3.2 Explain the Process of Agent Management and Deployment, Including Cloud Workloads SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A company is deploying the Cortex XDR agent on cloud VMs that are ephemeral and frequently replaced. They want to ensure that the agent is installed automatically on new VMs and that the correct policy is applied based on the VM's role. What is the most efficient approach?

   • AUse a golden image with the agent pre-installed and then manually assign the policy after the VM is created.
   • BManually install the agent on each VM after it is provisioned and then manually assign the policy based on the VM's role.
   • CUse the Cortex XDR console's built-in deployment feature to install the agent on VMs by their IP address.
   • DUse a cloud-native provisioning tool (e.g., AWS CloudFormation, Azure Resource Manager) to install the agent during VM creation and tag the VM with its role, then use group mapping in the Cortex XDR console to assign policies based on the tag.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which console feature allows an administrator to view the overall health and connectivity status of all agents in the environment?

   • AThe Policy page
   • BThe Audit Log page
   • CThe Alerts page
   • DThe Endpoints page
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   For deploying the Cortex XDR agent on containerized workloads, which approach is commonly used?

   • AInstalling the agent on the container host and using a Kubernetes DaemonSet to ensure it runs on every node
   • BInstalling the agent directly inside each container image
   • CUsing a serverless function to deploy the agent on demand
   • DDeploying the agent as a sidecar container alongside the application
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security administrator wants to ensure that a specific group of endpoints has a more restrictive firewall policy than the rest of the organization. What is the correct way to achieve this in the Cortex XDR console?

   • AUse the 'override' feature on the default policy to apply different settings to the specific group.
   • BModify the default policy to include the restrictive settings, and then exclude the specific group from the default policy.
   • CManually configure the firewall settings on each endpoint in the specific group.
   • DCreate a new policy with the restrictive settings and assign it to the specific group.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is troubleshooting an issue where the Cortex XDR agent is not reporting to the console. The agent is running, but the status shows 'disconnected'. What should the team check first?

   • AReview the agent's local logs for any errors related to policy assignment.
   • BUninstall and reinstall the agent on the affected endpoint.
   • CCheck if the agent is running the latest version and upgrade if necessary.
   • DVerify that the agent can reach the Cortex XDR cloud service on the required ports.
   Reveal Solution Discussion Select an answer first