4.2 Identify and Validate the Impact of Agent Operational States XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security administrator is planning to decommission a server that is no longer needed. The server has a Cortex XDR agent installed and is currently 'Connected'. What is the recommended action for the agent before the server is decommissioned?

   • AReinstall the agent to ensure it is clean before decommissioning.
   • BLeave the agent installed and connected, as it will automatically stop sending telemetry when the server is decommissioned.
   • CDisable the agent to prevent it from sending telemetry after the server is decommissioned.
   • DUninstall the agent from the server before decommissioning it.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is troubleshooting a Cortex XDR agent that is showing as 'Disconnected' in the console. The analyst has confirmed that the endpoint is online, the agent service is running, and the network path to the Cortex XDR cloud is functional. The agent log shows no errors. What is the most likely cause of the 'Disconnected' state?

   • AThe agent's local cache is full, preventing it from sending heartbeats to the backend.
   • BThe agent is in a 'Disabled' state but the console is not reflecting it correctly.
   • CThe agent's configuration file is corrupted, preventing it from connecting to the correct tenant.
   • DThe agent's certificate has expired, preventing it from authenticating to the Cortex XDR backend.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What does the 'Disabled' operational state of an agent indicate?

   • AThe agent is updating its definitions
   • BThe agent is temporarily unable to communicate with the cloud
   • CThe agent is actively protecting the endpoint but not sending logs
   • DThe agent is intentionally turned off and not providing protection
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   If an agent is unexpectedly 'Disabled', what corrective action should an administrator take?

   • ARestart the endpoint
   • BEnable the agent from the Cortex XDR console
   • CCheck the network connection
   • DReinstall the agent on the endpoint
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary security impact of an agent being in a 'Disconnected' state?

   • AThe endpoint is fully protected but not reporting to the cloud
   • BThe endpoint is protected by a fallback local policy
   • CThe endpoint loses visibility and may not receive policy updates
   • DThe endpoint is immediately quarantined from the network
   Reveal Solution Discussion Select an answer first