XDR-Analyst Planning And Installation — 40 Questions

Question 1

When planning a Cortex XDR deployment, what is the primary function of the Cortex XDR server component within the cloud architecture?

Accepted Answer

To act as the centralized management console, analytics engine, and data lake for security events. The Cortex XDR server component in the cloud architecture is the centralized brain of the platform: it hosts the management console, performs correlation and analytics across endpoint, network, and identity data, and stores security events in a scalable data lake. It does not enforce firewall policy (that is Panorama or the firewall itself) nor does it replace on-premises management for firewall rules. Its primary role is to aggregate telemetry from agents and Broker VMs, run detection rules and machine learning, and present unified incidents to analysts.

Answer

To replace the Panorama management server for firewall policy enforcement

Answer

To locally store raw endpoint memory dumps indefinitely without cloud transmission

Answer

To execute automated sandbox detonation for all enterprise email traffic

Question 2

An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?

Accepted Answer

Tenant Management and Endpoint Groups with RBAC scoping. Cortex XDR supports multi-tenancy through Tenant Management, which allows a parent tenant to create and manage child tenants. Combined with Endpoint Groups and Role-Based Access Control (RBAC) scoping, administrators can logically segment endpoints, logs, and alerts so that each business unit only sees its own data. This is the correct feature for isolating visibility across different business units in a multi-tenant architecture.

Answer

Broker VM App Domains

Answer

Global Protect Gateway Zones

Answer

Virtual Router Contexts within the Agent Core

Question 3

You are planning the deployment of Cortex XDR agents across a mixed environment containing Windows, macOS, and Linux servers. During the sizing phase, you need to determine the resource allocation requirements for the Broker VM instances. Which hypervisor platform is officially supported for hosting the Broker VM image?

Accepted Answer

VMware ESXi. Palo Alto Networks provides the Broker VM as an OVF/OVA template supported on VMware ESXi as well as KVM, AWS, and Azure.

Answer

Docker Engine on Bare Metal Linux

Answer

Microsoft Hyper-V Generation 1 only

Answer

Citrix Hypervisor XenServer v6.5

Question 4

Before installing Cortex XDR agents on Windows endpoints, an administrator wants to verify system compatibility. Which minimum Windows operating system version is officially required for the current generation Cortex XDR Agent?

Accepted Answer

Windows 7 Service Pack 1 / Windows 10 and Windows Server 2012. The current generation Cortex XDR agent officially supports Windows 7 Service Pack 1, Windows 10, and Windows Server 2012 as minimum operating system versions. These are the baseline Windows platforms validated for agent installation and operation. Older versions such as XP, 2000, and Vista are not supported.

Answer

Windows XP Service Pack 3

Answer

Windows 2000 Server Advanced

Answer

Windows Vista Enterprise

Question 5

An administrator is planning network bandwidth utilization for Cortex XDR agents deployed across 10,000 endpoints. Which mechanism does Cortex XDR use to minimize WAN bandwidth consumption during content updates and software upgrades?

Accepted Answer

Incremental, lightweight signature updates delivered dynamically over HTTPS. Cortex XDR uses incremental, lightweight signature/content updates delivered dynamically over HTTPS to keep agent content current without consuming excessive WAN bandwidth. Only deltas (changed signatures, new behavioral rules) are pushed rather than full content packages, and updates are pulled on-demand from the cloud distribution infrastructure. This design allows 10,000+ endpoints to stay protected without saturating WAN links during content or software upgrades.

Answer

Mandatory FTP file transfer during off-peak midnight hours only

Answer

Peer-to-peer multicast streaming across all local subnets

Answer

Local caching and distribution exclusively through Domain Controllers via GPO

Question 6

An administrator needs to verify that the Broker VM is successfully running and communicating with all configured apps. Where in the Cortex XDR management console can the administrator check the real-time operational status and health of the Broker VM?

Accepted Answer

Settings > Configurations > Broker VM. The Broker VM's real-time operational status and health are monitored from Settings > Configurations > Broker VM in the Cortex XDR management console. This page displays each deployed Broker VM, its connectivity state to the management server, and the status of the apps/services it hosts (such as the local agent data collector, syslog receiver, and pathfinder). Administrators use this view to confirm the Broker VM is online and communicating with all configured apps.

Answer

Dashboards > Incident Overview > Broker Status

Answer

Endpoints > All Endpoints > Infrastructure View

Answer

Reports > Scheduled Reports > VM Health

Question 7

An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?

