XDR-Analyst Planning And Installation Practice Test 3 — 15 Questions

Question 1

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

Accepted Answer

To actively block and remediate threats such as malware, exploits, and ransomware execution on the endpoint. Prevention modules block known and unknown malware, exploits, and ransomware execution in real-time on the endpoint.

Answer

To generate weekly compliance PDF reports for external auditors

Answer

To monitor bandwidth usage across enterprise switch ports

Answer

To automatically patch third-party software vulnerabilities like Adobe Reader

Question 2

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

Accepted Answer

Sufficient vCPU and RAM allocation per published system requirements. Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Answer

Fibre Channel HBA connected to an enterprise SAN storage array

Answer

Dedicated high-end NVIDIA GPU for deep learning processing

Answer

Dual 10Gbps SFP+ physical network interface cards passed through directly

Question 3

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

Accepted Answer

Settings > Configurations > Agent Settings > Upgrades. The automated agent upgrade setting is located under Settings > Configurations > Agent Settings > Upgrades. This is the central configuration point where administrators can enable automatic updates, set a schedule, and define the target agent version. Enabling this ensures agents check for and install new versions released by Palo Alto Networks without manual intervention.

Answer

Help > About > Check for Updates

Answer

Response > Actions > Push Update

Answer

Data Collector > Broker VM > Software Distribution

Question 4

What is the primary function of the Cortex XDR Agent Support File collection tool?

Accepted Answer

To collect diagnostic logs, configuration details, and troubleshooting data for Palo Alto Networks Support. The Cortex XDR Agent Support File collection tool is designed to gather diagnostic logs, configuration details, and system information from the endpoint to assist Palo Alto Networks Support in troubleshooting agent issues. It packages this data into a support file that can be uploaded to a case. It does not create forensic disk images, back up personal documents, or export cryptographic keys.

Answer

To generate a forensic disk image of the entire hard drive

Answer

To back up the user's personal documents to the cloud data lake

Answer

To export endpoint cryptographic keys to an external vault

Question 5

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

Accepted Answer

Deploy Broker VM instances locally at remote sites or data centers to aggregate logs and reduce WAN bandwidth consumption. Option B is correct because deploying Broker VM instances locally at remote sites or data centers lets them aggregate and buffer logs close to the source, which reduces WAN bandwidth consumption and avoids sending raw telemetry across high-latency links. Option D is correct because Broker VM capacity is driven by throughput, so vCPU and RAM must be sized to the expected events-per-second (EPS) load to prevent dropped or delayed log forwarding. Option A is wrong because Broker VM is a server-side virtual appliance, not software installed on Windows 10 Pro workstations. Option C is wrong because the Broker VM is not designed as a permanent seven-year log archive; long-term retention belongs in the management console or a dedicated storage/SIEM repository. Option E is wrong because a single Broker VM cannot adequately serve 50,000 global endpoints over high-latency WAN links; multiple distributed instances are required for scale and locality.

Answer

Install the Broker VM directly on user workstations running Windows 10 Pro

Answer

Configure the Broker VM to store all enterprise log data locally on its virtual disk permanently for 7 years

Answer

Share a single Broker VM instance across 50,000 global endpoints separated by high-latency WAN links

Question 6

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

Accepted Answer

Global Agent Profile Exclusions (Path, Process, and File Hash exclusions). The correct feature is Global Agent Profile Exclusions (Path, Process, and File Hash exclusions) (A). These exclusions allow administrators to specify directories, processes, or file hashes that the agent should ignore during inspection, preventing interference with critical applications. This is configured in the agent profile and applied to endpoints.

Answer

Broker VM Firewall Rules

Answer

Kernel Module Blacklisting via /etc/modprobe.d

Answer

Linux iptables PREROUTING chains

Question 7

An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?

Accepted Answer

Verify that the operating system version meets the minimum requirements supported by the current Cortex XDR agent release. Option A is correct because the Cortex XDR agent only installs and runs on supported OS versions, so the pre-installation script must verify the endpoint's operating system meets the minimum requirements of the current agent release to avoid failed or unsupported installations. Option B is correct because the agent must communicate with the regional Cortex XDR tenant (and related services) over outbound TCP 443 to the appropriate FQDNs; without this connectivity, enrollment and telemetry would fail. Option D is correct because competing third-party endpoint security agents can conflict with the Cortex XDR agent's kernel hooks and drivers, so they must be uninstalled or properly configured/excluded before installation. Option C is not correct because permanently disabling all local network interface cards would break the required outbound connectivity to the Cortex XDR tenant and is never a prerequisite. Option E is not correct because reformatting the local hard drive to FAT32 is unnecessary and inappropriate; Cortex XDR supports standard enterprise file systems like NTFS, and FAT32 is not a compatibility requirement.

