Cortex XDR Agent Configuration

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

What is the primary function of an Agent Settings profile in Cortex XDR?

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

What is the function of an Exploit Protection profile in Cortex XDR?

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

An administrator manages a Cortex XDR deployment where endpoints connect to the Cortex XDR server through an internal proxy. The security team requires that all agent-to-server communication use the proxy, but also wants the agent to bypass the proxy when reaching internal Cortex XDR appliances on the local network. Which configuration in the agent installation package achieves this?

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

A Cortex XDR administrator needs to ensure that all Windows endpoints in a specific department use the same behavioral threat prevention settings and that changes apply immediately when the profile is edited. Which configuration approach should the administrator use?