XDR-Analyst Planning And Installation Practice Test 4 — 15 Questions

Question 1

When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?

Accepted Answer

Apple macOS (supported modern versions with System Extensions). Option A is correct because Palo Alto Networks officially supports Cortex XDR agent installation on Apple macOS, including modern versions that use System Extensions (rather than the deprecated Kernel Extensions) for endpoint security functionality. Option D is correct because Microsoft Windows is a core supported platform for the Cortex XDR agent, covering Windows 10, Windows 11, and supported Windows Server editions. Options B, C, and E are incorrect because Atari TOS v4.04, Commodore AmigaOS 3.1, and MS-DOS 6.22 are legacy/retro operating systems that are not supported platforms for Cortex XDR agent deployment.

Answer

Atari TOS v4.04

Answer

Commodore AmigaOS 3.1

Answer

MS-DOS 6.22 operating system

Question 2

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three geographic regions. The security team wants to minimize the number of external firewall rules required for agent-to-cloud communication while still allowing the agents to receive policy updates and upload telemetry. Which component should the architect deploy in each region to aggregate and forward agent traffic to the Cortex XDR cloud tenant?

Accepted Answer

A Cortex XDR Broker VM. The Broker VM is designed to aggregate and forward agent traffic to the Cortex XDR cloud tenant, reducing the need for many direct outbound connections. In multi-region deployments, placing a Broker VM in each region concentrates agent communication and simplifies firewall rules. It also supports local apps such as syslog collection, but its core planning benefit here is traffic concentration.

Answer

A Cortex XDR management console

Answer

A Cortex XDR Content Update server

Answer

A Cortex XDR agent installation token

Question 3

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

Accepted Answer

Configure the Cortex XDR agents to initiate outbound connections over TCP 443 to the Cortex XDR cloud tenant.. Cortex XDR agents communicate with the cloud tenant by initiating outbound TCP 443 sessions, so no inbound firewall rules are required on the endpoint network. This outbound-only model is the standard deployment pattern and directly fulfills the architect's goal of reducing inbound port exposure while maintaining telemetry and policy delivery.

Answer

Configure agents to communicate with the Cortex XDR server component hosted on-premises over inbound TCP 443.

Answer

Enable inbound TCP 4443 on the perimeter firewall so agents can receive push notifications from the cloud.

Answer

Deploy a Broker VM in each regional office and open inbound TCP 443 from agents to the Broker VM.

Question 4

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

Accepted Answer

Download the agent installer from the Cortex XDR management console and distribute it using existing software deployment tools.. For a small deployment without existing infrastructure, the most straightforward method is to download the agent installer from the Cortex XDR management console. This console provides the correct installer version for the tenant and allows distribution through existing software deployment tools. Broker VMs, API automation, and support portal downloads are either unnecessary or less direct for this scenario.

Answer

Use the Cortex XDR API to generate a unique installer for each endpoint dynamically.

Answer

Deploy a Broker VM and configure it to push agent installers to endpoints automatically.

Answer

Download the installer from the Palo Alto Networks Customer Support Portal and install it manually on each endpoint.

Question 5

An administrator is planning the initial installation of Cortex XDR agents on 500 Windows endpoints. The security policy requires that endpoints authenticate to the Cortex XDR tenant during installation using a shared secret that can be rotated if compromised. Which item must the administrator generate in the Cortex XDR management console before installing the agents?

Accepted Answer

An agent installation token. The agent installation token is the shared secret that endpoints present during Cortex XDR agent installation to authenticate with the tenant. Administrators generate it in the management console and can rotate it if compromised. It is distinct from API keys and Broker VM tokens, which serve different authentication purposes in the Cortex XDR architecture.

Answer

A Broker VM registration token

Answer

A content update signing certificate

Answer

A Cortex XDR API key

Question 6

An administrator is planning a Cortex XDR agent rollout to a large fleet of Windows endpoints whose users are frequently offline and connect through a restricted proxy. The administrator needs the agents to receive new content and policy updates without user intervention and without direct internet egress from each endpoint. Which deployment planning consideration best addresses this requirement?

Accepted Answer

Deploy a Broker VM and configure it as an update and content distribution point so endpoints retrieve updates from the internal Broker VM instead of the cloud.. A Broker VM can be positioned inside the network to cache and distribute content and policy updates to agents, which is the standard approach when endpoints cannot reach the cloud directly. This lets offline or proxied endpoints stay current without user action, while the Broker VM maintains the cloud connection and reduces external bandwidth consumption.

Answer

Configure the agent to use the management console's public API endpoint directly for updates, bypassing the proxy.

Answer

Rely on the Cortex XDR agent's built-in offline license file so agents can update themselves locally without contacting any server.

Answer

Enable WildFire forwarding on each endpoint so the agent forwards files to the cloud and receives content updates in return.

Question 7

An administrator is planning a Cortex XDR agent rollout for 2,500 Windows servers that reside in a data center with no direct internet access. All outbound traffic must traverse an explicit forward proxy. The administrator wants agents to register successfully with the Cortex XDR cloud tenant. What should the administrator do first?

Accepted Answer

Configure the agent installation package with the explicit proxy address and port so agents can reach the Cortex XDR cloud.. In a no-direct-internet data center, the Cortex XDR agent cannot reach the cloud unless it is configured to use the explicit forward proxy. Providing the proxy address and port during installation or via policy lets the agent establish its outbound session and register, which is the foundation for receiving policy and sending telemetry.

Answer

Deploy a Broker VM in the data center and point agents to it as their management server instead of the cloud tenant.

