Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?
Disable SIP (System Integrity Protection).
Configure a custom kernel panic handler in the boot-args.
Approve Full Disk Access and System Extensions.
macOS Catalina and later gate endpoint telemetry and network extension loading behind privacy controls. Approving Full Disk Access and System Extensions lets the Cortex XDR agent read protected files and load its filtering extensions, satisfying the full visibility and prevention requirement.
Install a local proxy certificate in the Keychain Access utility.
Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?
xdr-cli
traps-cli
cytool
Cytool is Cortex XDR's Windows endpoint CLI, reporting agent status, connection state and version via commands such as `cytool status` and `cytool info`. It satisfies the stem's requirement for a local command-line utility querying the installed agent directly, unlike console-based or network-scanning alternatives.
pan-agent-ctl
An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?
Exploit Protection profile
Data Collection profile
The Data Collection profile defines which agent logs are gathered and forwarded to the Cortex XDR server, so configuring it enables automatic upload without manual intervention. Other profiles govern protection or exploit behaviour, not log forwarding.
Agent Settings profile
Biometric Threat Prevention profile
An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?
Add the IP address to the Data Collection profile under restricted hosts.
Create a firewall policy on the next-generation firewall to bypass XDR isolation.
Configure an isolation exception rule specifying the permitted IP address.
Isolation exception rules in Cortex XDR permit specified IP addresses or domains to reach an isolated endpoint, bypassing the isolation block while all other traffic remains denied. This directly satisfies the responder's need to allow one remote management IP for remediation without lifting isolation entirely.
Disable the agent service via Live Terminal using the 'net stop' command.
An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?
MSI
MSI is the Windows Installer package that Group Policy Software Installation can deploy and silently install at computer startup. Downloading the MSI lets the administrator distribute the Cortex XDR agent through the existing Active Directory GPO without manual intervention.
EXE
PKG
TGZ
When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?
To encrypt the installation binary against unauthorized tampering during transit.
To automatically apply specific configuration and security settings upon agent registration.
The agent profile bundles configuration and security settings that the endpoint receives during registration. Assigning it to the installation package ensures each newly enrolled agent automatically inherits the correct policy, avoiding manual per-endpoint configuration after deployment.
To determine which operating system architecture (32-bit or 64-bit) the package will target.
To set the license expiration date for the endpoint.
Want more Cortex XDR Agent Configuration practice?
Practice this domainAn administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?
Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page
The Broker VM rejects the external API's certificate because its issuing CA is not in the default trust store. Uploading the custom CA bundle through the Broker VM management page adds that root to the trust store, allowing TLS validation to succeed and API log ingestion to proceed.
Add the target API IP address to the Broker VM local hosts file
Modify the Broker VM system kernel parameters to ignore cipher mismatches
Disable SSL/TLS verification globally for all Cortex XDR broker app modules
An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?
A Data Collection task pointing to the endpoint agent
A Post-Processing script executed directly on the Broker VM
A Condition (or Decision) block that evaluates the sandbox verdict output
A Condition (or Decision) block evaluates the sandbox task's verdict output, branching the workflow only when the malicious hash is confirmed. This satisfies the stem's requirement for conditional isolation, since the endpoint-isolation action executes solely on a true verdict, preventing unnecessary containment when analysis returns clean or inconclusive results.
A Manual Approval step without automated logic branching
Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?
Incidents > Response > Broker Status
Settings > Configurations > Data Integration > Broker VM
Broker VM health, status and log forwarding statistics are surfaced under Settings > Configurations > Data Integration > Broker VM, where each deployed broker's connectivity and forwarding metrics are displayed. This path satisfies the administrator's need to monitor broker operational state directly.
Marketplace > Integrations > Instances
Endpoints > Management > Agent Status
When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?
To determine the operating system kernel executing the automation script
To define the encryption key used for secure payload transit
To uniquely identify a specific configuration and credential set for an integration
The instance name uniquely identifies each configured integration instance, binding one credential set and parameter combination to a distinct label. This satisfies the scenario's need to run multiple connections to the same third-party feed, each with separate API keys, without configuration collisions.
To specify the physical network interface the integration binds to
An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?
