XSIAM-Analyst Endpoint Security Management — Timed 30 Questions

Question 1

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

30 minute time limit — choose an answer to begin.

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 2

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. In XSIAM, the Endpoint Security > Dashboards section provides pre-built summary dashboards that include agent version distribution and deployment health across the organization. This is the intended location for analysts to quickly assess which endpoints have out-of-date Cortex XDR agent versions. The dashboards aggregate data from all managed endpoints and present it in a visual, filterable format.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 3

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Accepted Answer

Endpoint Security > Assets > Agent Details. The Endpoint Security > Assets > Agent Details view in XSIAM shows the operational status of the Cortex XDR agent, including its connected broker/gateway, last heartbeat time, and applied security profiles. This is the first place to check when telemetry is delayed or profiles aren't applying, because it directly surfaces connectivity and configuration state.

Answer

Incident Viewer > Alerts timeline

Answer

Query Library using dataset xdr_data

Answer

Settings > Agent Settings > Global Status

Question 4

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Isolate. Network isolation for an individual asset in XSIAM is performed from the Endpoint Security > Assets page. After selecting the specific asset, the Action menu provides the Isolate option, which immediately isolates the endpoint from the network. This is the direct, asset-centric workflow for containment.

Answer

Data Collection > Configurations > Network Isolation

Answer

Response > Playbooks > Manual Triggers > Isolate

Answer

Settings > Agent Settings > Containment Rules

Question 5

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Accepted Answer

Endpoint Security > Assets > Installers. The latest signed Cortex XDR agent installer package and transform file for Group Policy deployment are available under Endpoint Security > Assets > Installers in the XSIAM management console. This section provides the MSI and MST files needed for GPO-based deployment.

Answer

Data Collection > Sources > Agents

Answer

Settings > Configurations > Agents > Installers

Answer

Response > Content > Packages

Question 6

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Accepted Answer

Endpoint Security > Settings > Agent Settings > Heartbeat interval. Agent connectivity settings and offline alerting thresholds are managed within Agent Settings or specific Alert Rules in XSIAM.

Answer

Data Collection > Broker VM > Polling parameters

Answer

Settings > Integrations > Cortex XDR Agent > Sync Timer

Answer

Incidents > Automation > Heartbeat Playbook

Question 7

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Lift Isolation. To lift network isolation in XSIAM, the analyst navigates to Endpoint Security > Assets, selects the specific asset, and chooses Action > Lift Isolation. This restores network connectivity for the host after containment. The action is performed directly on the asset record, ensuring the correct endpoint is targeted.

Answer

Settings > Network > Firewall > Unblock Host

Answer

Response > Playbooks > Restart Agent

Answer

Data Collection > Endpoints > Reconnect

Question 8

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Accepted Answer

Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. The agent uninstallation/tamper protection password in XSIAM is configured under Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. This setting allows administrators to set a password that prevents unauthorized users or malware from stopping the agent service or modifying its configuration locally. It is a critical security control for endpoint agents.

Answer

Data Collection > Agent Deployment > Security Passwords

Answer

Settings > Access Management > Endpoint Users

Answer

Response > Containment > Agent Passwords

Question 9

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Accepted Answer

Configuring multiple gateway addresses within agent deployment settings for failover.. Option A is correct because XSIAM agents support configuring multiple gateway addresses in the agent deployment settings, allowing endpoints to fail over to an alternate gateway if the primary is unreachable, which maintains reporting continuity and distributes load across gateways. Option E is correct because Broker VMs are deployed locally within network segments to act as event collectors and agent proxies, so agents report to a nearby broker instead of crossing segment boundaries to the main XSIAM tenant, improving availability and load distribution. Options B, C, and D are incorrect: spanning tree protocol is a Layer 2 loop-prevention mechanism unrelated to XSIAM agent reporting; replacing agents with manual syslog over UDP 514 removes the agent architecture and provides no high availability or load distribution; and turning Windows workstations into cluster node controllers is not a supported XSIAM design and would not serve as an agent reporting tier.

Answer

Enabling spanning tree protocol across all endpoint network interface cards.

Answer

Replacing all endpoint agents with manual syslog forwarding rules via UDP port 514.

Answer

Converting every Windows workstation into an active cluster node controller.

