4.2 Identify and Validate the Impact of Agent Operational States XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a policy that requires all endpoints to have the Cortex XDR agent enabled at all times. However, a group of servers is showing as 'Disabled' in the console. The administrator discovers that the agents were disabled by a previous administrator for maintenance and were never re-enabled. What is the most appropriate action to resolve this issue?

   • ACreate a new policy that allows the agents to remain disabled on these servers.
   • BLeave the agents disabled and document that they were disabled for maintenance.
   • CUninstall the agents from the affected servers and reinstall them to ensure a clean state.
   • DRe-enable the agents on the affected servers and verify that they are enforcing policies.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is validating the operational state of a newly deployed Cortex XDR agent on a test workstation. The console shows the agent as 'Connected'. Which additional step should the analyst take to fully validate that the agent is functioning correctly?

   • AReview the agent's version to ensure it is the latest release.
   • BVerify that the agent is sending telemetry by checking the console for recent events from the workstation.
   • CConfirm that the agent service is set to 'Automatic' startup type on the workstation.
   • DCheck the workstation's local event log for any agent installation errors.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst notices that a critical file server has not reported telemetry to Cortex XDR for the past 90 minutes. The agent service is running and the endpoint appears online. The analyst checks the Cortex XDR console and sees the agent listed as 'Disconnected'. Which action should the analyst take first to validate the current operational state?

   • AReboot the file server to force the agent to re-establish a connection to the Cortex XDR cloud.
   • BVerify the agent-to-Cortex XDR connectivity by checking the agent's local logs for recent successful heartbeat transmissions.
   • CUninstall and reinstall the Cortex XDR agent on the file server to reset its configuration.
   • DDisable and re-enable the agent from the Cortex XDR console to force a status refresh.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which interface in the Cortex XDR console allows you to view the operational state of agents on managed endpoints?

   • AInvestigation > Causality
   • BAlerts > Alert Management
   • CAdministration > Users
   • DEndpoint Management > Agents
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does a 'Disabled' agent affect the security posture of an endpoint?

   • AIt leaves the endpoint without active protection and visibility
   • BIt provides reduced protection but still blocks known malware
   • CIt has no impact because the cloud still protects the endpoint
   • DIt only affects visibility, not actual protection
   Reveal Solution Discussion Select an answer first