Accepted Answer

show broker status and test connection. The Broker VM CLI provides a dedicated command 'show broker status' and a 'test connection' option to verify connectivity to the Cortex XDR cloud tenant. These commands check DNS resolution, HTTPS reachability, and authentication with the cloud backend, making them the correct tool for troubleshooting connectivity issues. They are purpose-built for the Broker VM and give actionable output about the connection state.

Answer

traceroute -m 64 gateway

Answer

ping -t customer.paloaltonetworks.com

Answer

tail -f /var/log/pan_broker_vm.log

Question 8

Which Cortex XDR license tier is required to ingest third-party logs (such as firewall, identity, and network logs) via the Broker VM Collector?

Accepted Answer

Cortex XDR Pro (Analytics or Per TB). Ingesting third-party logs for analytics requires the Cortex XDR Pro per TB or Pro per Endpoint license tier with data ingestion capabilities.

Answer

Cortex XDR Prevent (Base Edition)

Answer

Palo Alto Networks GlobalProtect Free Tier

Answer

WildFire Standalone API License

Question 9

An administrator is troubleshooting a Broker VM that fails to connect to the Cortex XDR cloud management console after deployment. Which THREE potential causes should be investigated?

Accepted Answer

An expired or incorrect registration token used during the initial setup wizard. Option B is correct because the Broker VM authenticates to the Cortex XDR tenant during the initial setup wizard using a registration token; if that token is expired, already consumed, or copied incorrectly, the registration and subsequent cloud connection will fail. Option C is correct because the Broker VM must resolve the tenant-specific URL (for example, .xdr..paloaltonetworks.com) to reach the Cortex XDR management console, so any DNS failure or misconfigured resolver prevents the connection. Option D is correct because Broker-to-cloud communication uses outbound TLS over TCP 443, so a firewall or proxy rule blocking that outbound HTTPS traffic from the Broker VM's IP address will break connectivity. Option A is not relevant because Fibre Channel zoning applies to SAN storage fabrics, not to the Broker VM's HTTPS connection to a cloud service. Option E is not relevant because insufficient RAM on a Windows 11 host laptop is a local resource/hypervisor concern and is not a network or registration cause of failing to reach the Cortex XDR cloud console.

Answer

Incorrect fiber channel zoning on the enterprise SAN switch

Answer

Insufficient physical RAM installed on the host laptop running Windows 11

Question 10

A security architect is planning a Cortex XDR deployment for a company with endpoints that frequently disconnect from the corporate network for weeks at a time. The architect must ensure endpoint data is retained locally and forwarded once connectivity returns, without requiring a direct inbound connection from the Cortex XDR console. Which Cortex XDR component should be placed in the remote or DMZ network to meet this requirement?

Accepted Answer

Cortex XDR Broker VM. The Broker VM is the Cortex XDR component specifically designed for remote or DMZ deployment to act as a local proxy and store-and-forward relay for agents. It enables endpoints with intermittent connectivity to buffer telemetry locally and forward it when the network is available, without requiring inbound connections to the Cortex XDR cloud. The other options are either not deployment components or do not provide the required relay and buffering functions.

Answer

Cortex XDR agent with local data buffering

Answer

Cortex XDR agent installation token

Answer

Cortex XDR management console

Question 11

A security architect is planning a Cortex XDR deployment for a company with strict data-residency requirements. The company's policy mandates that all endpoint telemetry and alert data must remain within the country of origin, and no data may be processed in a shared multi-tenant environment. The architect must select a Cortex XDR deployment model that satisfies this requirement. Which deployment model should the architect choose?

Accepted Answer

Cortex XDR with a Cortex XDR Pro per-Endpoint license deployed on a customer-managed on-premises management server. The requirement is that all endpoint telemetry and alert data remain in the country of origin and are never processed in a shared multi-tenant environment. Only a customer-managed on-premises Cortex XDR deployment keeps both storage and processing inside the customer's own controlled infrastructure, satisfying both constraints. Cloud-hosted options, whether multi-tenant or dedicated, still involve vendor-operated shared infrastructure, so they fail the strict policy.

Answer

Cortex XDR with a Cortex XDR Pro per-Endpoint license deployed on a dedicated, customer-managed tenant using a cloud region that meets residency requirements

Answer

Cortex XDR with a free Community edition license that relies entirely on the vendor's public cloud for storage and processing

Answer

Cortex XDR with a Cortex XDR Pro per-Endpoint license hosted in the vendor's multi-tenant cloud

Question 12

A security engineer is planning a Cortex XDR deployment for a data center with 200 Linux servers running a custom kernel module. The engineer must ensure that the Cortex XDR agent does not block the custom module from loading while still providing exploit protection. Which Cortex XDR agent capability should the engineer configure to allow the custom module while maintaining protection?

