An organization is experiencing a ransomware attack that is encrypting files on multiple endpoints. The security team wants to stop the attack as quickly as possible while preserving evidence for later analysis. Which response action should the team take first?

Isolate the affected endpoints from the network

Terminate the ransomware process on all endpoints

Delete the ransomware files from the endpoints

A company is considering deploying Cortex XDR to replace its legacy antivirus solution. The security team wants to understand the key benefit of Cortex XDR over traditional antivirus. Which statement best describes this benefit?

Cortex XDR is a firewall that also provides antivirus protection

Cortex XDR only works with Palo Alto Networks firewalls

Cortex XDR is a cloud access security broker (CASB)

Cortex XDR provides extended detection and response capabilities that go beyond signature-based detection

A company wants to use Cortex XDR to detect threats that involve both endpoint activity and network traffic. The company has a Palo Alto Networks firewall. Which data source should the company integrate with Cortex XDR to achieve this?

The firewall's firmware version

The firewall's user authentication logs

The firewall's configuration backup

A security team notices that a legitimate application is being used in an unusual way by an attacker to execute commands. The behavior is not covered by any existing signature. Which Cortex XDR detection method is most likely to identify this activity?

IOC matching against known malicious indicators

WildFire analysis of the application's executable

Behavioral analytics that detect deviations from normal application usage

Signature-based detection that matches known attack patterns

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 5Objective 7

5.7 Explain the Features and Functionality of Cortex XDR CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Part of the Endpoint Security domain, which accounts for 15% of the CYBERSECURITY-PRACTITIONER exam.

26questions here

6free pages

5concepts

15%of the exam

Questions 1–5

1expert · hard
An organization is experiencing a ransomware attack that is encrypting files on multiple endpoints. The security team wants to stop the attack as quickly as possible while preserving evidence for later analysis. Which response action should the team take first?
Select an answer first
2application · medium
A company is considering deploying Cortex XDR to replace its legacy antivirus solution. The security team wants to understand the key benefit of Cortex XDR over traditional antivirus. Which statement best describes this benefit?
Select an answer first
3foundation · easy
Which Palo Alto Networks product can be integrated with Cortex XDR to share threat intelligence?
Select an answer first
4application · medium
A company wants to use Cortex XDR to detect threats that involve both endpoint activity and network traffic. The company has a Palo Alto Networks firewall. Which data source should the company integrate with Cortex XDR to achieve this?
Select an answer first
5application · medium
A security team notices that a legitimate application is being used in an unusual way by an attacker to execute commands. The behavior is not covered by any existing signature. Which Cortex XDR detection method is most likely to identify this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.