XDR-Analyst Planning And Installation Practice Test 2 — 15 Questions

Question 1

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM. To pair a newly deployed Broker VM with the Cortex XDR management console, the administrator must configure a unique registration token generated in the console under Settings > Configurations > Broker VM. This token authenticates the Broker VM to the management plane during initial registration, establishing the trusted channel for configuration and log forwarding.

Answer

A pre-shared IPSec tunnel key configured on the perimeter firewall

Answer

An imported enterprise PKI root certificate bundle

Answer

An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

Question 2

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component that serves as a local communication proxy and log collector for remote agents deployed outside the corporate network. It acts as an intermediary between endpoints and the Cortex XDR cloud, buffering logs and forwarding them securely. This is essential when endpoints cannot directly reach the cloud due to network restrictions or when you want to reduce egress traffic.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 3

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 4

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. In the Cortex XDR management console, agent installation packages (.msi for Windows, .pkg for macOS) are downloaded from Settings > Configurations > Endpoint Settings > Install Packages. This is the designated location for obtaining the packages needed for enterprise software deployment tools like SCCM or Intune.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 5

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

Question 6

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

Accepted Answer

Kernel headers and dependent build tools matching the running kernel version. The prerequisite package is kernel headers and dependent build tools matching the running kernel version (D). Cortex XDR on Linux uses either a kernel module or eBPF for deep visibility, and these require kernel headers to compile or load correctly. Without matching headers, the agent cannot install or function properly.

Answer

Microsoft .NET Framework 4.8 Runtime

Answer

IIS Web Server Role and ASP.NET

Answer

Active Directory Domain Services Client tools

Question 7

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. The Cortex XDR agent installation token authenticates the agent during installation and registration with the Cortex XDR tenant, and it also prevents unauthorized uninstallation or tampering by requiring the token for agent removal. This ensures only authorized endpoints join the tenant and that the agent cannot be easily disabled by malware or unauthorized users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 8

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

Accepted Answer

Cortex Data Lake. Cortex Data Lake is the cloud-hosted, multi-tenant data repository that ingests and stores all telemetry from Cortex XDR agents, network sensors, and third-party log sources. It provides the centralized storage and correlation layer that powers Cortex XDR's detection, investigation, and threat-hunting capabilities across the entire environment.

Answer

Local Agent SQLite Cache

Answer

Panorama Log Collector Appliance

Answer

Broker VM Internal Hard Disk

Question 9

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

In the Agent Settings profile within the Cortex XDR management console. Proxy settings for Cortex XDR agents are configured within the Agent Settings profile in the Cortex XDR management console.

Answer

On the local Broker VM CLI configuration menu

Answer

Via the Palo Alto Networks Firewall URL Filtering profile

Answer

Directly inside the Windows registry under HKLM\Software\Cyvera\Proxy

Question 10

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

Accepted Answer

.msi Windows Installer package. Group Policy Software Installation (MSI) requires an .msi installation package.

Answer

.rpm Red Hat Package Manager file

Answer

.exe self-extracting archive with embedded arguments

Answer

.dmg disk image format

Question 11

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

Accepted Answer

The specific regional Cortex XDR tenant FQDNs and update distribution domains. The correct answer is to whitelist the specific regional Cortex XDR tenant FQDNs and update distribution domains (D). Cortex XDR agents communicate with region-specific cloud endpoints, and these must be allowed through egress firewalls. The FQDNs are provided by Palo Alto Networks and vary by region (e.g., Americas, Europe, Asia). Update distribution domains are also required for agent updates.

Answer

A static list of Palo Alto Networks global headquarters IP addresses

Answer

Only local internal DNS servers

Answer

Public NTP servers only

Question 12

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

Accepted Answer

To update detection rules, behavioral heuristics, and malware signatures on the agent. Cortex XDR Content Updates are automatic downloads that refresh the agent's detection content — including behavioral heuristics, detection rules, and malware signatures — without requiring a full agent upgrade. This ensures endpoints stay protected against emerging threats with minimal administrative overhead.

Answer

To upgrade the core operating system of the host endpoint

Answer

To upgrade the Broker VM hypervisor kernel version

Answer

To renew the TLS certificates of the Palo Alto Networks support portal

Question 13

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

Accepted Answer

TCP/UDP port 514. By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Answer

TCP port 636 for secure LDAP syslog

Answer

UDP port 123 for Network Time Protocol

Answer

TCP port 8080 for HTTP forwarding

Question 14

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

Accepted Answer

Through a Broker VM configured to download and distribute content updates locally within the air-gapped network. In air-gapped environments, agents receive updates through a local Broker VM configured as a content proxy/gateway that syncs from an internal source or offline bundle.

Answer

Via dial-up modem backup lines connected directly to Palo Alto Networks support

Answer

Air-gapped environments are not supported by Cortex XDR under any circumstances

Answer

Updates are physically loaded via USB thumb drive into every endpoint agent daily

Question 15

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

Accepted Answer

Approving System Extensions, Full Disk Access, and Network Filter permissions via MDM or user prompt. macOS requires users or MDM profiles to grant Full Disk Access and network filter permissions to the Cortex XDR agent.

Answer

Configuring an Apple Developer ID certificate in Keychain Access

Answer

Installing a custom kernel extension compiled locally using Xcode

Answer

Disabling System Integrity Protection (SIP) entirely on every Mac