Multiple remote desktop users complain of in-house applications no longer working. The team uses macOS with Cortex XDR agents version 8.7.0, and the applications were previously allowed by disable…

Question

Exhibit

Options

• AEndpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range
• BThe Cloud Identity Engine is disconnected or removed
• CXDR agent version was downgraded from 8.7.0 to 8.4.0
• DInstallation type changed from VDI to Kubernetes

• A
  59% (33)
• B
  23% (13)
• C
  13% (7)
• D
  5% (3)

Explanation

Option A is correct because Cortex XDR Exceptions Profiles - including the "Engineer-Mac" profile with its disable prevention rules - are scoped to target endpoints based on criteria such as IP address ranges. If the remote desktop endpoints shifted from the 192.168.0.0 subnet to the 192.168.100.0 subnet, they would no longer match the targeting criteria of the "Engineer-Mac" profile, causing those exceptions to stop applying and the applications to be blocked again.

Why the distractors are wrong:

• B (Cloud Identity Engine): The Cloud Identity Engine handles user/group-based identity policies; the exceptions here are scoped to endpoint attributes, not identity, so disconnecting it wouldn't directly remove endpoint-level disable prevention rules.
• C (Agent downgrade): The question states the agents are running 8.7.0, with no indication of a downgrade; this is a fabricated scenario not supported by the question's context.
• D (VDI to Kubernetes): Kubernetes is not a standard macOS remote desktop installation type in Cortex XDR - this is a nonsensical distractor mixing unrelated deployment concepts.

Memory tip: Think "the exception follows the IP, not the machine." If an endpoint migrates to a new subnet that wasn't included in the profile's scope, it becomes a stranger to that profile - the rule still exists, but no one in the new range receives it.

No community discussion yet for this question.