Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

The correct answer is B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.. Local Analysis is Cortex XDR's on-device machine learning engine used as a fallback when cloud-based WildFire analysis is unavailable or inconclusive. It is invoked under two specific conditions: (1) the endpoint is offline or disconnected from the Cortex XDR infrastructure and c

Submitted by sofia.br· Apr 18, 2026Cortex XDR Architecture and Agent Deployment

Question

Options

AThe endpoint is disconnected or the verdict from WildFire is of a type malware.
BThe endpoint is disconnected or the verdict from WildFire is of a type unknown.
CThe endpoint is disconnected or the verdict from WildFire is of a type grayware.
DThe endpoint is disconnected or the verdict from WildFire is of a type benign.

How the community answered

(29 responses)

A
7% (2)
B
86% (25)
C
3% (1)
D
3% (1)

Explanation

Local Analysis is Cortex XDR's on-device machine learning engine used as a fallback when cloud-based WildFire analysis is unavailable or inconclusive. It is invoked under two specific conditions: (1) the endpoint is offline or disconnected from the Cortex XDR infrastructure and cannot reach WildFire, or (2) WildFire returns an 'unknown' verdict - meaning the file has not been seen before or cannot be conclusively classified. Files already classified as malware, grayware, or benign already have a definitive WildFire verdict and do not need local re-analysis.

Topics

#Cortex XDR prevention#Local Analysis#WildFire integration#File analysis

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice