XSIAM-Analyst Endpoint Security Management Practice Test 4 — 15 Questions

Question 1

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Agent password protection. The correct answer is agent password protection. This setting requires a password to uninstall the Cortex XDR agent or stop its service, directly preventing unauthorized users and malware from disabling protection. Other features like behavioral threat protection, exploit protection, and device control serve different security purposes and do not control agent uninstallation.

Answer

Device control

Answer

Behavioral threat protection

Answer

Exploit protection

Question 2

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

Accepted Answer

Endpoint tag or endpoint group assignment.. Cortex XSIAM endpoint policy rules scope endpoints using supported attributes such as operating system platform, endpoint tags, and endpoint groups. Targeting the Windows Server platform and assigning servers to a specific tag or group both directly and reliably limit the policy to the intended fleet. The other options reference values that are either not exposed for policy scoping or are dynamic metrics unsuitable for stable policy assignment.

Answer

The endpoint's physical location as reported by the BIOS asset tag.

Answer

The endpoint's local administrator account password complexity.

Answer

The endpoint's current CPU utilization percentage.

Question 3

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

Accepted Answer

Endpoint Management > Endpoints > select the endpoint > Protection Status tab. To verify what protections a Cortex XDR agent is actually enforcing on a specific host, the analyst must open the endpoint's detail view and consult the Protection Status tab, which reports the applied policy and each module's state. Incident timelines, policy audit trails, and vulnerability views describe different data sets and do not represent the endpoint's live protection configuration.

Answer

Inventory > Endpoints > select the endpoint > Vulnerabilities tab

Answer

Policies > Prevention > select the policy > Audit Trail tab

Answer

Incidents > select the relevant incident > Timeline tab

Question 4

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

Accepted Answer

In the Cortex XSIAM Administrator Guide under the Cortex XDR agent installation requirements section.. The Cortex XSIAM Administrator Guide is the official documentation that lists Cortex XDR agent installation requirements, including supported Windows operating system versions. Administrators should consult it before deployment to confirm compatibility. The other options reference local endpoint data or licensing documents that do not contain the agent's supported OS matrix.

Answer

In the Cortex XSIAM license certificate provided at purchase.

Answer

In the endpoint's Windows Update history on each target machine.

Answer

In the Windows Event Viewer Application log on a previously deployed endpoint.

Question 5

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

Accepted Answer

The endpoint's last seen timestamp and connection status on the Endpoints page. Agent communication health is verified through the last seen timestamp and connection status shown on the Endpoints page. These fields are updated by agent heartbeats, so a recent timestamp confirms the agent is checking in and receiving policies, whereas incident counts, OS version, and group assignment do not reflect live connectivity.

Answer

The endpoint's assigned endpoint group name

Answer

The endpoint's operating system build version

Answer

The number of incidents associated with the endpoint

Question 6

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

Accepted Answer

Enable the malware protection module in blocking mode and add a hash-based allowlist for the known legitimate custom binaries.. Hash-based allowlisting of known legitimate custom binaries allows malware protection to remain in blocking mode for all other content, catching malicious executables while preventing false positives on approved builds. Report-only mode, disabling the module, and directory wildcard exclusions each weaken protection more than necessary for this scenario.

Answer

Enable the malware protection module in report-only mode for the entire workstation group.

Answer

Enable blocking mode and create a wildcard path exclusion for the directory where the custom binaries are compiled.

Answer

Leave the malware protection module disabled and rely solely on behavioral threat protection.

Question 7

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

Accepted Answer

From the Endpoints page in XSIAM, select the endpoint and choose 'Enable Agent' from the action menu.. The agent is in a disabled state, which means its protection features are not active. The XSIAM console provides a direct action to enable the agent on the endpoint. This sends a command to the agent to resume normal operation and apply its security policy. Restarting the service, reinstalling, or changing the policy to monitor-only would not resolve the disabled state and could introduce additional issues.

Answer

Restart the Cortex XDR agent service on the endpoint using the Services console.

Answer

Uninstall and reinstall the Cortex XDR agent on the endpoint.

Answer

Modify the endpoint's security policy to allow the agent to run in monitor-only mode.

Question 8

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable password protection for agent uninstallation and stopping of the agent service.. Password protection and running as a protected process (PPL) are both direct self-protection mechanisms. Password protection blocks unauthorized uninstallation or service stop, while PPL prevents other processes from terminating or modifying the agent. Together, they significantly harden the agent against tampering attempts, meeting the administrator's requirement.

Answer

Configure the agent to scan for and remove other security tools that might conflict.

Answer

Set the agent to automatically update to the latest version without user intervention.

Answer

Enable detailed logging of all agent actions to a remote syslog server.

Question 9

A Cortex XDR agent on a Linux server is repeatedly triggering behavioral threat protection alerts for a legitimate backup script that spawns shell commands and reads many files. The administrator wants to suppress these false positives without weakening protection against actual malicious behavior. Which action is most appropriate?

