XDR-Analyst Planning And Installation — Timed 10 Questions

Question 1

When planning a Cortex XDR deployment, what is the primary function of the Cortex XDR server component within the cloud architecture?

Accepted Answer

To act as the centralized management console, analytics engine, and data lake for security events. The Cortex XDR cloud backend hosts the analysis engine, data lake, and management console for threat investigation and policy configuration.

Answer

To replace the Panorama management server for firewall policy enforcement

Answer

To locally store raw endpoint memory dumps indefinitely without cloud transmission

Answer

To execute automated sandbox detonation for all enterprise email traffic

Question 2

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

Accepted Answer

A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM. Pairing a Broker VM requires generating a registration token in the Cortex XDR console and entering it into the Broker VM setup wizard.

Answer

A pre-shared IPSec tunnel key configured on the perimeter firewall

Answer

An imported enterprise PKI root certificate bundle

Answer

An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

Question 3

An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?

Accepted Answer

Tenant Management and Endpoint Groups with RBAC scoping. Multi-tenancy and role-based access control (RBAC) along with Endpoint Groups allow administrative segregation within a single tenant or via multi-tenant architecture.

Answer

Broker VM App Domains

Answer

Global Protect Gateway Zones

Answer

Virtual Router Contexts within the Agent Core

Question 4

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Broker VM serves as a local aggregator and proxy for Cortex XDR agents that are off-network, enabling secure communication with the Cortex XDR management console.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 5

You are planning the deployment of Cortex XDR agents across a mixed environment containing Windows, macOS, and Linux servers. During the sizing phase, you need to determine the resource allocation requirements for the Broker VM instances. Which hypervisor platform is officially supported for hosting the Broker VM image?

Accepted Answer

VMware ESXi. Palo Alto Networks provides the Broker VM as an OVF/OVA template supported on VMware ESXi as well as KVM, AWS, and Azure.

Answer

Docker Engine on Bare Metal Linux

Answer

Microsoft Hyper-V Generation 1 only

Answer

Citrix Hypervisor XenServer v6.5

Question 6

Before installing Cortex XDR agents on Windows endpoints, an administrator wants to verify system compatibility. Which minimum Windows operating system version is officially required for the current generation Cortex XDR Agent?

Accepted Answer

Windows 7 Service Pack 1 / Windows 10 and Windows Server 2012. Cortex XDR supports modern Windows operating systems starting from Windows 7 SP1 / Windows 10 and Windows Server 2008 R2 / 2012 and above, with exact support matrices updated per release.

Answer

Windows XP Service Pack 3

Answer

Windows 2000 Server Advanced

Answer

Windows Vista Enterprise

Question 7

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 8

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. Installation packages and transform files are accessed via Settings > Configurations > Endpoint Settings > Install Packages in the Cortex XDR console.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 9

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

Question 10

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

Accepted Answer

Kernel headers and dependent build tools matching the running kernel version. Linux agents rely on standard kernel headers, build essentials, or specific utilities depending on whether kernel modules or eBPF are utilized.

Answer

Microsoft .NET Framework 4.8 Runtime

Answer

IIS Web Server Role and ASP.NET

Answer

Active Directory Domain Services Client tools