4.3 Identify and Validate the Impact of Agent Version and Content Update XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An auditor requires proof that all endpoints in a specific group are running a minimum agent version and have a content update that is not older than 30 days. What is the most efficient way to provide this evidence?

   • AExport the firewall logs for the group and highlight the agent versions.
   • BTake screenshots of each endpoint's details page in the console.
   • CGenerate a report from the Cortex XDR console that includes the Agent Version and Content Release Date for the endpoint group.
   • DProvide a list of the agent installation packages that were deployed to the group.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is troubleshooting an endpoint that is not receiving content updates. The analyst confirms that the agent version is current and the endpoint has network connectivity. What is the most likely cause of the content update failure?

   • AThe content update is already installed, and the endpoint is waiting for the next update.
   • BThe endpoint's operating system is not supported by the agent.
   • CThe content update service is not reachable from the endpoint due to a firewall or proxy configuration.
   • DThe agent version is too old to support the latest content update format.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An organization is running an older agent version on some endpoints. Which of the following is a potential impact of using an outdated agent version?

   • AThe agent will stop sending any data to the management console
   • BThe agent may not support the latest features and may have compatibility issues with the management platform
   • CThe agent will automatically uninstall itself if the version is too old
   • DThe agent will become completely non-functional and unable to provide any protection
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst notices that a specific endpoint is not detecting a known malware strain that other endpoints are detecting. The analyst confirms the agent version is the same across all endpoints. What is the most likely cause of this discrepancy?

   • AThe endpoint is running a different operating system that is not supported by the agent.
   • BThe endpoint's firewall is blocking the content update downloads.
   • CThe endpoint's agent version is too new and is incompatible with the management platform.
   • DThe endpoint has an outdated content update version that does not include the signature for this malware strain.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An analyst is troubleshooting an endpoint issue and needs to confirm the exact agent version installed. Which of the following is the most direct method to identify the agent version on the endpoint itself?

   • AOpen the Task Manager and look under the 'Performance' tab
   • BRun the 'ipconfig' command and look for the agent version in the output
   • CCheck the Windows Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\Cortex XDR
   • DUse the 'ping' command to query the agent version from the management server
   Reveal Solution Discussion Select an answer first