CCNA Endpoint Security Management Questions

Where the proxy demands authentication, the agent must present valid credentials to complete the CONNECT request. Supplying them satisfies the stem, as an unauthenticated agent is rejected by the proxy even when the address and port are correct.

Local administrative privileges are required because the Cortex XDR agent installs kernel-level drivers and services on both Windows and macOS. Without elevation, installation fails or the agent runs with degraded protection, so this prerequisite directly satisfies the stem's requirement for successful deployment and full functionality.

This is correct because agent password protection requires a password to uninstall the agent or stop its service. It prevents unauthorized users and malware from disabling endpoint protection. The administrator sets this password in the agent configuration profile, and it is enforced on the endpoint.

The endpoint detail view in the Cortex XSIAM Endpoints page exposes the agent's connection state, version, and Last Seen timestamp, which directly confirms whether the agent has recently checked in. This is the supported way to verify communication status without logging into the endpoint, and it aligns with the reported 'Disconnected' status.

A Cortex XDR exception scoped to the initiating process hash plus the target registry path suppresses only that installer's registry write, leaving Behavioral Threat Protection enabled for all other registry activity across endpoints. This satisfies the requirement to suppress one alert without disabling the module.

Targeted path and process exclusions narrow the agent's file-system scanning to only the compilation workloads, cutting CPU overhead while leaving all other malware prevention intact. This satisfies the stem's constraint of reducing resource utilisation without disabling threat prevention entirely.

Causality Analysis View traces the investigated process's effects, including file modifications and registry changes it performed, revealing persistence and system tampering. These artifacts satisfy the stem's requirement by exposing the full scope of potential compromise beyond the initial alert trigger.

Password protection restricts who can stop, uninstall, or modify the agent. Setting a strong password means end users and malware cannot silently terminate protection from the tray or command line, directly satisfying the requirement. It is the purpose-built control for preventing unauthorized tampering with the agent on managed endpoints.

The Causality Analysis View sits within the Incident Viewer, under Alert Details, where the process tree and causality chain for a single endpoint alert are rendered. This satisfies the analyst's need to inspect the specific alert's originating process lineage rather than raw telemetry.

The Malware Protection Profile is a configurable prevention profile governing antivirus and malicious file blocking, assignable to endpoint groups. It satisfies the requirement by defining how XSIAM detects and prevents malware execution on managed endpoints.

Tags and endpoint groups are first-class scoping attributes in Cortex XSIAM policy rules. Administrators can assign servers to a group or tag and then build a rule that applies the policy only to that group, which cleanly targets the intended fleet without affecting other endpoints.

Endpoint profiles are pulled by agents on a scheduled polling interval rather than pushed instantly. Until each POS terminal completes its next poll to the XSIAM cloud, it retains the previous policy, explaining the delay in reflecting the newly assigned profile.

Hash-based allowlisting lets the administrator permit specific known-good custom binaries while keeping malware protection in blocking mode for everything else. This preserves strong protection across the workstation fleet and avoids disrupting builds, because only the explicitly approved artifacts are exempted from blocking.

This is correct because the XSIAM management console provides an Upgrade Agent action that performs an in-place, rebootless upgrade on selected endpoints. It replaces the agent binary while preserving the endpoint's existing configuration and protection state, and it does not require the administrator to manually uninstall the old agent first.

A file-hash or signed-certificate exception targets only the verified script, satisfying the requirement to stop repeated blocks without weakening protection for other scripts. Hash exceptions match the exact binary, while certificate exceptions trust anything signed by that publisher, so choose the hash for tighter scope.

Kernel Control Module (KCM) is the XSIAM endpoint security feature that enforces kernel-level driver load policies. It can block known vulnerable or malicious drivers from loading while allowing approved drivers. By creating a KCM policy that denies the specific driver, the analyst prevents the attacker from disabling the agent's kernel protection without affecting the legitimate application that uses a different, approved driver.

The Endpoint Management page in XSIAM displays all registered endpoints with their current status, last check-in time, and agent version. Filtering by hostname allows the analyst to quickly confirm whether the agent is registered, online, and reporting. If the last check-in is stale, the issue is likely agent-server communication, and further troubleshooting can proceed from there.

The endpoint asset inventory tracks the installed Cortex XDR agent version, letting administrators confirm endpoints run supported, current builds. This satisfies the stem's continuous posture-monitoring requirement by surfacing outdated agents as a compliance and coverage risk.

