XSIAM-Analyst Endpoint Security Management — Timed 15 Questions

Question 1

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

15 minute time limit — choose an answer to begin.

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 2

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. In XSIAM, the Endpoint Security > Dashboards section provides pre-built summary dashboards that include agent version distribution and deployment health across the organization. This is the intended location for analysts to quickly assess which endpoints have out-of-date Cortex XDR agent versions. The dashboards aggregate data from all managed endpoints and present it in a visual, filterable format.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 3

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Accepted Answer

Endpoint Security > Assets > Agent Details. The Endpoint Security > Assets > Agent Details view in XSIAM shows the operational status of the Cortex XDR agent, including its connected broker/gateway, last heartbeat time, and applied security profiles. This is the first place to check when telemetry is delayed or profiles aren't applying, because it directly surfaces connectivity and configuration state.

Answer

Incident Viewer > Alerts timeline

Answer

Query Library using dataset xdr_data

Answer

Settings > Agent Settings > Global Status

Question 4

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Isolate. Network isolation for an individual asset in XSIAM is performed from the Endpoint Security > Assets page. After selecting the specific asset, the Action menu provides the Isolate option, which immediately isolates the endpoint from the network. This is the direct, asset-centric workflow for containment.

Answer

Data Collection > Configurations > Network Isolation

Answer

Response > Playbooks > Manual Triggers > Isolate

Answer

Settings > Agent Settings > Containment Rules

Question 5

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Accepted Answer

Endpoint Security > Assets > Installers. The latest signed Cortex XDR agent installer package and transform file for Group Policy deployment are available under Endpoint Security > Assets > Installers in the XSIAM management console. This section provides the MSI and MST files needed for GPO-based deployment.

Answer

Data Collection > Sources > Agents

Answer

Settings > Configurations > Agents > Installers

Answer

Response > Content > Packages

Question 6

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Accepted Answer

Endpoint Security > Settings > Agent Settings > Heartbeat interval. Agent connectivity settings and offline alerting thresholds are managed within Agent Settings or specific Alert Rules in XSIAM.

Answer

Data Collection > Broker VM > Polling parameters

Answer

Settings > Integrations > Cortex XDR Agent > Sync Timer

Answer

Incidents > Automation > Heartbeat Playbook

Question 7

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Lift Isolation. To lift network isolation in XSIAM, the analyst navigates to Endpoint Security > Assets, selects the specific asset, and chooses Action > Lift Isolation. This restores network connectivity for the host after containment. The action is performed directly on the asset record, ensuring the correct endpoint is targeted.

Answer

Settings > Network > Firewall > Unblock Host

Answer

Response > Playbooks > Restart Agent

Answer

Data Collection > Endpoints > Reconnect

Question 8

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Accepted Answer

Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. The agent uninstallation/tamper protection password in XSIAM is configured under Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. This setting allows administrators to set a password that prevents unauthorized users or malware from stopping the agent service or modifying its configuration locally. It is a critical security control for endpoint agents.

Answer

Data Collection > Agent Deployment > Security Passwords

Answer

Settings > Access Management > Endpoint Users

Answer

Response > Containment > Agent Passwords

Question 9

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Accepted Answer

Configuring multiple gateway addresses within agent deployment settings for failover.. Option A is correct because XSIAM agents support configuring multiple gateway addresses in the agent deployment settings, allowing endpoints to fail over to an alternate gateway if the primary is unreachable, which maintains reporting continuity and distributes load across gateways. Option E is correct because Broker VMs are deployed locally within network segments to act as event collectors and agent proxies, so agents report to a nearby broker instead of crossing segment boundaries to the main XSIAM tenant, improving availability and load distribution. Options B, C, and D are incorrect: spanning tree protocol is a Layer 2 loop-prevention mechanism unrelated to XSIAM agent reporting; replacing agents with manual syslog over UDP 514 removes the agent architecture and provides no high availability or load distribution; and turning Windows workstations into cluster node controllers is not a supported XSIAM design and would not serve as an agent reporting tier.

Answer

Enabling spanning tree protocol across all endpoint network interface cards.

Answer

Replacing all endpoint agents with manual syslog forwarding rules via UDP port 514.

Answer

Converting every Windows workstation into an active cluster node controller.

Question 10

An administrator is configuring the automatic uninstallation protection and security settings for the Cortex XDR agent. Which THREE protection features can be enforced via the Agent Settings profile to secure the agent against tampering? (Choose three)

Accepted Answer

Prevent local termination or stopping of the Cortex XDR background services.. The Agent Settings profile in Cortex XDR includes a dedicated "Agent Tampering Protection" or uninstall-protection section that enforces exactly these three controls. Option A is correct because the profile can enable protection of the Cortex XDR background services (e.g., the Cytool and agent services) so that local users cannot stop or terminate them via Task Manager, net stop, or sc stop. Option B is correct because the profile can require an uninstall password (or authorization token) before the agent can be removed, preventing unauthorized uninstallation. Option C is correct because the same tampering protection hardens the agent's installation directory, registry keys, and driver binaries against modification or deletion by non-authorized processes. Option D is not part of agent tampering protection; disk wiping on failed logins is a full-disk encryption/endpoint policy feature, not an Agent Settings option. Option E is also unrelated, as resetting a BIOS password on service restart is not a Cortex XDR agent setting and is not a supported enforcement mechanism.

