Cybersecurity-Practitioner Endpoint Security Practice Question
Which TWO actions can be performed directly from the Cortex XDR management console on a compromised endpoint? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Initiate a remote PowerShell session or run triage scripts via Remote Response.
Cortex XDR provides remote response and isolation capabilities directly from the console interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reflash the physical BIOS firmware remotely to remove persistent bootkits.
Why it's wrong here
BIOS flashing is not supported as a remote endpoint action.
- ✓
Initiate a remote PowerShell session or run triage scripts via Remote Response.
Why this is correct
Remote Response allows running scripts and triage collection directly.
- ✗
Upgrade the physical RAM hardware configuration.
Why it's wrong here
Hardware upgrades require physical intervention.
- ✗
Reinstall the host operating system from a golden cloud image.
Why it's wrong here
OS re-imaging is not performed directly by the Cortex XDR agent.
- ✓
Isolate the endpoint from the network to stop lateral movement.
Why this is correct
Network isolation is a primary containment action available in Cortex XDR.
About these practice questions
One of 206 original Cybersecurity-Practitioner practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Practitioner practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Practitioner exam.