CCNA Endpoint Security Questions

Which TWO actions can an administrator perform from the Cortex XDR management console when responding to an active endpoint security incident? (Choose two)

Which component of the Cortex XDR architecture provides continuous endpoint data collection and threat prevention directly on the host operating system?

An organization's security policy requires all endpoint security logs to be forwarded to a centralized SIEM in real time. How does Cortex XDR support this requirement?

Which TWO types of files or threats are typically inspected and analyzed by the WildFire cloud service when integrated with Cortex XDR? (Choose two)

An administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows workstations. Which feature must be configured in the agent settings?

An administrator is troubleshooting a scenario where Cortex XDR agents are failing to report incident data to the cloud console. Which TWO network-related items should be verified? (Choose two)

Which THREE actions occur when an endpoint is placed into 'Isolation' mode using Cortex XDR? (Choose three)

Which THREE features are provided by the Cortex XDR agent to protect endpoints against modern malware and advanced threats? (Choose three)

An endpoint has been compromised by an advanced persistent threat (APT). The incident response team needs to reconstruct the entire attack lifecycle, showing how the initial access led to lateral movement and persistence. Which Cortex XDR feature provides this visualization?

An administrator needs to upgrade Cortex XDR agents across all enterprise endpoints. What is the recommended method in the Cortex XDR management console?

What is the primary function of WildFire integration within the Cortex XDR ecosystem?

An administrator needs to configure granular endpoint settings for different departments within the organization. Which THREE components of Cortex XDR should be utilized? (Choose three)

An administrator wants to verify which prevention modules (e.g., Malware, Exploit, Behavioral Threat Protection) are enabled for a specific set of workstations. Where should the administrator check?

An organization wants to verify that the Cortex XDR agent is actively communicating with the Cortex XDR cloud tenant. Which status indicator should the administrator look for in the Endpoint Management view?

A security analyst notices that a specific PowerShell script is being blocked on an endpoint by Cortex XDR behavioral threat protection. However, the development team confirms the script is legitimate. Where should the analyst create an exception to allow this specific script execution while maintaining behavioral monitoring?

An administrator is deploying Cortex XDR agent to corporate Windows endpoints and needs to ensure that the agent runs in full prevention mode without user intervention. Which configuration setting in the installation profile must be verified?

An endpoint running macOS encounters a kernel extension loading blockage when installing the Cortex XDR agent. What action must the administrator take to resolve this?

An administrator needs to deploy Cortex XDR agents across a large enterprise using an Active Directory Group Policy Object (GPO). The installation fails on Windows endpoints with an error indicating missing prerequisites. What must be verified first?

An endpoint generates an alert indicating that a known malicious file was detected and quarantined by the Cortex XDR agent. Where can the administrator review details about this quarantine action?

An enterprise environment contains legacy Windows servers that cannot support the latest Cortex XDR agent version due to OS limitations. How does Cortex XDR handle protection for these older operating systems?

Which TWO operating systems are officially supported for deployment of the standard Cortex XDR agent? (Choose two)

A security analyst is reviewing a BIOC (Behavioral Indicator of Compromise) alert in the Cortex XDR incident view. What distinguishes a BIOC alert from a standard malware alert?

Which THREE methods can be used to deploy the Cortex XDR agent package across an enterprise Windows environment? (Choose three)

A security analyst is investigating a polymorphic malware sample that attempts to inject code into legitimate Windows processes (Process Injection). Which Cortex XDR protection module is primarily responsible for detecting and blocking this technique?

An endpoint generates an alert for a suspicious script execution, but the analyst determines it is a false positive generated by a legitimate administrative tool. What is the best practice for handling this false positive in Cortex XDR?

An administrator is troubleshooting a Cortex XDR agent that has stopped reporting to the management console. The local agent service is running, but network traces show TLS handshake failures with the Cortex XDR server. What is the most likely cause?

An endpoint has been isolated via the Cortex XDR console due to a suspected ransomware outbreak. The incident responder needs to allow one specific management server to communicate with this isolated endpoint for forensics collection. What is the correct procedure?

An administrator is reviewing security events in Cortex XDR and notices multiple alerts tagged with MITRE ATT&CK techniques. Which THREE benefits does integrating MITRE ATT&CK taxonomy into Cortex XDR provide for analysts? (Choose three)

An endpoint experiences a zero-day fileless attack where shellcode is executed directly in memory via a vulnerable service. Which Cortex XDR protection feature is specifically designed to detect and block this type of attack prior to file drop?

An endpoint user reports that a legitimate internal application is failing to run because the Cortex XDR agent flags its behavior as suspicious. The administrator wants to collect forensic data specifically for this application to analyze its behavior. Which Cortex XDR feature should be enabled?