Answer

Disable all local network interface cards permanently

Answer

Reformat the local hard drive to use the FAT32 file system for compatibility

Question 8

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

Accepted Answer

A dedicated service account in Active Directory with read permissions to query user and group objects. Option A is correct because Cortex XDR's Active Directory integration via the Broker VM requires a dedicated AD service account with read permissions to query user and group objects, which is used to perform LDAP bind and enumerate directory data for User-ID mapping. Option E is correct because the Broker VM must reach the Domain Controllers over TCP 389 for LDAP or TCP 636 for LDAPS to perform those queries and synchronize user and group information. Option B is incorrect because no physical USB hardware token is involved in AD User-ID synchronization. Option C is incorrect because the integration uses LDAP/LDAPS queries with the service account, not direct SSH root access to each Domain Controller. Option D is incorrect because installing the Cortex XDR Agent on Domain Controllers is not a mandatory prerequisite for Broker VM-based AD integration.

Answer

A physical hardware token connected to the Broker VM USB port

Answer

Direct SSH root access to every Active Directory Domain Controller

Answer

Installation of the Cortex XDR Agent on all Domain Controllers as a mandatory prerequisite

Question 9

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?

Accepted Answer

The Windows System and Application Event Logs for MSIInstaller or service creation errors. Option A is correct because failed MSI installations and service-creation problems are recorded in the Windows System and Application Event Logs, where MSIInstaller events (e.g., Event ID 11708/1033/1040) reveal the failing action or service that could not be created. Option B is correct because the Cortex XDR agent writes its own installation logs to the Windows %TEMP% directory and Cyvera-branded log files, which contain agent-specific setup errors that the generic Windows logs may not capture. Option C is correct because running the MSI with verbose logging (msiexec /i installer.msi /l*v install.log) produces a detailed Windows Installer log showing each action, return value, and the exact point of failure. Option D is not relevant because BIOS boot order only affects which device the system boots from and has no bearing on an MSI-based agent installation inside Windows. Option E is not relevant because arp -a displays the local ARP cache (IP-to-MAC mappings), not router routing tables, and has no relationship to software installation failures.

Answer

The BIOS firmware boot order configuration screen

Answer

The local router routing table via the arp -a command

Question 10

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

Accepted Answer

Inbound Syslog (TCP/UDP 514 or custom ports) from network devices to the Broker VM Syslog collector. Option C is correct because the Broker VM hosts a Syslog collector that receives log and event data from network devices, so inbound Syslog on TCP/UDP 514 or configured custom ports must be allowed through internal firewalls. Option D is correct because the Broker VM must communicate with Active Directory Domain Controllers over LDAP/LDAPS on TCP 389/636 in both directions to perform directory lookups, user/group resolution, and related identity functions. Option E is correct because the Broker VM requires outbound HTTPS on TCP 443 to reach the Cortex XDR cloud tenant and associated content delivery networks for registration, management, telemetry, and content updates. Option A is not correct because BitTorrent peer-to-peer traffic is not a supported or required Broker VM communication flow. Option B is not correct because exposing RDP from all internet IP addresses directly to the Broker VM is an insecure management practice and is not a required internal firewall flow for Broker VM functionality.

Answer

Outbound BitTorrent peer-to-peer traffic for software distribution

Answer

Inbound Remote Desktop Protocol (RDP) from all internet IP addresses directly to the Broker VM

Question 11

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

Accepted Answer

The Broker VM runs as a virtual appliance on supported hypervisors such as VMware ESXi, KVM, AWS, or Azure. Option B is correct because the Broker VM is deployed as a virtual appliance on supported hypervisors and cloud platforms, including VMware ESXi, KVM, AWS, and Azure, rather than on endpoints. Option C is correct because the Broker VM hosts modular apps that provide capabilities such as Syslog Collector, Active Directory integration, and agent proxying for Cortex XDR. Option A is incorrect because the Broker VM is not installed as a macOS kernel extension on individual endpoints. Option D is incorrect because the Broker VM does not replace Cortex Data Lake as the enterprise's primary long-term log storage repository. Option E is incorrect because the Broker VM does not require a physical server with 128 cores and 1TB of RAM; it is a virtual appliance with far more modest resource requirements.

