2.1 Configure Endpoint Prevention Profiles and Policies XDR-ENGINEER Practice Questions (Page 4)

Questions 16–18

1. 16foundation · easy

   What is a recommended best practice when configuring prevention profiles in Cortex XDR?

   • AEnable all prevention settings to the most aggressive level to maximize security
   • BStart with a baseline profile and adjust settings based on the endpoint's role and observed impact
   • CDisable prevention settings for endpoints with high performance requirements
   • DUse the same prevention profile for all endpoints regardless of their role
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When creating a new prevention profile in Cortex XDR, what is the first step an administrator must take?

   • ASelect the malware prevention engine version
   • BConfigure the exploit protection settings
   • CDefine the profile name and description
   • DAssign the profile to an endpoint policy
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   An administrator is creating a new prevention profile for a group of servers that host a custom web application. The application uses a non-standard port and frequently downloads updates from an internal server. The administrator wants to ensure the application is not blocked by the prevention profile. What should the administrator configure in the prevention profile?

   • AAdd the internal update server's IP address to the network access exclusion list.
   • BCreate an application exclusion for the custom web application's executable file and its update process.
   • CDisable the exploit protection module for the entire server group.
   • DSet the prevention profile to alert-only mode for all modules.
   Reveal Solution Discussion Select an answer first