Agent Self-Protection blocks attempts to stop, kill, or tamper with the Cortex XDR agent service and processes, including through the Windows Services console. It does not interfere with legitimate uninstall operations that supply the correct uninstall password, so it satisfies both requirements: users cannot stop the service, but administrators can still remove the agent.

Endpoint Isolation in XSIAM allows an analyst to remotely isolate a compromised endpoint from the network while maintaining communication with the XSIAM management console. Enabling this capability in the agent configuration and assigning it to endpoint groups ensures that isolation can be initiated when a threat is detected. It is a core response action that meets the requirement for network isolation.

Full Disk Access allows the agent to read protected locations such as user data, mail stores, and system caches that are otherwise shielded by macOS privacy controls. Malware often hides in these areas, so without Full Disk Access the agent's scanning and telemetry would be incomplete and detections would be missed.

Excluding the specific high-churn directory from malware scanning prevents the agent from repeatedly inspecting files that change constantly, cutting CPU overhead while leaving protection active across the rest of the server. This is a targeted tuning measure that addresses the identified cause without broadly weakening endpoint security.

Allowlisting the specific file hash in the malware profile scopes the exception to that known-good binary while leaving all other malware protection intact. This is the supported mechanism in XSIAM for trusted internal applications and directly prevents repeated local analysis false positives without weakening protection for the rest of the endpoint group.

When an endpoint is online but the agent shows Disconnected, the most direct first step is to inspect the agent's own diagnostic logs and confirm its service is running. These logs reveal DNS resolution failures, TLS handshake problems, proxy misconfiguration, or service crashes that network pings cannot expose, giving the analyst actionable evidence before any reconfiguration.

XSIAM does not auto-delete endpoints that stay disconnected beyond 30 days; they persist in the inventory with a disconnected status. Administrators decide whether to purge or retain them, applying their own retention policies, so audit visibility is preserved rather than silently lost.

XSIAM supports rolling an endpoint back to its prior agent version when an upgrade causes issues. Selecting the affected endpoints and invoking rollback restores the previous build without a full manual reinstall, which is exactly the safety net needed for a fleet-wide upgrade. It preserves management continuity and minimizes downtime.

The last seen timestamp and connection status on the Endpoints page directly indicate whether the agent has recently checked in with the tenant. A recent timestamp confirms communication and policy retrieval, making this the fastest and most reliable first check for agent connectivity.

The Endpoints inventory in XSIAM shows every registered endpoint along with its agent version, last check-in time, and connection state. This is the authoritative place to confirm registration and see when the endpoint last communicated, directly answering whether the agent is still managed.

The Endpoint Security > Assets view exposes a Disk Encryption column and tab aggregating BitLocker and FileVault status reported by managed endpoints. This lets the administrator confirm encryption is active and reporting correctly, satisfying the stem's compliance verification requirement.

Registration requires the agent to reach specific tenant service hostnames and ports. If a firewall or proxy blocks those destinations, the agent installs but its enrollment call fails silently, leaving the endpoint absent from the console. Confirming allowed egress, including proxy authentication, is essential to complete registration.

Scoping an exception to the exact path and command line of the legitimate backup script suppresses the false positives while leaving behavioral detection active for all other processes. This is the most precise mitigation and preserves protection against genuinely malicious activity on the server.

XQL Search queries the xdr_data dataset, letting the analyst filter on actor process (w3wp.exe) and action process (cmd.exe or powershell.exe) to return historical shell-spawn events. This satisfies the need for a forensic query across retained endpoint telemetry.

Cortex XDR agents can be configured to use a proxy for outbound communication. If the proxy requires authentication, the agent policy must include the proxy address, port, and credentials. Without correct credentials, the agent cannot establish a connection, leading to repeated disconnects. Verifying these settings is the first step to restore connectivity in this scenario.

The Cortex XDR agent on Linux relies on kernel modules for certain protection features. If there is a compatibility issue, the agent logs will contain specific errors about failing to load modules or unsupported kernel versions. Checking these logs is the most direct way to diagnose the problem and determine if a compatibility issue is causing the disconnection. This step is non-disruptive and provides actionable information.

Cortex XSIAM allows administrators to enable agent password protection through the agent configuration profile, requiring the password for uninstall or tamper actions. This directly prevents users from stopping or removing the agent without authorization and is the correct mechanism for the described requirement.

Since the service runs but no telemetry reaches XSIAM, the fault lies in the agent's outbound communication or internal buffering. Local agent logs record connection failures, queue overflows and backend errors, giving the specific diagnostic evidence needed to pinpoint why events are not streaming.

