Planning And Installation

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

An administrator is planning the deployment of Cortex XDR agent protection on servers running critical databases. To prevent potential performance interference or locks on specific database files during agent scans, what should the administrator configure?

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

An administrator is planning a Cortex XDR deployment across a segmented network architecture where endpoints reside in a zone without direct internet access, but have access to a local proxy. Which TWO configuration steps are required to route agent traffic through this proxy? (Choose two)

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

An administrator is planning the deployment of Cortex XDR agent tamper protection. Which TWO administrative actions or scenarios are protected against when tamper protection is enabled on endpoints? (Choose two)

An administrator is planning an upgrade cycle for Cortex XDR agents. Which TWO best practices should be followed to ensure a smooth upgrade process across the enterprise? (Choose two)

An administrator is planning the initial deployment of Cortex XDR agents across a mixed environment of Windows and macOS endpoints. Which firewall port and protocol must be opened outbound from the endpoints to ensure successful registration and telemetry reporting to the Cortex XDR management console?

An organization is preparing to deploy the Cortex XDR agent using Microsoft Active Directory Group Policy Objects (GPO). Which installation package format is natively supported for GPO deployment of the agent on Windows endpoints?

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

An administrator is configuring a Cortex XDR Broker VM to collect logs from third-party syslog sources within a segregated network zone. Which prerequisite must be met on the network firewall to allow the Broker VM to successfully receive syslog data?

During a large-scale Cortex XDR agent deployment using a Software Distribution Tool, administrators notice that multiple endpoints show identical agent IDs (UUIDs) in the Cortex XDR management console, causing telemetry to overwrite. What caused this issue?

An administrator needs to install the Cortex XDR agent on a fleet of headless Linux servers using a silent installation script. Which parameter must be included alongside the installation package to successfully bind the agent to the correct Cortex XDR tenant?

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

An administrator is planning the deployment of Cortex XDR agents across endpoints and needs to configure Agent Settings profiles. Which TWO configurations can be managed directly within an Agent Settings profile? (Choose two)

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

An administrator is planning the deployment of Cortex XDR agents to a large number of endpoints that are located in a remote branch office with limited bandwidth. The administrator wants to minimize the impact on the WAN link during agent installation and content updates. Which deployment method should be used to achieve this goal?

An administrator is preparing to deploy the Cortex XDR agent to a large group of Windows endpoints. To ensure the agent can be installed silently without interactive prompts and to control the installation path, which method should the administrator use?

A security engineer is planning the deployment of Cortex XDR agents to endpoints that are located in a remote office with limited bandwidth. The engineer wants to minimize the impact on the network during the initial agent registration and content updates. Which Cortex XDR component should be deployed on-premises to cache content and reduce WAN traffic?

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints across multiple geographic locations. To optimize bandwidth and reduce latency for agent communication, the administrator decides to deploy Broker VMs. Which component of the Cortex XDR architecture is responsible for forwarding endpoint data to the Cortex XDR cloud when a Broker VM is used?

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to obtain the agent installation package that includes the tenant-specific configuration. Where should the administrator download this package?

A security administrator is installing a Cortex XDR Broker VM in a highly secure environment where internet access is restricted. The Broker VM must be able to communicate with the Cortex XDR cloud to receive updates and forward data. Which network configuration must be allowed to ensure successful operation?

A Cortex XDR engineer is deploying the Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must be able to receive updates and communicate with the Cortex XDR cloud. Which configuration should the engineer implement to allow this communication?

An administrator is planning to deploy Cortex XDR agents to a group of endpoints that do not have direct internet access. The administrator has deployed a Broker VM to act as a proxy. Which agent installation parameter must be specified during installation to ensure the agent communicates with the Broker VM instead of the Cortex XDR cloud?

A security architect is planning a Cortex XDR deployment for a large enterprise with 8,000 endpoints across three geographic regions. The company requires that all endpoint telemetry and alerts be stored within the region where each endpoint resides, and that no data leaves that region. Which Cortex XDR deployment architecture should the architect recommend?

A Cortex XDR administrator is planning to deploy the agent on a Windows Server 2019 that hosts a Microsoft SQL Server database. The database server has high I/O and memory usage. The administrator wants to ensure that the Cortex XDR agent does not degrade database performance. Which action should the administrator take?

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

A Cortex XDR administrator is planning to deploy agents to endpoints that are behind a web proxy that requires authentication. The administrator wants to ensure that the agents can register and communicate with the Cortex XDR cloud without manual intervention. What should the administrator do?

An administrator is planning to deploy Cortex XDR agents on macOS endpoints and needs to ensure that the agents have the necessary permissions to monitor system activity. Which TWO actions must be performed on each macOS endpoint? (Choose two.)

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

An administrator is designing a Cortex XDR deployment for a network with strict egress filtering. The security team wants to ensure that agents can communicate with the Cortex XDR cloud and receive updates. Which outbound communication method should be allowed to meet this requirement with minimal open ports?

A security administrator is planning to deploy the Cortex XDR agent to 500 Linux servers across multiple data centers. The organization wants to minimize administrative effort and ensure the agent is always running with the latest features. The servers have varying Linux distributions and kernel versions. Which deployment method should the administrator use?