A security team is investigating a series of endpoint crashes. The crashes occur when users open documents from an external source. Analysis shows the documents contain embedded objects that attempt to execute code in the context of the application. Which prevention profile component should be enabled to block this attack?

Exploit prevention with code injection protection

Vulnerability protection with virtual patching

Malware prevention with file reputation

Zero-day protection with behavioral analysis

How does malware prevention primarily detect known malicious files?

By using signature-based detection and behavioral analysis

By analyzing network traffic for command-and-control communication

By monitoring user login attempts

By blocking all executable files from running

What type of attack does exploit prevention primarily protect against?

Memory corruption and code injection

Credential theft via keylogging

What is the main characteristic of a zero-day threat that makes it difficult to detect?

It has no known signature or patch

It uses encryption to hide its communication

It is only delivered via USB drives

It always targets cloud services

Where in the XDR console would you configure prevention and extension policies?

Under the Endpoint Security Management section

Under the User Management section

Under the Data Loss Prevention section

Under the Network Security section

Palo Alto NetworksCertified XDR Analyst

Domain 4Objective 1

4.1 Demonstrate Understanding of Endpoint Prevention and Extension Profiles and Policies XDR-ANALYST Practice Questions (Page 2)

Part of the Endpoint Security Management domain, which accounts for 15% of the XDR-ANALYST exam.

33questions here

7free pages

11concepts

15%of the exam

Questions 6–10

6application · medium
A security team is investigating a series of endpoint crashes. The crashes occur when users open documents from an external source. Analysis shows the documents contain embedded objects that attempt to execute code in the context of the application. Which prevention profile component should be enabled to block this attack?
Select an answer first
7foundation · easy
How does malware prevention primarily detect known malicious files?
Select an answer first
8foundation · easy
What type of attack does exploit prevention primarily protect against?
Select an answer first
9foundation · easy
What is the main characteristic of a zero-day threat that makes it difficult to detect?
Select an answer first
10foundation · easy
Where in the XDR console would you configure prevention and extension policies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.