Answer

The Broker VM is installed directly on individual macOS endpoints as a kernel extension

Answer

The Broker VM replaces the Cortex Data Lake as the primary long-term log storage repository for the entire enterprise

Answer

The Broker VM requires a physical server with at least 128 cores and 1TB of RAM

Question 12

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

Accepted Answer

Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune using the .msi package. Option D is correct because Cortex XDR officially supports mass deployment on Windows domains through Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, distributing the provided .msi package via standard software-deployment mechanisms. Option E is correct because Active Directory Group Policy Object (GPO) Software Installation is a documented, supported method for pushing the Cortex XDR agent .msi to domain-joined Windows endpoints at scale. Option A is not a supported mass-deployment method, since email self-installation is unreliable, unmanaged, and not an official enterprise deployment channel. Option B is not viable for mass deployment because manually visiting each workstation with a USB drive is unscalable and not an officially supported automated method. Option C is not acceptable because broadcasting binaries over unauthenticated public FTP servers is insecure and not a supported Cortex XDR deployment method.

Answer

Sending the installer executable as an email attachment to all employees with instructions to self-install

Answer

Manually walking to every workstation with a USB flash drive to execute the GUI installer interactively

Answer

Broadcasting the installer binary over unauthenticated public FTP servers

Question 13

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Accepted Answer

Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles. Option D is correct because during initial Cortex XDR tenant onboarding, the administrator must create administrator user accounts and assign the appropriate RBAC roles so that different teams (e.g., SOC analysts, responders, admins) get only the permissions they need. Option E is correct because onboarding requires generating Agent Installation Packages (with the tenant/registration token) and defining Settings profiles so endpoints can be enrolled and managed consistently. Option A is incorrect because Cortex XDR agents are prebuilt binaries; no custom assembly code per CPU architecture is written by the administrator. Option B is incorrect because Cortex XDR is an endpoint detection and response platform and does not require physically replacing core switches with Palo Alto Networks firewalls. Option C is incorrect because disabling cloud logging would defeat Cortex XDR's telemetry ingestion and analytics rather than being a required setup task.

Answer

Manually write custom assembly code for every endpoint CPU architecture

Answer

Physically replace all enterprise core switches with Palo Alto Networks firewalls

Answer

Disable all cloud logging features to prevent data ingestion

Question 14

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

Accepted Answer

Proxy server configuration for agent communication traversal. Option A is correct because an Agent Settings profile in Cortex XDR includes proxy settings that determine how the agent reaches the management console and Cortex XDR services, including proxy server address, port, and authentication for communication traversal. Option C is correct because Agent Settings profiles define exclusions by path, process, or file hash so that specified files or behaviors are not scanned or blocked by the agent. Option E is correct because the profile controls the agent's operational mode, such as Normal, Detect-only, or Disabled, which governs whether protections are enforced or only reported. Option B is not part of agent profiles because GlobalProtect VPN gateway tunnel encryption algorithms are configured in the GlobalProtect gateway configuration, not in Cortex XDR agent settings. Option D is not part of agent profiles because physical firewall interface IP addresses and routing tables are configured on the firewall itself, not within an endpoint agent settings profile.

Answer

GlobalProtect VPN gateway tunnel encryption algorithms

Answer

Physical firewall interface IP addresses and routing tables

Question 15

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Accepted Answer

Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console. Option A is correct because continuous monitoring of Broker VM health, connectivity status, and app status in the Cortex XDR console provides the visibility needed to detect failures or degraded services early and trigger remediation, which is essential for maintaining high availability. Option B is correct because hypervisor-level HA such as VMware vSphere HA automatically restarts Broker VM virtual machines on another host when a host failure occurs, reducing downtime without manual intervention. Option C is correct because deploying multiple Broker VM instances in active-active or active-passive configurations across different hypervisor hosts removes single points of failure and ensures service continuity if one instance or host becomes unavailable. Option D does not belong because connecting virtual disks to a local USB thumb drive is not a supported or reliable HA mechanism and introduces a single point of failure rather than resilience. Option E does not belong because Broker VM is a virtual appliance deployed on a hypervisor, not software that runs inside a web browser tab, so it cannot provide the required availability or performance.

Answer

Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

Answer

Running the Broker VM software directly inside a web browser tab