An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?
You are planning the deployment of Cortex XDR agents across a mixed environment containing Windows, macOS, and Linux servers. During the sizing phase, you need to determine the resource allocation requirements for the Broker VM instances. Which hypervisor platform is officially supported for hosting the Broker VM image?
Before installing Cortex XDR agents on Windows endpoints, an administrator wants to verify system compatibility. Which minimum Windows operating system version is officially required for the current generation Cortex XDR Agent?
An administrator is planning network bandwidth utilization for Cortex XDR agents deployed across 10,000 endpoints. Which mechanism does Cortex XDR use to minimize WAN bandwidth consumption during content updates and software upgrades?
An administrator needs to verify that the Broker VM is successfully running and communicating with all configured apps. Where in the Cortex XDR management console can the administrator check the real-time operational status and health of the Broker VM?
An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?
An administrator is troubleshooting a Broker VM that fails to connect to the Cortex XDR cloud management console after deployment. Which THREE potential causes should be investigated?
A security architect is planning a Cortex XDR deployment for a company with endpoints that frequently disconnect from the corporate network for weeks at a time. The architect must ensure endpoint data is retained locally and forwarded once connectivity returns, without requiring a direct inbound connection from the Cortex XDR console. Which Cortex XDR component should be placed in the remote or DMZ network to meet this requirement?
A security architect is planning a Cortex XDR deployment for a company with strict data-residency requirements. The company's policy mandates that all endpoint telemetry and alert data must remain within the country of origin, and no data may be processed in a shared multi-tenant environment. The architect must select a Cortex XDR deployment model that satisfies this requirement. Which deployment model should the architect choose?
A security engineer is planning a Cortex XDR deployment for a data center with 200 Linux servers running a custom kernel module. The engineer must ensure that the Cortex XDR agent does not block the custom module from loading while still providing exploit protection. Which Cortex XDR agent capability should the engineer configure to allow the custom module while maintaining protection?
An administrator is planning to deploy Cortex XDR agents on a large number of endpoints that are behind a web proxy requiring authentication. The administrator wants to ensure that agents can communicate with the Cortex XDR cloud service without requiring user intervention. Which configuration should be implemented?
A Cortex XDR administrator is planning to deploy agents to Linux servers that run critical custom applications. The administrator must ensure that the Cortex XDR agent does not terminate or interfere with these applications, even if they exhibit behavior that could be considered malicious. Which Cortex XDR feature should be configured to achieve this?
An administrator is planning to install Cortex XDR agents on a set of servers that run a critical application. The administrator needs to ensure that the agents do not interfere with the application's performance and that they can be easily removed if necessary. Which Cortex XDR agent installation option should be used?
An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?
An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?
An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?
An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?
An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?
An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?
An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?
An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?
An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?
An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?
An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?
When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?
When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?
An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?
An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?
An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?
An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?
An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?
An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?
An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?
An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?
When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?
An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?
An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?
An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?
When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?
A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three geographic regions. The security team wants to minimize the number of external firewall rules required for agent-to-cloud communication while still allowing the agents to receive policy updates and upload telemetry. Which component should the architect deploy in each region to aggregate and forward agent traffic to the Cortex XDR cloud tenant?
A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?
A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?
An administrator is planning the initial installation of Cortex XDR agents on 500 Windows endpoints. The security policy requires that endpoints authenticate to the Cortex XDR tenant during installation using a shared secret that can be rotated if compromised. Which item must the administrator generate in the Cortex XDR management console before installing the agents?
An administrator is planning a Cortex XDR agent rollout to a large fleet of Windows endpoints whose users are frequently offline and connect through a restricted proxy. The administrator needs the agents to receive new content and policy updates without user intervention and without direct internet egress from each endpoint. Which deployment planning consideration best addresses this requirement?
An administrator is planning a Cortex XDR agent rollout for 2,500 Windows servers that reside in a data center with no direct internet access. All outbound traffic must traverse an explicit forward proxy. The administrator wants agents to register successfully with the Cortex XDR cloud tenant. What should the administrator do first?
An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?
A security administrator is preparing to install Cortex XDR agents on a large number of Windows endpoints. The administrator wants to ensure that the agents automatically register with the correct Cortex XDR tenant and receive the appropriate policy settings. Which item must be included in the agent installation package or command line to achieve this?
