Cybersecurity-Apprentice Endpoint Security Practice Question
A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.
Cortex XDR allows administrators to create profile exceptions based on hash or behavioral exception rules for specific trusted scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the Cortex XDR management console under Profiles, create a behavioral threat protection exception using the script file hash.
Why this is correct
A behavioral threat protection exception using the file hash permits the specific script without disabling the entire module.
- ✗
Change the Agent settings to bypass all SSL decryption rules.
Why it's wrong here
SSL decryption rules are managed on the firewall, not the Cortex XDR agent profile.
- ✗
Disable the Local Analysis module entirely for the target endpoint group.
Why it's wrong here
Disabling Local Analysis lowers overall security posture and is not best practice for a single script.
- ✗
Modify the Windows Firewall inbound rules on the local endpoint.
Why it's wrong here
Windows Firewall manages network traffic, not script execution behavior.
About these practice questions
Courseiva writes every Cybersecurity-Apprentice question from scratch — 177 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Apprentice practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Apprentice exam.