4.3 Identify and Validate the Impact of Agent Version and Content Update XDR-ANALYST Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A security analyst is investigating a breach where an endpoint failed to detect a known malware variant. The analyst finds that the endpoint's agent version is current, but the content update is three weeks old. The malware variant was discovered two weeks ago. What is the most likely reason the endpoint failed to detect the malware?

   • AThe malware variant is a zero-day that no content update can detect.
   • BThe content update is outdated and does not contain the signature for the malware variant.
   • CThe agent version is incompatible with the content update format.
   • DThe endpoint's firewall blocked the content update download.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the most likely consequence of an endpoint having an outdated content update?

   • AThe endpoint will lose all network connectivity
   • BThe endpoint will automatically reboot to apply the update
   • CThe endpoint may fail to detect or prevent recently discovered threats
   • DThe endpoint will become slower and consume more CPU
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   An organization is planning to upgrade its Cortex XDR management platform. The security team is concerned that some endpoints with older agent versions may not be compatible with the new platform. What is the best way to determine which endpoints need an agent upgrade before the platform upgrade?

   • AWait until after the platform upgrade and then check which endpoints are no longer reporting.
   • BCheck the content update version on each endpoint, as it determines platform compatibility.
   • CUpgrade all endpoints to the latest agent version before upgrading the platform to ensure compatibility.
   • DReview the Cortex XDR compatibility matrix to identify the minimum agent version required for the new platform, then compare it with the Agent Version field in the Endpoints page.
   Reveal Solution Discussion Select an answer first