PCDRA practice question 10 of 15

After scan, how does file quarantine function work on an endpoint?

Answer options

A: Quarantine takes ownership of the files and folders and prevents execution through access control.

B: Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

C: Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed. Correct answer

D: Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

Correct Answer:

C. Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Explanation

Quarantine is a feature of Cortex XDR that allows you to isolate a malicious file from its original location and prevent it from being executed. Quarantine works by moving the file to a protected folder on the endpoint and changing its permissions and attributes. Quarantine can be applied to files detected by periodic scans or by behavioral threat protection (BTP) rules. Quarantine is only supported for portable executable (PE) and dynamic link library (DLL) files. Quarantine does not affect the network connectivity or the communication of the endpoint with Cortex XDR. Reference: Quarantine Malicious Files Manage Quarantined Files

Keep practicing

Take the free PCDRA practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test