4.2 Identify and Validate the Impact of Agent Operational States XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An agent is showing as 'Disconnected' in the Cortex XDR console. What is the most likely cause to investigate first?

   • AThe agent is updating
   • BThe agent has been disabled by an administrator
   • CThe endpoint has been powered off
   • DNetwork connectivity issues between the endpoint and the cloud
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which agent operational state indicates that the endpoint is actively communicating with the Cortex XDR cloud and is fully functional?

   • AConnected
   • BDisabled
   • CDisconnected
   • DUninstalled
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) analyst is reviewing the endpoint list in Cortex XDR and notices that a group of servers has been in a 'Disconnected' state for over 24 hours. The servers are still running and accessible. What is the most immediate security impact of this operational state?

   • AThe endpoints will automatically quarantine themselves from the network to prevent the spread of malware.
   • BThe endpoints are completely unprotected and cannot detect or prevent any local threats.
   • CThe endpoints are not receiving new prevention policies or content updates from Cortex XDR.
   • DThe endpoints will continue to function normally, and the only impact is a lack of real-time alerts.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the most direct way to validate the operational state of an agent on a specific endpoint?

   • ACheck the agent status in the Cortex XDR console
   • BReview the endpoint's event logs
   • CPing the endpoint from another machine
   • DRun a vulnerability scan
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is validating the operational state of agents on a fleet of remote laptops. The console shows all agents as 'Connected', but the analyst suspects that some agents may be 'zombie' agents that are connected but not actually enforcing policies. Which validation method would best confirm that an agent is actively enforcing policies?

   • AReview the agent's installation date to ensure it was deployed recently.
   • BCheck the agent's local log for any policy enforcement errors.
   • CVerify that the agent's service is running on each remote laptop.
   • DCheck the console for the agent's last policy sync timestamp.
   Reveal Solution Discussion Select an answer first