Accepted Answer

Add a Behavioral Threat Protection exception scoped to the specific backup script's path and command line.. A Behavioral Threat Protection exception scoped to the backup script's exact path and command line suppresses the false positives while keeping behavioral detection and blocking active for everything else on the server. Disabling the module, switching to report-only, and host-wide alert exclusions all reduce protection far beyond what the scenario requires.

Answer

Disable behavioral threat protection on the Linux server group.

Answer

Change the agent's action for behavioral threat protection from blocking to report-only.

Answer

Create an alert exclusion that hides all behavioral threat protection alerts originating from the server.

Question 10

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

Accepted Answer

Enable 'Password Protection' for agent uninstallation in the agent configuration profile.. The Cortex XDR agent includes a password protection feature that prevents unauthorized uninstallation. This is configured in the agent configuration profile within XSIAM. When enabled, a password is required to uninstall the agent, ensuring that only authorized personnel can remove it. Other methods like Group Policy or registry changes are not the native or recommended way to enforce this requirement.

Answer

Deploy the agent with a tamper-resistant installation package.

Answer

Configure a Windows Group Policy to restrict uninstallation of the agent.

Answer

Set the agent to run as a protected process in the Windows registry.

Question 11

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management section under the Endpoints menu is specifically designed to list all endpoints with the Cortex XDR agent, showing status, version, and other details. It allows administrators to search for a specific endpoint and verify that the agent is installed and running. The other sections focus on incidents, policies, or global settings, not endpoint-specific agent status.

Answer

Incidents > Incident Management

Answer

Policies > Policy Management

Answer

Settings > Agent Configuration

Question 12

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

Accepted Answer

Password protection requires a password to uninstall or tamper with the agent, and the password is set in the agent configuration profile applied to the endpoint.. Cortex XSIAM agent password protection is configured in the agent profile and requires a password for uninstall or tamper operations, preventing users from stopping or removing the agent. It is not an OS-level encryption or Group Policy feature, and it applies to Windows agents. The other options misdescribe the mechanism or incorrectly limit its platform support.

Answer

Password protection encrypts the agent's local database and requires a password each time the endpoint boots.

Answer

Password protection is enforced by the Windows operating system's Group Policy and is unrelated to the Cortex XDR agent configuration.

Answer

Password protection only applies to macOS and Linux agents; Windows agents rely solely on Windows service permissions.

Question 13

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

Accepted Answer

Enable 'Agent Self-Protection' to prevent termination of the agent process and its services.. Agent Self-Protection is the built-in Cortex XDR capability that guards the agent service and processes against tampering, including attempts to stop the service from the Services console. Because it operates independently of uninstall authorization, administrators can still uninstall the agent by supplying the configured uninstall password, which precisely matches the stated requirement.

Answer

Deploy a Windows Group Policy Object that sets the Cortex XDR service startup type to Automatic and denies stop permissions to the Users group.

Answer

Enable 'Behavioral Threat Protection' to block service-stopping behavior on endpoints.

Answer

Configure an 'Agent Settings' profile with a password-protected uninstall and disable the agent tray icon.

Question 14

An analyst is reviewing the endpoint security status in XSIAM and notices that a Linux server has the Cortex XDR agent installed but is reporting a 'Disconnected' status. The server is critical and runs a custom application that requires specific kernel modules. The analyst suspects that the agent is not functioning correctly due to a compatibility issue. Which of the following is the most appropriate first step to troubleshoot this issue?

Accepted Answer

Check the agent logs on the Linux server for errors related to kernel module loading.. When a Linux endpoint with a Cortex XDR agent reports a disconnected status and a kernel compatibility issue is suspected, the agent logs on the server are the best source of diagnostic information. These logs will show if the agent is failing to load required kernel modules or encountering other errors. This step is non-intrusive and directly addresses the suspected cause. Other actions like reinstalling or disabling features are premature without understanding the root cause.

Answer

Disable the agent's kernel-level protection features to allow it to connect.

Answer

Reinstall the Cortex XDR agent with the latest version from the XSIAM console.

Answer

Verify that the server's firewall allows outbound communication on port 443 to the XSIAM tenant.

Question 15

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Accepted Answer

Check the agent diagnostic logs and service status on the endpoint to identify why the agent cannot reach the tenant.. An online endpoint whose agent reports Disconnected points to a communication or service problem on the endpoint itself, not a network outage. Inspecting the agent's diagnostic logs and confirming the service is running surfaces the specific failure, such as proxy, DNS, or certificate issues, so the analyst can remediate the true cause rather than applying disruptive containment or unnecessary reinstallation.

Answer

Immediately isolate the endpoint from the network to prevent potential lateral movement while investigating.

Answer

Reinstall the Cortex XDR agent on the endpoint to restore communications with the tenant.

Answer

Create a new agent installation package and redistribute it to the endpoint through the deployment console.