Answer

Disable SSL inspection on the proxy for all traffic so agents can register without certificate issues.

Answer

Open inbound TCP 443 from the Cortex XDR cloud to each server so registration traffic can reach the agents.

Question 8

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

Accepted Answer

Broker VM. A Broker VM deployed at the remote office can cache content updates and threat intelligence, serving them to local endpoints. This reduces WAN traffic because endpoints retrieve updates from the Broker VM instead of the cloud. The management console and Cortex Data Lake are cloud-based and do not provide local caching. Agent local caching does not exist as a feature for sharing updates.

Answer

Cortex XDR agent with local caching enabled

Answer

Cortex Data Lake

Answer

Cortex XDR management console

Question 9

A security administrator is preparing to install Cortex XDR agents on a large number of Windows endpoints. The administrator wants to ensure that the agents automatically register with the correct Cortex XDR tenant and receive the appropriate policy settings. Which item must be included in the agent installation package or command line to achieve this?

Accepted Answer

The installation token generated in the Cortex XDR console. The installation token is the required credential for Cortex XDR agents to authenticate and register with the correct tenant during installation. It is generated in the management console and can be included in the installation package or command line for bulk deployments. Without it, agents cannot join the tenant or receive policies. The other options are not used for initial agent registration.

Answer

The Broker VM IP address

Answer

The Cortex XDR tenant API key

Answer

The Cortex XDR agent license key

Question 10

A security team is planning its first Cortex XDR deployment and must decide how to group endpoints so that different prevention policies apply to servers versus user workstations. Which planning action should the administrator take first?

Accepted Answer

Create endpoint groups and assign each group a tailored agent policy, then target the groups during installation.. Endpoint groups let administrators apply different agent policies to different endpoint categories, so servers and workstations can each receive appropriate prevention settings. Planning groups before installation ensures endpoints land in the correct policy from the start, avoiding manual reconfiguration and keeping the deployment organized and auditable.

Answer

Disable prevention modules on servers and rely solely on the workstations' policy to protect the environment.

Answer

Purchase separate Cortex XDR tenants for servers and workstations to keep their policies isolated.

Answer

Install all agents with the default policy, then manually edit each endpoint's local configuration after installation.

Question 11

A company is planning its first Cortex XDR deployment and wants to confirm which component is responsible for centrally storing endpoint telemetry, running analytics, and delivering policy to agents. Which component fulfills this role?

Accepted Answer

The Cortex XDR management console hosted in the cloud tenant.. The cloud-hosted Cortex XDR management console is the central management plane that stores telemetry, performs analytics, and distributes policy to agents. Agents enforce and report, while Broker VMs extend reach to isolated networks, but neither replaces the cloud tenant as the authoritative analytics and policy source.

Answer

The Cortex XDR agent installed on each endpoint.

Answer

The on-premises Cortex XDR server component installed by the customer.

Answer

The Broker VM deployed in the local network.

Question 12

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

Accepted Answer

Broker VM. The Broker VM is the Cortex XDR component designed to sit inside the customer network and mediate communication between agents and the cloud. When network policy forbids direct internet access from endpoints, routing agent traffic through a Broker VM provides the controlled egress the team requires while preserving telemetry, policy enforcement, and management connectivity.

Answer

Cortex XDR agent installation token

Answer

Cortex XDR Content Update package

Answer

Cortex XDR management console

Question 13

An administrator is planning a Cortex XDR deployment for a network that uses a forward proxy requiring authentication for all outbound traffic. Endpoints run Windows and must communicate with the Cortex XDR cloud tenant. Which planning configuration will allow agents to reach the cloud through the proxy without per-user credentials?

Accepted Answer

Configure the agent to use the proxy with credentials embedded in the agent installation package or agent settings so the service can authenticate.. Agents run as services and need their own proxy configuration to authenticate to a forward proxy. Specifying proxy settings and credentials in the agent installation or agent configuration ensures the service can reach the cloud tenant consistently, including when no user is logged in, which is essential for reliable management and content updates.

Answer

Enable transparent proxy mode on the endpoints so the agent's traffic is redirected without authentication.

Answer

Rely on the logged-in user's browser proxy settings, since the agent inherits the user's proxy configuration automatically.

Answer

Disable the proxy requirement for the Cortex XDR cloud URLs by adding them to the proxy's authentication bypass list.

Question 14

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

Accepted Answer

Deploy the agent MSI package with the installation token supplied as a command-line parameter through a software distribution tool.. Silent, unattended installation on Windows is achieved by distributing the agent MSI through a software deployment tool and passing the installation token as a command-line parameter. This lets each host register automatically with the tenant without interactive input, which is essential for large-scale rollouts.

Answer

Run the agent installer interactively on each endpoint and paste the installation token when prompted.

Answer

Install the agent without a token and rely on the cloud tenant to auto-assign the endpoint to a default policy.

Answer

Copy the agent installer to a network share and instruct users to double-click it from their desktops.

Question 15

An administrator is preparing to install Cortex XDR agents on 500 Windows servers. The security policy requires that the endpoint be automatically associated with the correct tenant and that agents report to the management console without manual per-endpoint registration. What must the administrator obtain from the Cortex XDR management console before starting the installation?

Accepted Answer

An agent installation token. The agent installation token is the credential that authorizes an endpoint to enroll with a specific Cortex XDR tenant. When embedded in the installer, it lets each Windows server register automatically without manual intervention. This is the standard mechanism for large-scale, policy-compliant deployments where every endpoint must land in the correct tenant.

Answer

A Broker VM registration code

Answer

A content update license key

Answer

An XDR analytics API key