After scan, how does file quarantine function work on an endpoint?

The correct answer is C. Quarantine removes a specific file from its location on a local or removable drive to a protected. When Cortex XDR quarantines a file after a scan, it moves the malicious file from its original location (on a local disk or removable drive) to a protected quarantine directory on the endpoint. This prevents the file from being accessed or executed while preserving it for…

Submitted by fernanda_arg· Apr 18, 2026Investigation and Response

Question

Options

AQuarantine takes ownership of the files and folders and prevents execution through access
BQuarantine disables the network adapters and locks down access preventing any communications
CQuarantine removes a specific file from its location on a local or removable drive to a protected
DQuarantine prevents an endpoint from communicating with anything besides the listed exceptions

How the community answered

(44 responses)

A
2% (1)
B
5% (2)
C
93% (41)

Explanation

When Cortex XDR quarantines a file after a scan, it moves the malicious file from its original location (on a local disk or removable drive) to a protected quarantine directory on the endpoint. This prevents the file from being accessed or executed while preserving it for potential forensic analysis or restoration if it was a false positive. Option A describes taking file system ownership - not how quarantine works. Option B describes network isolation, which is a separate 'Endpoint Isolation' feature. Option D describes network exception-based blocking, also a distinct feature unrelated to file quarantine.

Topics

#Endpoint Security#File Quarantine#Threat Response#Cortex XDR

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice