An administrator is creating an endpoint extension profile for a group of endpoints that run a legacy application requiring a specific script. What should the administrator do during profile creation to support this requirement?

Add the script to the profile's allowed extensions list

Disable the agent's behavioral threat detection

Set the profile to 'Monitor only' mode to observe the script

Create a separate endpoint group for the legacy application

A company has a 'Standard' endpoint extension profile that has been in use for six months. The security team wants to test a more restrictive version of the profile on a small pilot group before rolling it out to the entire company. What is the best way to do this?

Temporarily change the 'Standard' profile, test it, and then restore it from a backup.

Create a new profile from scratch with the restrictive settings and assign it to the pilot group.

Edit the 'Standard' profile to be more restrictive, assign it to the pilot group, and then revert the changes after testing.

Clone the 'Standard' profile, make the restrictive changes to the clone, and assign the clone to the pilot group.

Within an endpoint extension profile, what does the 'Block' action for an extension do?

Allows the extension to run only during business hours

Prevents the extension from executing on the endpoint

Quarantines the extension file on the endpoint

Logs the extension's activity without preventing execution

An administrator is managing endpoint extension profiles in Cortex XDR. They need to retire an old profile that is no longer needed. However, the profile is currently assigned to the 'Legacy' endpoint group, which still has active endpoints. What is the correct way to delete the profile without disrupting the endpoints?

Disable the profile in the console, wait for endpoints to check in, and then delete it.

Delete the profile directly; Cortex XDR will automatically revert the endpoints to the default profile.

Clone the old profile, delete the original, and then assign the clone to the 'Legacy' group.

First, assign a different profile to the 'Legacy' group, then delete the old profile.

What is the primary purpose of an endpoint extension profile in Cortex XDR agent configuration?

To set the frequency of agent-to-cloud communication for policy updates

To configure the network firewall rules applied to endpoint traffic

To specify which endpoint users are allowed to access the Cortex XDR console

To define which third-party applications and scripts the agent is allowed to execute on an endpoint

Palo Alto NetworksCertified XDR Engineer

Domain 2Objective 2

2.2 Configure Endpoint Extension Profiles and Policies XDR-ENGINEER Practice Questions (Page 2)

Part of the Cortex XDR Agent Configuration domain, which accounts for 22% of the XDR-ENGINEER exam.

17questions here

4free pages

6concepts

22%of the exam

Questions 6–10

6foundation · easy
An administrator is creating an endpoint extension profile for a group of endpoints that run a legacy application requiring a specific script. What should the administrator do during profile creation to support this requirement?
Select an answer first
7application · medium
A company has a 'Standard' endpoint extension profile that has been in use for six months. The security team wants to test a more restrictive version of the profile on a small pilot group before rolling it out to the entire company. What is the best way to do this?
Select an answer first
8foundation · easy
Within an endpoint extension profile, what does the 'Block' action for an extension do?
Select an answer first
9expert · medium
An administrator is managing endpoint extension profiles in Cortex XDR. They need to retire an old profile that is no longer needed. However, the profile is currently assigned to the 'Legacy' endpoint group, which still has active endpoints. What is the correct way to delete the profile without disrupting the endpoints?
Select an answer first
10foundation · easy
What is the primary purpose of an endpoint extension profile in Cortex XDR agent configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ENGINEER” is a trademark of its owner, used for identification only.