Question 10

An administrator is configuring the automatic uninstallation protection and security settings for the Cortex XDR agent. Which THREE protection features can be enforced via the Agent Settings profile to secure the agent against tampering? (Choose three)

Accepted Answer

Prevent local termination or stopping of the Cortex XDR background services.. The Agent Settings profile in Cortex XDR includes a dedicated "Agent Tampering Protection" or uninstall-protection section that enforces exactly these three controls. Option A is correct because the profile can enable protection of the Cortex XDR background services (e.g., the Cytool and agent services) so that local users cannot stop or terminate them via Task Manager, net stop, or sc stop. Option B is correct because the profile can require an uninstall password (or authorization token) before the agent can be removed, preventing unauthorized uninstallation. Option C is correct because the same tampering protection hardens the agent's installation directory, registry keys, and driver binaries against modification or deletion by non-authorized processes. Option D is not part of agent tampering protection; disk wiping on failed logins is a full-disk encryption/endpoint policy feature, not an Agent Settings option. Option E is also unrelated, as resetting a BIOS password on service restart is not a Cortex XDR agent setting and is not a supported enforcement mechanism.

Answer

Automatically wipe the endpoint hard drive upon three failed login attempts.

Answer

Force a BIOS password reset whenever the agent service restarts.

Question 11

An analyst is reviewing the endpoint security posture in XSIAM and notices several Windows endpoints showing a status of 'Protection Disabled'. The analyst needs to determine which TWO conditions could cause the Cortex XDR agent to enter this state without generating a malware alert. (Choose two.)

Accepted Answer

Tamper protection was not enabled, allowing a malicious process to terminate the agent's protected processes.. The correct answers are a local administrator manually stopping the agent service and a malicious process terminating the agent's processes when tamper protection is not enabled. Both scenarios result in the agent being stopped or disabled, which XSIAM reports as 'Protection Disabled'. Neither requires a malware detection to be generated, which matches the analyst's observation.

Answer

The endpoint's license or agent registration expired, causing the agent to stop enforcing security profiles.

Answer

A security policy update from XSIAM temporarily disabled protection while applying a new profile.

Answer

The Cortex XDR agent was uninstalled by a user with administrative rights using the standard Windows uninstaller.

Question 12

An analyst notices that a Windows endpoint is showing in XSIAM with a status of 'Unprotected' and the Cortex XDR agent service is not running. The analyst wants to remotely start the agent service and collect a support file without interrupting the user session. Which action in the XSIAM endpoint management console should the analyst perform first?

Accepted Answer

Use the 'Restart Agent' action from the endpoint's action menu, then use 'Retrieve Support File' to collect diagnostics.. The 'Restart Agent' action is designed to remotely restart the Cortex XDR agent service even when it is stopped, using the management communication channel. After the agent is running, 'Retrieve Support File' gathers logs and configuration for analysis. This combination restores protection and provides diagnostics without requiring a reinstall or disrupting the user session.

Answer

Isolate the endpoint from the network to prevent potential compromise, then troubleshoot the agent service.

Answer

Deploy a new agent installation package to the endpoint to overwrite the existing installation.

Answer

Initiate a live terminal session to the endpoint and run 'net start cyserver' manually.

Question 13

A security administrator is configuring the Cortex XDR agent's malware protection settings for a group of Linux servers. The administrator wants to ensure that when a malicious file is detected, the agent quarantines the file and also logs the original file path and hash for forensic analysis. Which agent configuration option should the administrator enable to meet these requirements?

Accepted Answer

Enable 'Quarantine' action and configure the agent to send quarantine events to XSIAM with file metadata.. The 'Quarantine' action both neutralizes the threat by moving the file to a secure quarantine area and generates an event that includes the original file path and hash. This event is forwarded to XSIAM for forensic analysis. The other actions either do not quarantine the file or do not provide the required metadata, failing to meet the combined requirements.

Answer

Enable 'Block' action, which prevents execution but leaves the file in place and logs the attempt.

Answer

Enable 'Report' action only, which logs the file path and hash without modifying the file.

Answer

Configure a custom IOC rule that blocks the file hash and automatically deletes the file.

Question 14

An analyst is reviewing a Cortex XSIAM endpoint where the Cortex XDR agent has stopped reporting telemetry. The endpoint still shows as connected in the console, but no new events have arrived for several hours. The analyst suspects the agent is in a state that suppresses event forwarding while still maintaining its heartbeat. Which agent state should the analyst investigate first?

Accepted Answer

The agent's local event buffer is full and is dropping events because the endpoint cannot reach the tenant's event collector endpoint.. The described symptoms—connected heartbeat with no new events—point to a transport issue where the agent can reach the management service but not the event collector. In that case the local event buffer fills and events are dropped. The other options describe policy, uninstall, or licensing states that would not produce this specific combination of maintained connectivity and missing telemetry.

Answer

The agent has entered 'Disabled' mode because an administrator applied a policy that disables event collection.

