Question 11
A security audit determines that the Windows Cortex XDR host-based firewall is not blocking outbound RDP connections for certain remote workers. The audit report confirms the following: All devices are running healthy Cortex XDR agents. A single host-based firewall rule to block all outbound RDP is implemented. The policy hosting the profile containing the rule applies to all Windows endpoints. The logic within the firewall rule is adequate. Further testing concludes RDP is successfully being blocked on all devices tested at company HQ. Network location configuration in Agent Settings is enabled on all Windows endpoints. What is the likely reason the RDP connections are not being blocked?
- The pertinent host-based firewall rule group is only applied to external rule groups.
- Report mode is set to Enabled in the report settings under the profile configuration.
- The pertinent host-based firewall rule group is only applied to internal rule groups.
- The profile’s default action for outbound traffic is set to Allow.