3.2 Explain the Process of Agent Management and Deployment, Including Cloud Workloads SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst notices that several endpoints are showing a 'disconnected' status in the Cortex XDR console. What is the first step the analyst should take to troubleshoot this issue?

   • AUninstall and reinstall the agent on the affected endpoints.
   • BCheck the endpoint's local agent logs for any errors.
   • CVerify that the agent version is up to date and upgrade if necessary.
   • DCheck the network connectivity between the endpoints and the Cortex XDR cloud service.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An administrator needs to install the Cortex XDR agent on a single Windows workstation that is not managed by any enterprise deployment tool. Which deployment method is most appropriate?

   • AManual installation using the downloaded installer
   • BContainer deployment using a Docker image
   • CGroup deployment using a GPO
   • DMass deployment via a software distribution tool
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A security architect is planning to deploy the Cortex XDR agent on a fleet of Windows Server 2012 R2 VMs in a cloud environment. The VMs are not domain-joined and are used for a legacy application. The architect wants to minimize the risk of deployment failure. What should the architect do?

   • ADeploy the agent using the latest version available, assuming it supports all Windows versions.
   • BUse a container deployment method instead, because the agent is not supported on Windows Server 2012 R2.
   • CDeploy the agent using a mass deployment tool, which automatically handles compatibility by installing the appropriate version.
   • DVerify that Windows Server 2012 R2 is still a supported platform for the agent version they plan to deploy, and check the agent's system requirements for any specific prerequisites.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security team is upgrading the Cortex XDR agent on a large number of endpoints. They want to minimize the risk of a failed upgrade that could leave endpoints unprotected. What is the best practice for performing the upgrade?

   • AUpgrade the endpoints that are most critical first, and then upgrade the rest.
   • BUninstall the agent from all endpoints and then reinstall the new version to ensure a clean installation.
   • CUpgrade all endpoints at once to ensure consistency and minimize the time required.
   • DUpgrade a small pilot group first, monitor the results, and then gradually roll out to the rest of the endpoints.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Cortex XDR console, which status indicates that an agent is installed and actively communicating with the cloud?

   • AConnected
   • BPending
   • CUninstalled
   • DDisconnected
   Reveal Solution Discussion Select an answer first