Courseiva

Cybersecurity-Practitioner · topic practice

Endpoint Security practice questions

This domain covers endpoint protection with Palo Alto Networks Cortex XDR: agent deployment across Windows, macOS, and Linux, proxy and management-server communication, malware and exploit prevention profiles, hash-based blocking, alert suppression, and the telemetry sources that feed the Cortex XDR console. Questions are scenario-based, asking you to choose the correct agent setting, policy action, or exclusion to achieve a stated security outcome.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Endpoint Security
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Endpoint Security

Be able to deploy Cortex XDR agents through a forward proxy, apply hash-based blocking to stop a known-malicious executable, and create targeted exclusions that suppress false-positive alerts without weakening endpoint protection. The single most important thing is matching the control to the exact indicator given, such as SHA-256 versus filename.

Cortex XDR agent installation and communication through forward proxies and management servers

Malware, exploit, and restriction profiles applied to Windows and macOS endpoint policies

Hash-based and behavior-based blocking of known-malicious executables across managed endpoints

Alert suppression and exclusions for legitimate applications writing to registry Run keys

Watch out for

Common Endpoint Security exam traps

  • ▸Assuming filename-based blocking works when the question specifies only a SHA-256 hash is known and the filename may vary
  • ▸Forgetting that proxy settings must be configured on the agent or installer so endpoints can reach the Cortex XDR management server
  • ▸Suppressing an alert by disabling the entire prevention policy instead of scoping an exclusion to the specific application or behavior

Practice set

Endpoint Security questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice
Read the full Endpoint Security explanation →

A security analyst is investigating a suspicious process execution chain in the Cortex XDR Incident Viewer. The analyst wants to understand the exact sequence of child processes spawned by a malicious PowerShell script. Which Cortex XDR feature provides a graphical representation of the attack lifecycle and process relationships?

Question 2easymultiple choice
Read the full Endpoint Security explanation →

An administrator is deploying Cortex XDR Agent to Windows workstations using an Active Directory Group Policy Object (GPO). Which installation parameter must be used to ensure the agent registers correctly with the assigned Cortex XDR tenant using a specific installation token?

Question 3easymultiple choice
Read the full Endpoint Security explanation →

An administrator is preparing to deploy Cortex XDR agents to 500 remote endpoints using a software deployment tool. Where can the administrator download the latest installation packages and transforms?

Question 4easymultiple choice
Read the full Endpoint Security explanation →

An administrator needs to verify that the Cortex XDR agent services are running properly on a macOS endpoint. Which command-line utility should be used to check the agent status?

Question 5easymultiple choice
Read the full Endpoint Security explanation →

An administrator wants to verify which Cortex XDR agent version is installed on a specific Windows endpoint using the command line. Which command should be executed?

Question 6mediummultiple choice
Read the full Endpoint Security explanation →

An administrator observes that several Cortex XDR agents are showing a 'Disconnected' status in the management console. After verifying network connectivity, the administrator suspects that communication is blocked by an intermediate firewall. Which TCP port must be open outbound from the endpoints to the Cortex XDR server?

Question 7hardmultiple choice
Read the full Endpoint Security explanation →

An organization deploys Cortex XDR disk encryption management. An endpoint fails to escrow its BitLocker recovery key to the Cortex XDR console. What is the most effective troubleshooting step to verify escrow status using the agent command-line tool?

Question 8hardmultiple choice
Read the full network assurance explanation →

A security engineer needs to investigate endpoint telemetry data for a suspicious fileless attack that executed PowerShell commands out of memory. Which Cortex XDR component provides deep forensic visibility into command-line arguments, registry modifications, and network connections without relying solely on traditional logs?

Question 9hardmultiple choice
Read the full Endpoint Security explanation →

An organization requires compliance reporting showing that all endpoints are actively protected by Cortex XDR modules (Anti-Malware, Exploit Prevention, Behavioral Threat Protection). Where can an administrator generate this comprehensive compliance report in the Cortex XDR management console?

Question 10easymultiple choice
Read the full Endpoint Security explanation →

An administrator needs to check the status of the Exploit Prevention module on a Windows endpoint running Cortex XDR. Which command should be used?

Question 11hardmultiple choice
Read the full Endpoint Security explanation →

An administrator is troubleshooting an issue where Cortex XDR agent logs need to be gathered and submitted to Palo Alto Networks Support. Which command generates a complete support file package (often referred to as 'collector') containing all necessary logs and debug data?