Switch the syslog transport from TCP to ICMP tunneling
Enable verbose kernel debugging on the Cortex XDR agent
Decrease the agent keep-alive interval to force faster handshakes
Increase the syslog collector worker threads and queue size parameters in the Broker VM configuration
The syslog collector processes incoming messages with a fixed pool of worker threads and a bounded queue. Raising both parameters lets the Broker VM absorb bursts by parsing and buffering more concurrent messages, preventing drops when CPU and memory remain normal.
An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?
Configure the syslog collector instance on the Broker VM with a valid SSL/TLS certificate and private key
Configuring the syslog collector instance with a valid SSL/TLS certificate and private key enables encrypted Syslog-over-TLS ingestion on the Broker VM, directly satisfying the stem's TLS encryption requirement. The certificate and key terminate TLS at the collector, so forwarded logs travel encrypted rather than in plaintext.
Install an external IPsec VPN tunnel between the syslog source and the Cortex XDR cloud tenant
Modify the Windows Registry keys on the domain controller
Configure a reverse proxy on the endpoint agent with port forwarding
Want more Ingestion And Automation practice?
Practice this domainAn administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?
Go to Settings > Configurations > Broker VM.
Broker VM health, CPU and memory utilisation are surfaced under Settings > Configurations > Broker VM, where each deployed broker appliance is listed with its connection state and resource metrics. This satisfies the stem's requirement to monitor operational status directly in the Cortex XDR management console.
Go to XQL Search using dataset = broker_vm_logs.
Go to Dashboards > Broker VM Performance.
Go to Endpoint Management > Broker VM.
An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?
TCP port 389 and 636
TCP port 22 and 8080
TCP port 443
TCP 443 outbound satisfies the firewall constraint because Cortex XDR agents transmit telemetry to the management console over TLS-encrypted HTTPS, which uses TCP 443. Permitting this port allows agent registration, heartbeat, and event uploads through restricted egress rules without exposing additional ports.
UDP port 514
An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?
Go to Incident Response > Investigations.
Go to Endpoints > All Endpoints and check the Last Connected and Content Version columns.
Checking Endpoints > All Endpoints allows administrators to view real-time sync status, agent version, and policy application.
Go to Dashboards > Agent Health widget.
Go to Settings > Configurations > Agent Management.
An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?
pan_broker_status --syslog
netstat -tulnp
netstat -tulnp lists listening TCP and UDP sockets with numeric ports and owning processes, revealing whether the Broker VM's syslog listener is active. It also shows established connections, letting the administrator confirm connectivity status for the failing log source.
traceroute -syslog
systemctl check-syslog
An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?
Click the alert in the Incident view, select Add Exception, and define criteria such as file hash or digital signature.
Adding an exception directly from the alert lets you define precise matching criteria, such as file hash or digital signature, so the BIOC rule ignores only those known-good developer binaries. This satisfies the tuning requirement without authoring custom XQL exclusion queries.
Downgrade the agent content version to a legacy release.
Delete the default BIOC profile and create an entirely new tenant policy.
Restart the Cortex XDR Agent service on each developer workstation.
An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?
Settings > Content Updates > Status.
Incident Response > Endpoint Inventory.
Dashboards > Content Health.
Endpoints > All Endpoints view, under the Content Version column.
The All Endpoints view exposes a Content Version column, letting the administrator confirm the exact content release applied to a specific endpoint without opening its detail pane. This directly satisfies the requirement to verify the latest content version per endpoint, since the column reflects each agent's reported content build.
Want more Maintenance And Troubleshooting practice?
Practice this domainAn analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?
Change the agent operating mode to Bypass.
Tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria.
Adding process path exclusions or qualifying criteria narrows the rule so legitimate deployment activity no longer matches, reducing false positives while preserving true detections. This tuning step satisfies the requirement to address excessive false positives during normal software deployments.
Disable the entire Analytics engine on all endpoints.
Delete the BIOC rule and rely solely on default cloud-delivered IOCs.
An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?
Agent Settings -> Profiles -> Analytics
Threat Intelligence -> Feed Management
Incident Response -> Playbooks
Dashboards menu using a widget based on an XQL query
An XQL query widget in the Dashboards menu aggregates raw alert data, letting you group by endpoint and sort by count descending, then limit to 10. This satisfies the stem's requirement for a ranked top-10 view over a rolling 7-day window, which prebuilt widget templates cannot express.
An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?
Incident Export via Syslog
Data Export Service
BIOC Alert Notifications
Scheduled Reports in the Reporting menu
Scheduled Reports in the Reporting menu lets you define a recurring weekly schedule, select critical endpoint incidents as the data source, and deliver the output as a PDF by email — matching every constraint in the stem without manual export.
A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?
Agent Malware Prevention profile exception
Local firewall rule configuration
Sequence or threshold-based BIOC rule
A sequence or threshold BIOC rule correlates multiple events over a rolling window, counting sequential connection failures from the same source IP within 60 seconds. This satisfies the stated constraint, which a single-event rule cannot evaluate.
Static IOC file hash block rule
An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?
The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.
Linux endpoints do not support custom BIOC rules in Cortex XDR.
The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.
BIOC rules match against event fields and command structures from the endpoint telemetry schema. A rule written with Windows-specific fields cannot match Linux events, so identical commands execute without triggering the rule on Linux hosts.
Custom BIOCs require Cortex XSOAR to process Linux telemetry.
An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?
BIOC Rule Builder under Analytics
The BIOC Rule Builder under Analytics provides the Causality Analysis Engine syntax editor and built-in testing against live or historical endpoint data, letting the administrator author and validate the PowerShell download detection logic before deployment.
Host Insights Query Builder
Cortex XSOAR Playbook Designer
IOC Management under Malware Protection
Want more Detection And Reporting practice?
Practice this domainAn administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?
Deploy a Mobile Device Management (MDM) configuration profile containing the required system extension and network filter payloads
macOS Big Sur and later block kernel extensions, requiring system extensions and network filters to be approved. An MDM profile with the system extension and network filter payloads pre-approves them silently, delivering full agent functionality without per-endpoint user prompts.
Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode
Modify the /etc/pam.d/authorization file prior to running the PKG installer
Run the installer using sudo privileges with the --force flag
During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?
Prisma Access Remote Networks Connector
Cortex XDR Broker VM
The Broker VM acts as a proxy for agent communications, threat intelligence updates, and local file analysis in isolated networks.
Traps Management Service
Panorama Management Server
An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?
TCP ports 22, 80, and 443
TCP port 443
Cortex XDR agents communicate with the management tenant over outbound TCP port 443, carrying telemetry uploads and command-and-control traffic inside TLS. Permitting this single destination port satisfies strict outbound filtering without opening additional inbound or legacy ports.
UDP port 514 and TCP port 6514
TCP port 80 and 443
An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?
MSI
An MSI package is the only Cortex XDR agent format Group Policy Software Installation can deploy natively, satisfying the stem's GPO constraint across 5,000 endpoints. GPO assigns MSI installers at computer startup with SYSTEM privileges, enabling silent, scalable rollout. EXE and other formats require separate deployment tooling, so MSI is the correct export.
TGZ
PKG
EXE
An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?
Modify the Windows Registry on each endpoint to point to separate cloud regions
Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes
Folders and registration tokens allow logical separation and targeting of endpoints for different organizational units within the same tenant.
Deploy multiple Broker VMs on the same subnet and assign static VLAN tags
Install multiple instances of the Cortex XDR agent side-by-side on each endpoint
An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?
The Broker VM registration key contains invalid characters due to copy-paste formatting
The Cortex XDR management tenant license has expired due to billing cycle misalignment
An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM
SSL handshake errors arise when a middlebox intercepts TLS and presents a certificate the Broker VM does not trust, so the chain fails. An explicit proxy or firewall performing SSL decryption substitutes its own certificate; unless that CA is imported, the Broker VM rejects the handshake and cannot pull updates.
The Broker VM kernel version is incompatible with the Linux swap space partition size
Want more Planning And Installation practice?
Practice this domainThe vendor does not publish an exact question count for the XDR-Engineer. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Cortex XDR Agent Configuration, Ingestion And Automation, Maintenance And Troubleshooting, Detection And Reporting, Planning And Installation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks XDR-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.