Which two types of response actions are available in Cortex XDR? (Choose two)

Cortex XDR provides several built-in and integrated response actions to contain and remediate threats. "Isolate endpoint" is a direct containment action that disconnects the device from the network, preventing lateral movement while still allowing the XDR agent to communicate with the console. "Block IP address" is another common response action, typically executed through integration with a Next-Generation Firewall (NGFW), to stop communication with a malicious command-and-control server or other external threat.

C. Run disk defragmentation is a system maintenance utility and has no application as a security response action within Cortex XDR.
D. Change analyst user role is an administrative function for managing access to the Cortex XDR console, not a response to a threat on an endpoint.

1. Palo Alto Networks, "Cortex XDR Administrator's Guide," Chapter: "Action Center," Section: "Response Actions." This section explicitly lists "Isolate Endpoint" as a network isolation response action.

2. Palo Alto Networks, "Cortex XDR Administrator's Guide," Chapter: "Response," Section: "Remediation." This section describes various remediation capabilities, including actions like blocking files and IP addresses, often through integration with enforcement points like firewalls.