Question 12easymulti select
Read the full Endpoint Security explanation →

Which THREE parameters or settings can be configured within a Cortex XDR Agent Settings profile? (Choose three)

Question 13mediummulti select
Read the full Endpoint Security explanation →

Which TWO tasks are required when preparing to deploy Cortex XDR agents using an installation token? (Choose two)

Question 14mediummultiple choice
Read the full network assurance explanation →

A security administrator is configuring a Cortex XDR agent installation on a Linux server that has no direct internet access. The administrator needs the agent to send telemetry to the Cortex XDR management server through an intermediate host. Which Cortex XDR agent configuration file must be edited to specify the broker VM address and port that the agent will use for communication?

Question 15easymultiple choice
Read the full Endpoint Security explanation →

A security analyst is reviewing a Cortex XDR alert indicating that a known malicious file was executed on an endpoint. The analyst wants to quickly determine the file's hash and its current status on the endpoint without leaving the Cortex XDR console. Which Cortex XDR feature provides this information directly from the alert details?

Question 16mediummulti select
Read the full network assurance explanation →

A security analyst is reviewing the Cortex XDR agent's capabilities for endpoint data collection. The analyst needs to verify that the agent is capturing the necessary telemetry to detect fileless attacks. Which TWO data sources does the Cortex XDR agent collect that are specifically useful for detecting fileless malware? (Choose two.)

Question 17mediummultiple choice
Read the full Endpoint Security explanation →

A security administrator is deploying Cortex XDR agents to a fleet of Windows servers that must communicate with the Cortex XDR management console exclusively through an outbound HTTPS proxy. The proxy requires authentication and is not configured at the operating system level. Where should the administrator configure the proxy settings so the agent can register successfully?

Question 18easymultiple choice
Read the full network assurance explanation →

A security administrator needs to ensure that Cortex XDR agents on Windows endpoints can receive policy updates and send telemetry to the Cortex XDR management console. The environment uses a proxy for internet access. Where should the administrator configure the proxy settings for the agents?

Question 19mediummulti select
Read the full Endpoint Security explanation →

A Cortex XDR administrator is preparing to onboard a new set of macOS endpoints into the environment. The administrator wants to verify that the agent has the necessary system permissions to monitor process activity and network connections on macOS. Which TWO macOS privacy permissions must the Cortex XDR agent be granted to provide full endpoint visibility? (Choose two.)

Question 20hardmulti select
Read the full Endpoint Security explanation →

A Cortex XDR administrator is configuring a new Malware Protection profile for a group of Windows servers that run a proprietary line-of-business application. The application's vendor has confirmed that a specific DLL it loads is unsigned and is frequently flagged by reputation services, causing the application to fail at startup. The administrator needs to allow this application to run while keeping protection enabled for all other software. Which TWO configuration actions should the administrator take in the Malware Protection profile? (Choose two.)

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Endpoint Security sessions

Start a Endpoint Security only practice session

Every question in these sessions is drawn from the Endpoint Security domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Endpoint Security questions →Mixed Cybersecurity-Practitioner session

Related practice questions

Related Cybersecurity-Practitioner topic practice pages

Move into related areas when this topic feels solid.

Network Security practice questions

Sharpen your Cybersecurity-Practitioner knowledge of Network Security.

Cybersecurity Fundamentals practice questions

Cybersecurity Fundamentals practice questions for Cybersecurity-Practitioner.

Cloud Security practice questions

Work through Cybersecurity-Practitioner questions on Cloud Security.

Endpoint Security practice questions

Work through Cybersecurity-Practitioner questions on Endpoint Security.

SOC Operations practice questions

Targeted Cybersecurity-Practitioner practice covering SOC Operations.

Cybersecurity-Practitioner fundamentals practice questions

Work through Cybersecurity-Practitioner questions on Cybersecurity-Practitioner fundamentals.

Cybersecurity-Practitioner scenario practice questions

Practise Cybersecurity-Practitioner questions linked to Cybersecurity-Practitioner scenario.

Cybersecurity-Practitioner troubleshooting practice questions

Cybersecurity-Practitioner troubleshooting practice questions for Cybersecurity-Practitioner.

Frequently asked questions

What does the Cybersecurity-Practitioner exam test about Endpoint Security?
Be able to deploy Cortex XDR agents through a forward proxy, apply hash-based blocking to stop a known-malicious executable, and create targeted exclusions that suppress false-positive alerts without weakening endpoint protection. The single most important thing is matching the control to the exact indicator given, such as SHA-256 versus filename.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Endpoint Security questions in a focused session?
Yes — the session launcher on this page draws every question from the Endpoint Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other Cybersecurity-Practitioner topics?
Use the topic links above to move to related areas, or go back to the Cybersecurity-Practitioner question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the Cybersecurity-Practitioner exam covers. They are not copied from any real exam or dump site.