Planning And Installation

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

What is the primary function of the Cortex XDR Agent Support File collection tool?

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three geographic regions. The security team wants to minimize the number of external firewall rules required for agent-to-cloud communication while still allowing the agents to receive policy updates and upload telemetry. Which component should the architect deploy in each region to aggregate and forward agent traffic to the Cortex XDR cloud tenant?

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

An administrator is planning the initial installation of Cortex XDR agents on 500 Windows endpoints. The security policy requires that endpoints authenticate to the Cortex XDR tenant during installation using a shared secret that can be rotated if compromised. Which item must the administrator generate in the Cortex XDR management console before installing the agents?

An administrator is planning a Cortex XDR agent rollout to a large fleet of Windows endpoints whose users are frequently offline and connect through a restricted proxy. The administrator needs the agents to receive new content and policy updates without user intervention and without direct internet egress from each endpoint. Which deployment planning consideration best addresses this requirement?

An administrator is planning a Cortex XDR agent rollout for 2,500 Windows servers that reside in a data center with no direct internet access. All outbound traffic must traverse an explicit forward proxy. The administrator wants agents to register successfully with the Cortex XDR cloud tenant. What should the administrator do first?

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

A security administrator is preparing to install Cortex XDR agents on a large number of Windows endpoints. The administrator wants to ensure that the agents automatically register with the correct Cortex XDR tenant and receive the appropriate policy settings. Which item must be included in the agent installation package or command line to achieve this?

A security team is planning its first Cortex XDR deployment and must decide how to group endpoints so that different prevention policies apply to servers versus user workstations. Which planning action should the administrator take first?

A company is planning its first Cortex XDR deployment and wants to confirm which component is responsible for centrally storing endpoint telemetry, running analytics, and delivering policy to agents. Which component fulfills this role?

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

An administrator is planning a Cortex XDR deployment for a network that uses a forward proxy requiring authentication for all outbound traffic. Endpoints run Windows and must communicate with the Cortex XDR cloud tenant. Which planning configuration will allow agents to reach the cloud through the proxy without per-user credentials?

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

An administrator is preparing to install Cortex XDR agents on 500 Windows servers. The security policy requires that the endpoint be automatically associated with the correct tenant and that agents report to the management console without manual per-endpoint registration. What must the administrator obtain from the Cortex XDR management console before starting the installation?

A security administrator is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints. Before installation, the administrator must ensure that the endpoints meet the minimum operating system requirements for the Cortex XDR agent. Which of the following is a valid supported Windows operating system for the Cortex XDR agent?

An administrator is planning a Cortex XDR deployment where agents will be installed on endpoints that have no direct internet access and will rely on a Broker VM for connectivity. Which TWO planning tasks are required to ensure the agents can register and communicate through the Broker VM? (Choose two.)

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

An administrator is planning a Cortex XDR deployment for a hospital network with strict change-control and limited maintenance windows. Before rolling agents out to clinical workstations, the administrator must validate that the deployment will not disrupt critical medical applications. Which TWO planning activities best reduce the risk of application conflicts during the rollout? (Choose two.)

An administrator is planning a large Cortex XDR agent rollout across 5,000 endpoints in a distributed network. Before starting, the administrator must confirm the network prerequisites that allow agents to register with the Cortex XDR management console and receive content updates. Which TWO network requirements must be satisfied? (Choose two.)

A Cortex XDR administrator is planning the installation of agents on endpoints that are behind a web proxy that requires authentication. The administrator needs to ensure that the agents can communicate with the Cortex XDR cloud through the proxy. What should the administrator configure in the agent installation settings?

A security operations manager is planning to deploy Cortex XDR agents to 2,000 endpoints. The manager wants to ensure that the agents can receive the latest detection content and policy updates automatically without manual intervention. Which Cortex XDR feature should the manager verify is enabled to meet this requirement?

An administrator is planning a Cortex XDR agent rollout and needs to decide how to distribute the agent installer to 2,000 Windows endpoints without manually touching each machine. The organization already uses Microsoft Configuration Manager (SCCM) and Microsoft Intune for software deployment. Which approach best fits the planning requirement?

An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?

An administrator is planning a Cortex XDR deployment in an environment where endpoints reside behind a web proxy that performs SSL inspection. During a pilot, agents fail to register with the management console even though outbound TCP 443 is permitted. The administrator must adjust the plan so agents can communicate through the proxy. Which action should the administrator take?

An administrator is planning a Cortex XDR rollout for a multinational company. Legal requires that endpoint telemetry from one region remain within that region's cloud tenant and never be visible to administrators in other regions. Which planning consideration is most critical to satisfy this data-residency requirement?

A Cortex XDR administrator is planning agent deployment for 5,000 Windows endpoints in a data center with restricted internet access. The security team requires that endpoints receive policy updates and upload telemetry without direct outbound internet connectivity. The administrator decides to deploy a Broker VM. Which Cortex XDR component must the Broker VM communicate with to receive policy updates and forward telemetry from agents?

A security administrator is planning a Cortex XDR deployment for a large enterprise with endpoints in multiple VLANs. The administrator must ensure that the Cortex XDR agents can communicate with the Broker VM and that the Broker VM can reach the Cortex XDR management console. Which TWO network requirements must be met to support this deployment? (Choose two.)

A Cortex XDR administrator is preparing to deploy agents to 200 Linux servers in a demilitarized zone (DMZ). The administrator needs to select a deployment method that supports automated, scalable installation without manual intervention on each server. Which deployment method should the administrator use?