Scenario practice questions

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Trap 1: Built-in capability to execute shell scripts on Linux servers

MSI packages are strictly for Windows environments and do not execute Linux shell scripts.

Trap 2: Automatic conversion of EXE payloads into macOS PKG files

MSI packages cannot be converted into macOS PKG files.

Trap 3: Exemption from all Windows User Account Control (UAC) prompts…

MSI installations still require administrative privileges and can trigger UAC prompts.

A
Standardized installation parameters and property passing (e.g., /qn, /norestart)
MSI packages adhere to Windows Installer standards, providing consistent switches and property arguments.
B
Built-in capability to execute shell scripts on Linux servers
Why wrong: MSI packages are strictly for Windows environments and do not execute Linux shell scripts.
C
Automatic conversion of EXE payloads into macOS PKG files
Why wrong: MSI packages cannot be converted into macOS PKG files.
D
Native support for application transforms (.MST files) for customization
MSI packages support MST files to customize installation properties without modifying the original installer.
E
Exemption from all Windows User Account Control (UAC) prompts without admin rights
Why wrong: MSI installations still require administrative privileges and can trigger UAC prompts.

Read the full network assurance explanation →

Question 2hardmultiple choice

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Trap 1: TCP port 389 and 636

Ports 389 and 636 are used for LDAP and LDAPS directory services.

Trap 2: TCP port 22 and 8080

SSH (port 22) and HTTP (port 8080) are not standard agent reporting ports.

Trap 3: UDP port 514

UDP port 514 is standard for syslog, not Cortex XDR agent telemetry.

A
TCP port 389 and 636
Why wrong: Ports 389 and 636 are used for LDAP and LDAPS directory services.
B
TCP port 22 and 8080
Why wrong: SSH (port 22) and HTTP (port 8080) are not standard agent reporting ports.
C
TCP port 443
Cortex XDR agents use HTTPS over TCP port 443 for all communications and telemetry reporting to the cloud tenant.
D
UDP port 514
Why wrong: UDP port 514 is standard for syslog, not Cortex XDR agent telemetry.

Question 3hardmulti select

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Trap 1: Reinstall the Cortex XDR Agent on all high-priority servers.

Reinstalling agents changes neither incident scoring logic nor priority algorithms.

Trap 2: Modify the Broker VM packet buffer size.

Buffer sizing affects network log throughput, not incident severity scoring.

A
Reinstall the Cortex XDR Agent on all high-priority servers.
Why wrong: Reinstalling agents changes neither incident scoring logic nor priority algorithms.
B
Modify the Broker VM packet buffer size.
Why wrong: Buffer sizing affects network log throughput, not incident severity scoring.
C
Create exceptions for known benign alerts to prevent them from inflating incident priority scores.
Suppressing false positives through exceptions prevents score inflation from noisy alerts.
D
Modify individual BIOC or Analytics alert severities to reflect their true operational impact.
Adjusting base alert severities directly affects the severity assigned to resulting incidents.
E
Configure Incident Scoring rules to adjust how individual alert weights contribute to overall incident severity.
Incident Scoring rules allow customizing the calculation of incident severity based on organizational risk.

Question 4hardmultiple choice

An administrator is troubleshooting a scenario where Cortex XDR incident causality chains appear broken or incomplete. Which local agent component or setting is primarily responsible for tracking process creation and parent-child lineage for causality analysis?

Trap 1: Local Syslog Forwarder

Syslog forwarders handle external log ingestion, not internal endpoint process lineage.

Trap 2: Agent GUI Application (Traps.exe)

Traps.exe is the user interface and notification tray, not the core telemetry collection driver.

Trap 3: Broker VM Parser Module

Broker VM parsers process raw logs at the network collection layer, not endpoint process trees.

A
Local Syslog Forwarder
Why wrong: Syslog forwarders handle external log ingestion, not internal endpoint process lineage.
B
Behavioral Threat Protection / Behavioral Monitoring driver
The behavioral monitoring driver tracks process relationships, injection, and execution lineage required for causality chains.
C
Agent GUI Application (Traps.exe)
Why wrong: Traps.exe is the user interface and notification tray, not the core telemetry collection driver.
D
Broker VM Parser Module
Why wrong: Broker VM parsers process raw logs at the network collection layer, not endpoint process trees.

Question 5hardmulti select

An administrator is planning the deployment of Cortex XDR agent tamper protection. Which TWO administrative actions or scenarios are protected against when tamper protection is enabled on endpoints? (Choose two)

Trap 1: Standard user printing jobs sent to network printers

Printing operations are unrelated to Cortex XDR tamper protection.

Trap 2: Normal operating system scheduled reboots initiated by the system…

Standard OS reboots do not trigger tamper protection mechanisms.

Trap 3: Standard automatic content updates pushed by the authorized Cortex…

Authorized cloud updates bypass tamper protection since they originate from the trusted management plane.

A
Standard user printing jobs sent to network printers
Why wrong: Printing operations are unrelated to Cortex XDR tamper protection.
B
Normal operating system scheduled reboots initiated by the system administrator
Why wrong: Standard OS reboots do not trigger tamper protection mechanisms.
C
Standard automatic content updates pushed by the authorized Cortex XDR cloud tenant
Why wrong: Authorized cloud updates bypass tamper protection since they originate from the trusted management plane.
D
Unauthorized deletion of Cortex XDR agent files, directories, or critical registry keys
Tamper protection safeguards agent files and registry entries from unauthorized modification or deletion.
E
Unauthorized attempts by local users or malware to stop or disable the Cortex XDR agent services
Tamper protection blocks unauthorized attempts to stop or disable agent services.