Accepted Answer

Exploit Protection exceptions. Exploit Protection exceptions are the correct mechanism to allow a specific kernel module while keeping exploit mitigation active for other processes. Malware Prevention exclusions, Device Control exceptions, and Restriction Policy exclusions address different protection modules and would not prevent Exploit Protection from blocking the custom module.

Answer

Device Control exceptions

Answer

Restriction Policy exclusions

Answer

Malware Prevention exclusions

Question 13

An administrator is planning to deploy Cortex XDR agents on a large number of endpoints that are behind a web proxy requiring authentication. The administrator wants to ensure that agents can communicate with the Cortex XDR cloud service without requiring user intervention. Which configuration should be implemented?

Accepted Answer

Deploy a Broker VM and configure it as a proxy for agent communication, and configure the agents to use the Broker VM.. Deploying a Broker VM as a proxy for agent communication allows agents to connect to the Broker VM without individual proxy authentication. The Broker VM can be configured to authenticate to the web proxy on behalf of the agents, or it can be placed in a network segment with direct internet access. This centralizes and simplifies proxy authentication for large deployments.

Answer

Configure each agent with the proxy credentials using the Cortex XDR agent configuration settings.

Answer

Use a PAC file to automatically provide proxy credentials to the agents.

Answer

Configure the Cortex XDR agent to use the system proxy settings, and ensure the proxy allows unauthenticated access to the Cortex XDR cloud URLs.

Question 14

A Cortex XDR administrator is planning to deploy agents to Linux servers that run critical custom applications. The administrator must ensure that the Cortex XDR agent does not terminate or interfere with these applications, even if they exhibit behavior that could be considered malicious. Which Cortex XDR feature should be configured to achieve this?

Accepted Answer

Agent Self-Protection and Critical Process Protection settings. Critical Process Protection is a Cortex XDR feature that allows administrators to specify processes that the agent must never terminate, regardless of behavioral detections. This is essential for critical applications that might exhibit unusual behavior but must remain operational. The other options provide some level of exclusion or trust but do not offer the same guarantee against termination by the agent.

Answer

Allow List in the agent profile

Answer

Process Exclusions in the agent profile

Answer

Exception policy in the agent profile

Question 15

An administrator is planning to install Cortex XDR agents on a set of servers that run a critical application. The administrator needs to ensure that the agents do not interfere with the application's performance and that they can be easily removed if necessary. Which Cortex XDR agent installation option should be used?

Accepted Answer

Install the agent using the standard installation package and ensure the uninstall password is documented and available.. Using the standard installation package with a known uninstall password allows the agent to be easily removed when necessary. Uninstall protection is a security feature that can be managed with a password. This approach ensures that the administrator can uninstall the agent if it interferes, while still maintaining protection. Monitoring mode and disabling prevention are not focused on removal, and enabling uninstall protection without documenting the password would hinder removal.

Answer

Install the agent with the 'no prevention' flag to disable all blocking modules.

Answer

Install the agent with the option to enable uninstall protection and a unique uninstall password.

Answer

Install the agent in monitoring mode to observe behavior without blocking.

Question 16

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

Accepted Answer

A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM. To pair a newly deployed Broker VM with the Cortex XDR management console, the administrator must configure a unique registration token generated in the console under Settings > Configurations > Broker VM. This token authenticates the Broker VM to the management plane during initial registration, establishing the trusted channel for configuration and log forwarding.

Answer

A pre-shared IPSec tunnel key configured on the perimeter firewall

Answer

An imported enterprise PKI root certificate bundle

Answer

An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

Question 17

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component that serves as a local communication proxy and log collector for remote agents deployed outside the corporate network. It acts as an intermediary between endpoints and the Cortex XDR cloud, buffering logs and forwarding them securely. This is essential when endpoints cannot directly reach the cloud due to network restrictions or when you want to reduce egress traffic.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 18

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 19

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. In the Cortex XDR management console, agent installation packages (.msi for Windows, .pkg for macOS) are downloaded from Settings > Configurations > Endpoint Settings > Install Packages. This is the designated location for obtaining the packages needed for enterprise software deployment tools like SCCM or Intune.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 20

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI