Planning And Installation

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

An enterprise environment requires the Cortex XDR Broker VM to be sized correctly for handling log forwarding and agent proxying from 15,000 endpoints. Which minimum hardware specification should the administrator allocate for the Broker VM hypervisor?

During the initial setup of a Cortex XDR tenant, where does the administrator navigate in the management console to download agent installation packages for various operating systems?

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

An administrator needs to upgrade the Cortex XDR agents across all enterprise endpoints. Where should the administrator upload and manage the new agent software versions before rolling them out?

An administrator is deploying the Cortex XDR agent on a virtual desktop infrastructure (VDI) non-persistent pool. Which configuration consideration is critical to ensure proper management and prevent duplicate endpoint entries in the Cortex XDR console?

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

An administrator wants to verify the version of the Cortex XDR agent running on a specific macOS endpoint. Which command should be executed in the macOS Terminal?

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

An administrator is troubleshooting an agent installation failure on a Windows endpoint. Where is the primary installation log file generated by the MSI installer located for review?

An organization has strict compliance requirements preventing direct internet access from any server. The administrator deploys a Broker VM to act as an agent proxy. How must the agent installation command be modified so that endpoints know to communicate through the Broker VM instead of directly reaching the cloud?

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

An administrator is planning the deployment of Cortex XDR agent protection on servers running critical databases. To prevent potential performance interference or locks on specific database files during agent scans, what should the administrator configure?

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

An administrator is planning a Cortex XDR deployment across a segmented network architecture where endpoints reside in a zone without direct internet access, but have access to a local proxy. Which TWO configuration steps are required to route agent traffic through this proxy? (Choose two)

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

An administrator is planning the deployment of Cortex XDR agent tamper protection. Which TWO administrative actions or scenarios are protected against when tamper protection is enabled on endpoints? (Choose two)

An administrator is planning an upgrade cycle for Cortex XDR agents. Which TWO best practices should be followed to ensure a smooth upgrade process across the enterprise? (Choose two)

An administrator is planning the initial deployment of Cortex XDR agents across a mixed environment of Windows and macOS endpoints. Which firewall port and protocol must be opened outbound from the endpoints to ensure successful registration and telemetry reporting to the Cortex XDR management console?

An organization is preparing to deploy the Cortex XDR agent using Microsoft Active Directory Group Policy Objects (GPO). Which installation package format is natively supported for GPO deployment of the agent on Windows endpoints?

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

An administrator is configuring a Cortex XDR Broker VM to collect logs from third-party syslog sources within a segregated network zone. Which prerequisite must be met on the network firewall to allow the Broker VM to successfully receive syslog data?

During a large-scale Cortex XDR agent deployment using a Software Distribution Tool, administrators notice that multiple endpoints show identical agent IDs (UUIDs) in the Cortex XDR management console, causing telemetry to overwrite. What caused this issue?

An administrator needs to install the Cortex XDR agent on a fleet of headless Linux servers using a silent installation script. Which parameter must be included alongside the installation package to successfully bind the agent to the correct Cortex XDR tenant?

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

An administrator is planning the deployment of Cortex XDR agents across endpoints and needs to configure Agent Settings profiles. Which TWO configurations can be managed directly within an Agent Settings profile? (Choose two)

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

An administrator is preparing to uninstall the Cortex XDR agent from a protected Windows endpoint for troubleshooting purposes. Which THREE methods or tools can be used to successfully remove the agent? (Choose three)