A security operations center (SOC) wants to detect threats that span multiple attack surfaces, such as an email attachment that leads to a malicious network connection and then to a cloud resource. Which solution is best suited for this cross-layer visibility?

A cloud access security broker (CASB)

A network intrusion detection system (NIDS)

How does EDR support incident response during a confirmed endpoint compromise?

By reconfiguring the firewall to block all inbound traffic

By deleting the user's profile to remove the threat

By automatically patching the vulnerability that was exploited

By isolating the affected endpoint and providing forensic data for investigation

A company wants to detect attacks that start with a phishing email, then use a malicious link to download malware on an endpoint, and finally exfiltrate data to a cloud service. Which solution is best suited to detect this entire attack chain?

A web application firewall (WAF)

A data loss prevention (DLP) tool

What is the primary purpose of endpoint detection and response (EDR) in an organization's security strategy?

To manage software patches and updates across all endpoints in the organization

To replace traditional antivirus with a signature-based scanner that blocks known malware

To continuously monitor endpoint activity, detect suspicious behavior, and enable investigation and response to threats

To enforce network segmentation policies by analyzing traffic between endpoints and servers

What is the primary scope of extended detection and response (XDR) compared to EDR?

XDR focuses only on endpoint devices, while EDR covers the entire network

XDR extends beyond endpoints to include network, cloud, and email security layers

XDR only handles email security, while EDR handles all other threats

XDR is limited to cloud workloads, while EDR covers on-premises endpoints

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 5Objective 4

5.4 Explain Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Part of the Endpoint Security domain, which accounts for 15% of the CYBERSECURITY-PRACTITIONER exam.

29questions here

6free pages

7concepts

15%of the exam

Questions 16–20

16application · medium
A security operations center (SOC) wants to detect threats that span multiple attack surfaces, such as an email attachment that leads to a malicious network connection and then to a cloud resource. Which solution is best suited for this cross-layer visibility?
Select an answer first
17foundation · easy
How does EDR support incident response during a confirmed endpoint compromise?
Select an answer first
18application · medium
A company wants to detect attacks that start with a phishing email, then use a malicious link to download malware on an endpoint, and finally exfiltrate data to a cloud service. Which solution is best suited to detect this entire attack chain?
Select an answer first
19foundation · easy
What is the primary purpose of endpoint detection and response (EDR) in an organization's security strategy?
Select an answer first
20foundation · easy
What is the primary scope of extended detection and response (XDR) compared to EDR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.