4.3 Identify and Validate the Impact of Agent Version and Content Update XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is investigating a potential security incident. The team needs to determine if a specific endpoint was running a vulnerable agent version at the time of the incident. The endpoint has since been upgraded. Where can the team find historical agent version information?

   • AIn the Endpoints page, view the current Agent Version field.
   • BCheck the installation logs on the endpoint to see the original version.
   • CReview the firewall logs to see the agent version used during the incident.
   • DIn the Cortex XDR console, view the endpoint's audit log or event history, which may record agent version changes.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization has a critical server that cannot be rebooted during business hours. The server is running an older agent version that is missing a critical security feature. The security team needs to enable this feature but cannot afford downtime. What is the most appropriate action?

   • ASchedule the agent upgrade during the next maintenance window, as agent upgrades typically require a reboot.
   • BDisable the agent on the server until the upgrade can be performed.
   • CEnable the feature through a content update, as content updates can enable new features.
   • DUpgrade the agent immediately, as agent upgrades do not require a reboot.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is documenting the environment and needs to record the agent version for a specific endpoint. The analyst has the endpoint's hostname. What is the quickest way to find this information in the Cortex XDR console?

   • AGo to the Settings > Agent > Installation Packages page and find the hostname in the deployment list.
   • BUse the search bar in the Endpoints page, type the hostname, and view the Agent Version in the results.
   • CAccess the endpoint remotely and run a command to query the agent version.
   • DNavigate to the Alerts page and search for alerts from that hostname to find the agent version.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise is planning to upgrade its Cortex XDR management platform. The security team has identified that some endpoints are running an agent version that is no longer supported by the new platform. The team must ensure all endpoints are compatible before the upgrade window. However, the team also wants to minimize the number of endpoints that need to be upgraded. What is the most effective approach?

   • AUpgrade the platform first and then address any endpoints that fail to connect.
   • BIdentify the minimum agent version required for the new platform, then use the Endpoints page to filter for endpoints below that version and upgrade only those.
   • CUpgrade all endpoints to the latest agent version to ensure full compatibility and feature availability.
   • DPostpone the platform upgrade until all endpoints are running the latest agent version.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating why a specific endpoint failed to detect a new ransomware variant. The analyst verifies that the agent version is current. What should the analyst check next to determine if the content update is the issue?

   • AReview the endpoint's firewall logs to see if the ransomware was blocked at the network level.
   • BCheck the agent's installation date to see if it was installed before the ransomware variant was discovered.
   • CCheck the Content Version field in the endpoint details and compare it with the latest available content version.
   • DReboot the endpoint to ensure the agent is running correctly.
   Reveal Solution Discussion Select an answer first