2.1 Configure Endpoint Prevention Profiles and Policies XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When configuring prevention profiles, what should an administrator consider to minimize operational impact?

   • AThe cost of the Cortex XDR license
   • BThe geographic location of the endpoints
   • CThe number of endpoints that will receive the profile
   • DThe potential for false positives that could block legitimate applications
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is configuring a new prevention profile for a fleet of point-of-sale (POS) terminals that run a single, well-known application. The terminals are in a highly regulated environment and must remain available during business hours. What is the recommended approach for the prevention profile settings?

   • ADisable all prevention modules on the POS terminals because the application is well-known and trusted.
   • BEnable all prevention modules at their most aggressive settings and rely on the application vendor to fix any compatibility issues.
   • CUse the same aggressive profile as the rest of the organization because the POS terminals are managed endpoints.
   • DStart with a conservative profile, enable the most critical prevention modules, and test the POS application in a staging environment before rolling out to production.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security administrator is creating a new prevention profile for a group of Windows workstations. The administrator wants to ensure that the profile blocks known malware, prevents exploit attempts, and detects malicious network traffic. Which settings should the administrator configure in the prevention profile?

   • AEnable malware protection and firewall rules, and configure device control.
   • BEnable malware protection, exploit protection, and network threat protection.
   • CEnable exploit protection and script execution control, and configure data loss prevention.
   • DEnable malware protection and network threat protection, and configure USB device control.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator is reviewing the components of an endpoint prevention profile in Cortex XDR. The administrator wants to ensure that the profile includes protections against malware, exploits, and malicious network activity. Which components should the administrator verify are present in the prevention profile?

   • AMalware protection, exploit protection, and network threat protection.
   • BExploit protection, application control, and data loss prevention.
   • CMalware protection, script execution control, and USB device control.
   • DMalware protection, firewall rules, and device control.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team manages a large environment with a hierarchical policy structure. The global policy assigns a standard prevention profile to all endpoints. A regional policy for the APAC region overrides the malware protection setting to be less aggressive. A local policy for the Singapore office overrides the malware protection setting to be more aggressive than the global standard. What is the effective malware protection setting for an endpoint in the Singapore office?

   • AThe Singapore local setting, because the local policy is the most specific and its override takes precedence.
   • BThe most aggressive setting among all policies, because Cortex XDR always applies the highest protection level.
   • CThe APAC regional setting, because the regional policy is more specific than the global policy.
   • DThe global standard setting, because the global policy is the highest priority.
   Reveal Solution Discussion Select an answer first