Answer

The agent's license has expired, causing it to stop forwarding events but keep the heartbeat.

Answer

The agent is in 'Uninstalled' state pending a reboot, so it no longer sends events.

Question 15

A Cortex XDR agent on a Windows server is installed with the content update policy set to 'Scheduled'. The administrator notices that new behavioral threat signatures are not being applied even though the agent is online and the schedule is configured to run nightly. Which action should the administrator take to ensure content updates are applied when the agent checks in, without reinstalling the agent?

Accepted Answer

Change the agent's content update policy to 'Immediate' in the endpoint policy configuration.. The agent's content update policy determines when new signatures and behavioral rules are downloaded and applied. When set to Scheduled, updates occur only at configured intervals, which may not align with the agent's check-in times. Changing the policy to Immediate ensures the agent applies content as soon as it communicates with the server, resolving the delay without reinstalling.

Answer

Re-register the endpoint with the XSIAM tenant by generating a new installation package.

Answer

Restart the Cortex XDR agent service on the endpoint and verify the scheduled task is enabled.

Answer

Modify the Windows Task Scheduler entry that triggers the content update to run more frequently.

Question 16

An analyst is investigating a suspicious process on a Windows endpoint. The analyst wants to view the process tree, command-line arguments, and loaded modules for a specific process directly from the XSIAM console without logging into the endpoint. Which XSIAM feature should the analyst use?

Accepted Answer

Endpoint Investigation > Process Explorer. The Process Explorer under Endpoint Investigation is purpose-built to display detailed process information, including the process tree, command-line arguments, and loaded modules. It allows analysts to remotely investigate suspicious processes without direct endpoint access. The other features either require manual command execution, focus on threat intelligence, or provide a timeline rather than a structured process view.

Answer

Threat Intelligence > IOC Analysis

Answer

Forensics > Timeline Analysis

Answer

Incident Response > Live Terminal

Question 17

A security administrator is configuring endpoint security policies in XSIAM. The administrator wants to ensure that when a malware incident is detected on an endpoint, the Cortex XDR agent automatically isolates the endpoint from the network except for communication with the XSIAM management server. Which policy action should the administrator configure to achieve this?

Accepted Answer

Set the malware protection action to 'Block and Isolate'.. The 'Block and Isolate' action in the malware protection policy is designed to automatically isolate an endpoint when malware is detected. This action blocks malicious activity and restricts network communication to only the XSIAM management server, allowing the security team to investigate and remediate. Other options like playbooks or network ACLs are not the native agent policy action and may introduce delays or complexity.

Answer

Enable 'Auto Isolation' in the endpoint's agent configuration profile.

Answer

Configure a playbook in XSIAM to isolate the endpoint upon malware alert.

Answer

Set the endpoint's network access control list to block all traffic except to the XSIAM server.

Question 18

An administrator is reviewing the endpoint security management capabilities in XSIAM. The administrator needs to perform a bulk action on multiple endpoints to apply a new security policy and then verify the policy application status. Which TWO actions can be performed directly from the Endpoints page in the XSIAM console? (Choose two.)

Accepted Answer

Select multiple endpoints and apply a new policy from the action menu.. The XSIAM Endpoints page provides bulk policy assignment through the action menu, allowing administrators to select multiple endpoints and apply a policy. After assignment, the endpoint details pane displays the policy application status, enabling verification. These two actions directly support the administrator's need to apply and confirm policy deployment across multiple endpoints.

Answer

Export a list of endpoints with their current policy status to a CSV file.

Answer

Edit the security policy directly from the Endpoints page without navigating to the Policies section.

Answer

Initiate a remote scan on multiple endpoints simultaneously.

Question 19

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. To reduce Cortex XDR agent file-system scanning overhead on developer endpoints without disabling threat prevention, the correct approach is to add targeted file path and process exclusions in the Malware Profile scan settings. Exclusions tell the agent to skip known-good, high-churn paths (such as compiler output directories) and trusted build processes, which lowers CPU usage while keeping malware protection active for everything else. This is the surgical, supported method for balancing performance and security.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 20

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Accepted Answer

Inspect the local agent log files on the endpoint to identify communication or buffering errors with the XSIAM backend.. Reviewing local agent log files (such as cyserver.log) on the endpoint or checking broker VM communication logs helps determine if telemetry is blocked or failing to upload.

Answer

Modify the XQL ingestion parser rules for the endpoint asset dataset.

Answer

Purge all historical alerts from the Incident Viewer to free up ingestion buffers.

Answer

Run an immediate software upgrade of the XSIAM tenant license key.