Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?
Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?
The first protection module checked in the Cortex XDR Windows agent malware protection flow is the Child Process Protection. When a process attempts to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process attempting to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event.
Phase 1: Evaluation of Child Process Protection Policy When a user attempts to run an executable, the operating system attempts to run the executable as a process. If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.
should be - Evaluation of Child Process Protection Policy https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/File-Analysis-and-Protection-Flow
saw this in admin guide https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/File-Analysis-and-Protection-Flow
D is the correct answer
Correct Answer D. Child Process Protection https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/File-Analysis-and-Protection-Flow If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.
See link from escar