Answer

Automatically wipe the endpoint hard drive upon three failed login attempts.

Answer

Force a BIOS password reset whenever the agent service restarts.

Question 11

An analyst is reviewing the endpoint security posture in XSIAM and notices several Windows endpoints showing a status of 'Protection Disabled'. The analyst needs to determine which TWO conditions could cause the Cortex XDR agent to enter this state without generating a malware alert. (Choose two.)

Accepted Answer

Tamper protection was not enabled, allowing a malicious process to terminate the agent's protected processes.. The correct answers are a local administrator manually stopping the agent service and a malicious process terminating the agent's processes when tamper protection is not enabled. Both scenarios result in the agent being stopped or disabled, which XSIAM reports as 'Protection Disabled'. Neither requires a malware detection to be generated, which matches the analyst's observation.

Answer

The endpoint's license or agent registration expired, causing the agent to stop enforcing security profiles.

Answer

A security policy update from XSIAM temporarily disabled protection while applying a new profile.

Answer

The Cortex XDR agent was uninstalled by a user with administrative rights using the standard Windows uninstaller.

Question 12

An analyst notices that a Windows endpoint is showing in XSIAM with a status of 'Unprotected' and the Cortex XDR agent service is not running. The analyst wants to remotely start the agent service and collect a support file without interrupting the user session. Which action in the XSIAM endpoint management console should the analyst perform first?

Accepted Answer

Use the 'Restart Agent' action from the endpoint's action menu, then use 'Retrieve Support File' to collect diagnostics.. The 'Restart Agent' action is designed to remotely restart the Cortex XDR agent service even when it is stopped, using the management communication channel. After the agent is running, 'Retrieve Support File' gathers logs and configuration for analysis. This combination restores protection and provides diagnostics without requiring a reinstall or disrupting the user session.

Answer

Isolate the endpoint from the network to prevent potential compromise, then troubleshoot the agent service.

Answer

Deploy a new agent installation package to the endpoint to overwrite the existing installation.

Answer

Initiate a live terminal session to the endpoint and run 'net start cyserver' manually.

Question 13

A security administrator is configuring the Cortex XDR agent's malware protection settings for a group of Linux servers. The administrator wants to ensure that when a malicious file is detected, the agent quarantines the file and also logs the original file path and hash for forensic analysis. Which agent configuration option should the administrator enable to meet these requirements?

Accepted Answer

Enable 'Quarantine' action and configure the agent to send quarantine events to XSIAM with file metadata.. The 'Quarantine' action both neutralizes the threat by moving the file to a secure quarantine area and generates an event that includes the original file path and hash. This event is forwarded to XSIAM for forensic analysis. The other actions either do not quarantine the file or do not provide the required metadata, failing to meet the combined requirements.

Answer

Enable 'Block' action, which prevents execution but leaves the file in place and logs the attempt.

Answer

Enable 'Report' action only, which logs the file path and hash without modifying the file.

Answer

Configure a custom IOC rule that blocks the file hash and automatically deletes the file.

Question 14

An analyst is reviewing a Cortex XSIAM endpoint where the Cortex XDR agent has stopped reporting telemetry. The endpoint still shows as connected in the console, but no new events have arrived for several hours. The analyst suspects the agent is in a state that suppresses event forwarding while still maintaining its heartbeat. Which agent state should the analyst investigate first?

Accepted Answer

The agent's local event buffer is full and is dropping events because the endpoint cannot reach the tenant's event collector endpoint.. The described symptoms—connected heartbeat with no new events—point to a transport issue where the agent can reach the management service but not the event collector. In that case the local event buffer fills and events are dropped. The other options describe policy, uninstall, or licensing states that would not produce this specific combination of maintained connectivity and missing telemetry.

Answer

The agent has entered 'Disabled' mode because an administrator applied a policy that disables event collection.

Answer

The agent's license has expired, causing it to stop forwarding events but keep the heartbeat.

Answer

The agent is in 'Uninstalled' state pending a reboot, so it no longer sends events.

Question 15

A Cortex XDR agent on a Windows server is installed with the content update policy set to 'Scheduled'. The administrator notices that new behavioral threat signatures are not being applied even though the agent is online and the schedule is configured to run nightly. Which action should the administrator take to ensure content updates are applied when the agent checks in, without reinstalling the agent?

Accepted Answer

Change the agent's content update policy to 'Immediate' in the endpoint policy configuration.. The agent's content update policy determines when new signatures and behavioral rules are downloaded and applied. When set to Scheduled, updates occur only at configured intervals, which may not align with the agent's check-in times. Changing the policy to Immediate ensures the agent applies content as soon as it communicates with the server, resolving the delay without reinstalling.

Answer

Re-register the endpoint with the XSIAM tenant by generating a new installation package.

Answer

Restart the Cortex XDR agent service on the endpoint and verify the scheduled task is enabled.

Answer

Modify the Windows Task Scheduler entry that triggers the content update to run more frequently.