Path exclusions in the Linux Malware and Scan profile tell the agent to skip the custom mount directories, removing the I/O latency caused by scanning those database files. This satisfies the constraint of excluding specific mount points without disabling protection elsewhere.

Password protection for agent uninstallation is a specific setting in the Cortex XDR agent configuration profile. When enabled, it requires a password to uninstall the agent, preventing unauthorized removal. This directly addresses the requirement that local administrators cannot uninstall the agent without a password. The setting is found in the agent settings under 'Uninstall Protection' or similar, depending on the version.

Cortex XDR endpoint prevention modules include exploit and memory-based attack techniques, covering behaviours such as memory corruption and shellcode injection. These detections target exploitation attempts rather than file-based malware, giving analysts a distinct category for filtering alerts.

The XDR agent service can be restarted remotely from the XSIAM console via the endpoint's action menu, forcing the agent to reinitialise without local access. This satisfies the stem's requirement for agent troubleshooting and management actions performed directly from the console.

The Endpoint Management section under the Endpoints menu provides a list of all endpoints with the Cortex XDR agent installed. It displays the agent status (e.g., Connected, Disconnected, Unprotected) and version. Administrators can search for a specific endpoint by name or IP address and view detailed agent information. This is the primary location for managing and monitoring agent health.

The digital certificate signer identifies the publisher signing the application's binary, so exclusions scoped to that signer apply only to software from the trusted vendor. This satisfies the precision requirement, avoiding broad exclusions that would suppress detection of unrelated malicious behaviour.

The Assets inventory view exposes endpoint records with Operating System columns, letting the administrator filter and group by OS version. This directly satisfies the requirement to review all endpoints running outdated operating system versions for upgrade planning.

Scan exclusions in the malware profile tell the agent to skip real-time and on-demand scanning of specified paths, which directly reduces the file I/O overhead on the busy log directory. Scoping the exclusion to the endpoint group keeps protection intact for the rest of the fleet and addresses the performance impact.

The Cortex XSIAM Administrator Guide contains the official Cortex XDR agent installation requirements, including supported Windows versions and prerequisites. This is the authoritative source for confirming minimum OS requirements before a deployment, and it is maintained for the current agent release.

The Endpoint Management page shows the agent's current status, including whether it is running, stopped, or failed to start, along with the last check-in time. This information helps determine if the agent is completely down or intermittently failing. Combined with other data, it guides further troubleshooting steps.

XQL Search queries the file execution and hash datasets directly, letting the analyst retrieve the file's hash, execution context and characteristics across tenant telemetry, which satisfies the requirement to inspect the suspicious file's hash and reputation.

The Protection Status tab on an endpoint's detail page shows the agent version, the applied policy, and the status of each protection module such as behavioral threat protection and whether the endpoint is in blocking or report-only mode. This is the correct place to confirm the actual runtime protection state of a single endpoint.

Broker VM agent connectivity and app health are surfaced under Settings > Configurations > Broker VM, where the Agent Status and App Health views show whether internal endpoints are still checking in through the broker. This directly satisfies the stem's requirement to verify health and connectivity between the Broker VM and internal endpoints.

This action collects the agent's diagnostic logs and makes them available for download from the console, allowing the analyst to examine detection and operational details without accessing the endpoint directly. It is the intended way to retrieve logs for troubleshooting.

Password protection requires a password to uninstall the agent or stop its service, preventing unauthorized users or malware from disabling protection. This is a core self-protection feature that ensures only administrators with the password can perform these actions. It directly addresses the requirement to prevent tampering and is configurable per agent policy in XSIAM.

Agent version assignment is controlled through the Profile or Settings applied to an endpoint group. Assigning the new version only to the test group's profile deploys it there first, leaving other groups on the existing version until the rollout is validated.

Live Query uses osquery to execute targeted queries against an active endpoint and return results immediately, bypassing the delay inherent in scheduled telemetry ingestion. This directly satisfies the stem's requirement for real-time running process information without waiting for uploads.

This page lists all endpoints with their agent and content versions, allowing the analyst to filter for outdated content and identify vulnerable systems. It is the central inventory for agent health and update status, directly answering which endpoints lack current security content.

The XSIAM Endpoints page provides an action to enable a disabled agent. When an agent is disabled, either by an administrator or automatically due to a policy, selecting the endpoint and choosing 'Enable Agent' sends a command to the agent to resume normal operation and re-enable all protection features according to its assigned policy. This is the correct administrative action to restore protection.