A company runs a legacy line-of-business application that has a known remote code execution vulnerability. The vendor has not yet released a patch, and the application cannot be taken offline. The security team wants to reduce the risk of exploitation while the patch is pending. Which prevention profile capability should they use?

Enable vulnerability protection with virtual patching

Enable exploit prevention with shellcode detection

Enable zero-day protection with machine learning

Enable malware prevention with behavioral analysis

A security analyst is reviewing the endpoint prevention profile assigned to a group of servers. The profile includes malware prevention, exploit prevention, and vulnerability protection. The analyst wants to understand what each component does. Which statement accurately describes the purpose of the prevention profile components?

All three components use the same detection method and are interchangeable

Malware prevention blocks malicious files, exploit prevention blocks memory corruption, and vulnerability protection shields against known software flaws

Malware prevention shields against known software flaws, exploit prevention blocks malicious files, and vulnerability protection blocks memory corruption

Malware prevention blocks memory corruption, exploit prevention blocks malicious files, and vulnerability protection blocks unknown threats

What is the role of extension profiles in endpoint security?

To configure network routing on endpoints

To manage user permissions for the XDR console

To extend the security capabilities of endpoints beyond the built-in protections

To replace the need for endpoint prevention profiles

A company wants to extend its endpoint security beyond the built-in prevention profiles. They need to enforce a custom rule that blocks a specific application from executing on all endpoints. Which approach should they use?

Create a new policy that directly references the application without an extension profile

Use the zero-day protection profile to block the application

Modify the built-in malware prevention profile to include the application block

Create a custom extension profile and apply it to endpoints via a policy

What is the primary goal of vulnerability protection on endpoints?

To encrypt data at rest on the endpoint

To automatically apply operating system patches

To monitor user activity for insider threats

To prevent exploitation of known software vulnerabilities

Palo Alto NetworksCertified XDR Analyst

Domain 4Objective 1

4.1 Demonstrate Understanding of Endpoint Prevention and Extension Profiles and Policies XDR-ANALYST Practice Questions (Page 4)

Part of the Endpoint Security Management domain, which accounts for 15% of the XDR-ANALYST exam.

33questions here

7free pages

11concepts

15%of the exam

Questions 16–20

16application · medium
A company runs a legacy line-of-business application that has a known remote code execution vulnerability. The vendor has not yet released a patch, and the application cannot be taken offline. The security team wants to reduce the risk of exploitation while the patch is pending. Which prevention profile capability should they use?
Select an answer first
17application · medium
A security analyst is reviewing the endpoint prevention profile assigned to a group of servers. The profile includes malware prevention, exploit prevention, and vulnerability protection. The analyst wants to understand what each component does. Which statement accurately describes the purpose of the prevention profile components?
Select an answer first
18foundation · easy
What is the role of extension profiles in endpoint security?
Select an answer first
19application · medium
A company wants to extend its endpoint security beyond the built-in prevention profiles. They need to enforce a custom rule that blocks a specific application from executing on all endpoints. Which approach should they use?
Select an answer first
20foundation · easy
What is the primary goal of vulnerability protection on endpoints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.

4.1 Demonstrate Understanding of Endpoint Prevention and Extension Profiles and Policies XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

What is the role of extension profiles in endpoint security?

A company wants to extend its endpoint security beyond the built-in prevention profiles. They need to enforce a custom rule that blocks a specific application from executing on all endpoints. Which approach should they use?

What is the primary goal of vulnerability protection on endpoints?

Keep studying — Endpoint Security Management