What determines which extension profile is applied to a specific endpoint?

The version of the endpoint's operating system

The user's role in the XDR console

The policy that matches the endpoint's attributes

A company has a policy that blocks all USB devices for the finance department. A new policy is created that allows USB devices for the CFO, who is in the finance department. The administrator wants the CFO to be able to use USB devices, but the block policy is listed first. What should the administrator do to achieve the desired outcome?

Delete the block policy and create a new one that excludes the CFO

Move the block policy above the allow policy

Apply the allow policy directly to the CFO's endpoint

Move the allow policy above the block policy

A security analyst notices that several endpoints are crashing after users visit a popular news website. Investigation reveals the website is serving a JavaScript exploit that attempts to write outside the browser's allocated memory. Which prevention profile component would directly block this attack?

Exploit prevention with memory corruption protection

Zero-day protection with behavioral analysis

Vulnerability protection with virtual patching

Malware prevention with file signature blocking

What is a key consideration when configuring a custom extension profile?

It should align with the organization's specific security requirements

It must be based on a predefined template

It must include all default prevention settings

It can only be applied to a single endpoint

Palo Alto NetworksCertified XDR Analyst

Domain 4Objective 1

4.1 Demonstrate Understanding of Endpoint Prevention and Extension Profiles and Policies XDR-ANALYST Practice Questions (Page 5)

Part of the Endpoint Security Management domain, which accounts for 15% of the XDR-ANALYST exam.

33questions here

7free pages

11concepts

15%of the exam

Questions 21–25

21foundation · easy
What determines which extension profile is applied to a specific endpoint?
Select an answer first
22expert · hard
A company has a policy that blocks all USB devices for the finance department. A new policy is created that allows USB devices for the CFO, who is in the finance department. The administrator wants the CFO to be able to use USB devices, but the block policy is listed first. What should the administrator do to achieve the desired outcome?
Select an answer first
23application · medium
A security analyst notices that several endpoints are crashing after users visit a popular news website. Investigation reveals the website is serving a JavaScript exploit that attempts to write outside the browser's allocated memory. Which prevention profile component would directly block this attack?
Select an answer first
24foundation · easy
What is a key consideration when configuring a custom extension profile?
Select an answer first
25foundation · easy
Which of the following is a component typically found within an endpoint prevention profile?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.

4.1 Demonstrate Understanding of Endpoint Prevention and Extension Profiles and Policies XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

What determines which extension profile is applied to a specific endpoint?

What is a key consideration when configuring a custom extension profile?

Which of the following is a component typically found within an endpoint prevention profile?

Keep studying — Endpoint Security Management