Which remediation endpoint action disables all network access on compromised endpoints except for traffic to the Cortex XDR management console, preventing these endpoints from communicating with and potentially infecting other endpoints?1 pointTerminate ProcessesIsolate EndpointsBlock ExecutionsQuarantine Files

To determine which remediation endpoint action disables all network access on compromised endpoints except for traffic to the Cortex XDR management console, follow these steps:

1. Understand the Options:

   • Terminate Processes: This action stops specific processes running on the endpoint. It does not affect network access.
   • Isolate Endpoints: This action restricts the endpoint's network access, allowing only communication with the management console.
   • Block Executions: This action prevents certain applications or processes from running on the endpoint. It does not affect network access.
   • Quarantine Files: This action moves suspicious files to a secure location to prevent them from causing harm. It does not affect network access.

2. Identify the Requirement:

   • The requirement is to disable all network access on compromised endpoints except for traffic to the Cortex XDR management console.

3. Match the Requirement to the Options:

   • The action that matches this requirement is Isolate Endpoints. This action ensures that the endpoint can only communicate with the Cortex XDR management console, effectively preventing it from communicating with and potentially infecting other endpoints.

Therefore, the correct remediation endpoint action is:

Isolate Endpoints

To determine which remediation endpoint action disables all network access on compromised endpoints except for traffic to the Cortex XDR management console, follow these steps:

1. Understand the Options:

   • Terminate Processes: This action stops specific processes running on the endpoint.
   • Isolate Endpoints: This action restricts the endpoint's network access, allowing only essential communication.
   • Block Executions: This action prevents certain applications or processes from running.
   • Quarantine Files: This action moves suspicious files to a secure location to prevent them from causing harm.

2. Identify the Requirement:

   • The requirement is to disable all network access on compromised endpoints except for traffic to the Cortex XDR management console.

3. Match the Requirement to the Options:

   • Terminate Processes does not address network access.
   • Isolate Endpoints specifically mentions restricting network access while allowing essential communication, which fits the requirement.
   • Block Executions focuses on preventing applications from running, not network access.
   • Quarantine Files deals with handling suspicious files, not network access.

4. Conclusion:

   • The action that matches the requirement of disabling all network access except for traffic to the Cortex XDR management console is Isolate Endpoints.

Therefore, the correct answer is: Isolate Endpoints