XDR-Analyst Planning And Installation — Timed 20 Questions

Question 1

When planning a Cortex XDR deployment, what is the primary function of the Cortex XDR server component within the cloud architecture?

Accepted Answer

To act as the centralized management console, analytics engine, and data lake for security events. The Cortex XDR cloud backend hosts the analysis engine, data lake, and management console for threat investigation and policy configuration.

Answer

To replace the Panorama management server for firewall policy enforcement

Answer

To locally store raw endpoint memory dumps indefinitely without cloud transmission

Answer

To execute automated sandbox detonation for all enterprise email traffic

Question 2

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

Accepted Answer

A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM. Pairing a Broker VM requires generating a registration token in the Cortex XDR console and entering it into the Broker VM setup wizard.

Answer

A pre-shared IPSec tunnel key configured on the perimeter firewall

Answer

An imported enterprise PKI root certificate bundle

Answer

An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

Question 3

An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?

Accepted Answer

Tenant Management and Endpoint Groups with RBAC scoping. Multi-tenancy and role-based access control (RBAC) along with Endpoint Groups allow administrative segregation within a single tenant or via multi-tenant architecture.

Answer

Broker VM App Domains

Answer

Global Protect Gateway Zones

Answer

Virtual Router Contexts within the Agent Core

Question 4

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Broker VM serves as a local aggregator and proxy for Cortex XDR agents that are off-network, enabling secure communication with the Cortex XDR management console.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 5

You are planning the deployment of Cortex XDR agents across a mixed environment containing Windows, macOS, and Linux servers. During the sizing phase, you need to determine the resource allocation requirements for the Broker VM instances. Which hypervisor platform is officially supported for hosting the Broker VM image?

Accepted Answer

VMware ESXi. Palo Alto Networks provides the Broker VM as an OVF/OVA template supported on VMware ESXi as well as KVM, AWS, and Azure.

Answer

Docker Engine on Bare Metal Linux

Answer

Microsoft Hyper-V Generation 1 only

Answer

Citrix Hypervisor XenServer v6.5

Question 6

Before installing Cortex XDR agents on Windows endpoints, an administrator wants to verify system compatibility. Which minimum Windows operating system version is officially required for the current generation Cortex XDR Agent?

Accepted Answer

Windows 7 Service Pack 1 / Windows 10 and Windows Server 2012. Cortex XDR supports modern Windows operating systems starting from Windows 7 SP1 / Windows 10 and Windows Server 2008 R2 / 2012 and above, with exact support matrices updated per release.

Answer

Windows XP Service Pack 3

Answer

Windows 2000 Server Advanced

Answer

Windows Vista Enterprise

Question 7

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 8

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. Installation packages and transform files are accessed via Settings > Configurations > Endpoint Settings > Install Packages in the Cortex XDR console.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 9

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

Question 10

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

Accepted Answer

Kernel headers and dependent build tools matching the running kernel version. Linux agents rely on standard kernel headers, build essentials, or specific utilities depending on whether kernel modules or eBPF are utilized.

Answer

Microsoft .NET Framework 4.8 Runtime

Answer

IIS Web Server Role and ASP.NET

Answer

Active Directory Domain Services Client tools

Question 11

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. Installation tokens/passwords protect the agent from unauthorized removal, tampering, or uninstallation by local end-users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 12

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

Accepted Answer

Cortex Data Lake. The Cortex Data Lake is the cloud-based repository that stores all enterprise telemetry and logs for Cortex XDR.

Answer

Local Agent SQLite Cache

Answer

Panorama Log Collector Appliance

Answer

Broker VM Internal Hard Disk

Question 13

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

In the Agent Settings profile within the Cortex XDR management console. Proxy settings for Cortex XDR agents are configured within the Agent Settings profile in the Cortex XDR management console.

Answer

On the local Broker VM CLI configuration menu

Answer

Via the Palo Alto Networks Firewall URL Filtering profile

Answer

Directly inside the Windows registry under HKLM\Software\Cyvera\Proxy

Question 14

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

Accepted Answer

.msi Windows Installer package. Group Policy Software Installation (MSI) requires an .msi installation package.

Answer

.rpm Red Hat Package Manager file

Answer

.exe self-extracting archive with embedded arguments

Answer

.dmg disk image format

Question 15

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

Accepted Answer

The specific regional Cortex XDR tenant FQDNs and update distribution domains. Cortex XDR agents require outbound HTTPS access to the specific regional Cortex XDR cloud tenant URLs provided by Palo Alto Networks.

Answer

A static list of Palo Alto Networks global headquarters IP addresses

Answer

Only local internal DNS servers

Answer

Public NTP servers only

Question 16

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

Accepted Answer

To update detection rules, behavioral heuristics, and malware signatures on the agent. Content updates deliver updated detection rules, behavioral signatures, and policy adjustments to the endpoint agent without requiring a full software upgrade.

Answer

To upgrade the core operating system of the host endpoint

Answer

To upgrade the Broker VM hypervisor kernel version

Answer

To renew the TLS certificates of the Palo Alto Networks support portal

Question 17

An administrator is planning network bandwidth utilization for Cortex XDR agents deployed across 10,000 endpoints. Which mechanism does Cortex XDR use to minimize WAN bandwidth consumption during content updates and software upgrades?

Accepted Answer

Incremental, lightweight signature updates delivered dynamically over HTTPS. Content updates and signatures are lightweight, and proxy/Broker VM caching can further assist, though agents primarily download directly or via designated distribution mechanisms.

Answer

Mandatory FTP file transfer during off-peak midnight hours only

Answer

Peer-to-peer multicast streaming across all local subnets

Answer

Local caching and distribution exclusively through Domain Controllers via GPO

Question 18

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

Accepted Answer

TCP/UDP port 514. By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Answer

TCP port 636 for secure LDAP syslog

Answer

UDP port 123 for Network Time Protocol

Answer

TCP port 8080 for HTTP forwarding

Question 19

An administrator needs to verify that the Broker VM is successfully running and communicating with all configured apps. Where in the Cortex XDR management console can the administrator check the real-time operational status and health of the Broker VM?

Accepted Answer

Settings > Configurations > Broker VM. Broker VM health and status can be monitored in the Cortex XDR console under Settings > Configurations > Broker VM.

Answer

Dashboards > Incident Overview > Broker Status

Answer

Endpoints > All Endpoints > Infrastructure View

Answer

Reports > Scheduled Reports > VM Health

Question 20

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

Accepted Answer

Through a Broker VM configured to download and distribute content updates locally within the air-gapped network. In air-gapped environments, agents receive updates through a local Broker VM configured as a content proxy/gateway that syncs from an internal source or offline bundle.

Answer

Via dial-up modem backup lines connected directly to Palo Alto Networks support

Answer

Air-gapped environments are not supported by Cortex XDR under any circumstances

Answer

Updates are physically loaded via USB thumb drive into every endpoint agent daily