question 15mediummultiple choice

Read the full Endpoint Security Management explanation →

A Cortex XDR agent on a Windows server is installed with the content update policy set to 'Scheduled'. The administrator notices that new behavioral threat signatures are not being applied even though the agent is online and the schedule is configured to run nightly. Which action should the administrator take to ensure content updates are applied when the agent checks in, without reinstalling the agent?

Question 16mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a suspicious process on a Windows endpoint. The analyst wants to view the process tree, command-line arguments, and loaded modules for a specific process directly from the XSIAM console without logging into the endpoint. Which XSIAM feature should the analyst use?

Question 17mediummultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring endpoint security policies in XSIAM. The administrator wants to ensure that when a malware incident is detected on an endpoint, the Cortex XDR agent automatically isolates the endpoint from the network except for communication with the XSIAM management server. Which policy action should the administrator configure to achieve this?

Question 18mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is reviewing the endpoint security management capabilities in XSIAM. The administrator needs to perform a bulk action on multiple endpoints to apply a new security policy and then verify the policy application status. Which TWO actions can be performed directly from the Endpoints page in the XSIAM console? (Choose two.)

Question 19hardmultiple choice

Read the full Endpoint Security Management explanation →

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Question 20hardmultiple choice

Read the full network assurance explanation →

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Question 21mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Question 22easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Question 23mediummultiple choice

Read the full Endpoint Security Management explanation →

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

Question 24mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Question 25easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Question 26easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

Question 27hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Question 28hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Question 29hardmultiple choice

Read the full Endpoint Security Management explanation →

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Question 30mediummultiple choice

Read the full network assurance explanation →

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Question 31hardmultiple choice

Read the full Endpoint Security Management explanation →

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Question 32easymultiple choice

Read the full network assurance explanation →

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Question 33mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Question 34hardmulti select

Read the full Endpoint Security Management explanation →

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Question 35mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Question 36easymulti select

Read the full Endpoint Security Management explanation →

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

Question 37mediummulti select

Read the full Endpoint Security Management explanation →

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

Question 38hardmulti select

Read the full Endpoint Security Management explanation →

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Question 39hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Question 40easymulti select

Read the full Endpoint Security Management explanation →

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Question 41mediummulti select

Read the full Endpoint Security Management explanation →

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

Question 42easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Question 43mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

Question 44mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

Question 45mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

Question 46easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

Question 47hardmulti select

Read the full Endpoint Security Management explanation →

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

Question 48mediummultiple choice

Read the full Endpoint Security Management explanation →

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

Question 49easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

Question 50easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

Question 51mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

Question 52mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

Question 53mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

Question 54hardmultiple choice

Read the full Endpoint Security Management explanation →

A Cortex XDR agent on a Linux server is repeatedly triggering behavioral threat protection alerts for a legitimate backup script that spawns shell commands and reads many files. The administrator wants to suppress these false positives without weakening protection against actual malicious behavior. Which action is most appropriate?

Question 55easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

Question 56easymultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

Question 57mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

Question 58mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

Question 59hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing the endpoint security status in XSIAM and notices that a Linux server has the Cortex XDR agent installed but is reporting a 'Disconnected' status. The server is critical and runs a custom application that requires specific kernel modules. The analyst suspects that the agent is not functioning correctly due to a compatibility issue. Which of the following is the most appropriate first step to troubleshoot this issue?

Question 60mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Question 61hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

Question 62hardmultiple choice

Read the full Endpoint Security Management explanation →

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

Question 63easymultiple choice

Read the full Endpoint Security Management explanation →

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

Question 64easymultiple choice

Read the full Endpoint Security Management explanation →

An analyst notices that a Cortex XDR agent on a macOS endpoint is repeatedly disconnecting from the XSIAM tenant. The endpoint is behind a proxy that requires authentication. Which configuration should the analyst verify on the agent to ensure it can authenticate to the proxy and maintain connectivity?

Question 65mediummulti select

Read the full Endpoint Security Management explanation →

An administrator is configuring a new Cortex XDR agent installation on a group of macOS endpoints managed through Cortex XSIAM. The administrator needs to ensure the agent has the required macOS permissions to monitor and block malicious activity. Which TWO actions must be performed? (Choose two.)

Question 66hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent installed successfully but the endpoint never appears in the XSIAM Endpoints inventory. The endpoint has internet access. Which two conditions should the administrator verify to resolve the missing registration? (Choose two.)

Question 67hardmulti select

Read the full Endpoint Security Management explanation →

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent fails to start after a system update. The administrator needs to collect diagnostic information to determine the cause. Which two actions can be performed from the XSIAM management console to assist with this troubleshooting? (Choose two.)

Question 68mediummultiple choice

Read the full Endpoint Security Management explanation →

An administrator is preparing to upgrade the Cortex XDR agent across a large fleet and wants the ability to revert endpoints to the previous agent version if the new build causes stability problems. Which capability should the administrator rely on in XSIAM?

Question 69easymultiple choice

Read the full Endpoint Security Management explanation →

A security analyst receives an alert that a Cortex XDR agent on a Windows server has not checked in with Cortex XSIAM for over 24 hours. The analyst wants to confirm whether the endpoint is still registered and view its last known status. Where in the XSIAM console should the analyst look?

Question 70hardmultiple choice

Read the full network assurance explanation →

An analyst notices that a specific Windows server's Cortex XDR agent is consuming unusually high CPU and the endpoint occasionally stops sending telemetry. The analyst suspects a scanning-related performance issue caused by the agent monitoring a large, rapidly changing data directory. Which action should the analyst take to reduce agent overhead while retaining threat detection elsewhere on the server?

Question 71hardmultiple choice

Read the full Endpoint Security Management explanation →

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

Question 72mediummultiple choice

Read the full Endpoint Security Management explanation →

An analyst is investigating a Windows endpoint that was recently compromised. The attacker used a legitimate signed driver to disable the Cortex XDR agent's kernel-mode protection. The analyst wants to prevent this technique from succeeding on other endpoints without blocking the legitimate business application that relies on the driver. Which XSIAM endpoint security capability should the analyst configure?

Question 73hardmulti select

Read the full Endpoint Security Management explanation →

A security team is using XSIAM to manage endpoint security across a mixed fleet of Windows and macOS devices. They need to ensure that the Cortex XDR agent enforces malware prevention and that endpoints can be isolated from the network if a threat is detected. Which two actions should the administrator take to meet these requirements? (Choose two.)