A security team is planning its first Cortex XDR deployment and must decide how to group endpoints so that different prevention policies apply to servers versus user workstations. Which planning action should the administrator take first?
A company is planning its first Cortex XDR deployment and wants to confirm which component is responsible for centrally storing endpoint telemetry, running analytics, and delivering policy to agents. Which component fulfills this role?
A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?
An administrator is planning a Cortex XDR deployment for a network that uses a forward proxy requiring authentication for all outbound traffic. Endpoints run Windows and must communicate with the Cortex XDR cloud tenant. Which planning configuration will allow agents to reach the cloud through the proxy without per-user credentials?
An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?
An administrator is preparing to install Cortex XDR agents on 500 Windows servers. The security policy requires that the endpoint be automatically associated with the correct tenant and that agents report to the management console without manual per-endpoint registration. What must the administrator obtain from the Cortex XDR management console before starting the installation?
A security administrator is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints. Before installation, the administrator must ensure that the endpoints meet the minimum operating system requirements for the Cortex XDR agent. Which of the following is a valid supported Windows operating system for the Cortex XDR agent?
An administrator is planning a Cortex XDR deployment where agents will be installed on endpoints that have no direct internet access and will rely on a Broker VM for connectivity. Which TWO planning tasks are required to ensure the agents can register and communicate through the Broker VM? (Choose two.)
An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)
An administrator is planning a Cortex XDR deployment for a hospital network with strict change-control and limited maintenance windows. Before rolling agents out to clinical workstations, the administrator must validate that the deployment will not disrupt critical medical applications. Which TWO planning activities best reduce the risk of application conflicts during the rollout? (Choose two.)
An administrator is planning a large Cortex XDR agent rollout across 5,000 endpoints in a distributed network. Before starting, the administrator must confirm the network prerequisites that allow agents to register with the Cortex XDR management console and receive content updates. Which TWO network requirements must be satisfied? (Choose two.)
A Cortex XDR administrator is planning the installation of agents on endpoints that are behind a web proxy that requires authentication. The administrator needs to ensure that the agents can communicate with the Cortex XDR cloud through the proxy. What should the administrator configure in the agent installation settings?
A security operations manager is planning to deploy Cortex XDR agents to 2,000 endpoints. The manager wants to ensure that the agents can receive the latest detection content and policy updates automatically without manual intervention. Which Cortex XDR feature should the manager verify is enabled to meet this requirement?
An administrator is planning a Cortex XDR agent rollout and needs to decide how to distribute the agent installer to 2,000 Windows endpoints without manually touching each machine. The organization already uses Microsoft Configuration Manager (SCCM) and Microsoft Intune for software deployment. Which approach best fits the planning requirement?
An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?
An administrator is planning a Cortex XDR deployment in an environment where endpoints reside behind a web proxy that performs SSL inspection. During a pilot, agents fail to register with the management console even though outbound TCP 443 is permitted. The administrator must adjust the plan so agents can communicate through the proxy. Which action should the administrator take?
An administrator is planning a Cortex XDR rollout for a multinational company. Legal requires that endpoint telemetry from one region remain within that region's cloud tenant and never be visible to administrators in other regions. Which planning consideration is most critical to satisfy this data-residency requirement?
A Cortex XDR administrator is planning agent deployment for 5,000 Windows endpoints in a data center with restricted internet access. The security team requires that endpoints receive policy updates and upload telemetry without direct outbound internet connectivity. The administrator decides to deploy a Broker VM. Which Cortex XDR component must the Broker VM communicate with to receive policy updates and forward telemetry from agents?
A security administrator is planning a Cortex XDR deployment for a large enterprise with endpoints in multiple VLANs. The administrator must ensure that the Cortex XDR agents can communicate with the Broker VM and that the Broker VM can reach the Cortex XDR management console. Which TWO network requirements must be met to support this deployment? (Choose two.)
A Cortex XDR administrator is preparing to deploy agents to 200 Linux servers in a demilitarized zone (DMZ). The administrator needs to select a deployment method that supports automated, scalable installation without manual intervention on each server. Which deployment method should the administrator use?