XDR-Engineer Practice Test 12 — 15 Questions

Question 1

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Accepted Answer

All inbound and outbound network traffic is blocked except for allowed management traffic to Cortex XDR and defined exceptions.. Option C is correct because Cortex XDR network isolation enforces a host-based firewall/network containment policy that blocks all inbound and outbound traffic except the management channel to Cortex XDR (and any administrator-defined exceptions), allowing the agent to remain reachable for response actions. Option D is correct because isolation is designed to preserve remote responder access, so administrators can still use Live Terminal to investigate and remediate the endpoint while it is contained. Option E is correct because the agent can display a user notification banner on the isolated endpoint when that setting is configured, informing the local user of the isolation state. Option A is incorrect because isolation is a software-enforced network containment action and does not cut physical power to the hardware. Option B is incorrect because isolation does not delete local user accounts; account modification is not part of the isolation behavior.

Answer

The endpoint physical hardware power supply is automatically shut off.

Answer

All local user accounts on the machine are permanently deleted.

Question 2

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Accepted Answer

Standardized installation parameters and property passing (e.g., /qn, /norestart). Option A is correct because MSI packages are installed via msiexec.exe, which provides standardized, documented parameters such as /qn for silent installation and /norestart to suppress reboots, making them ideal for automated software distribution tools that need predictable, scriptable installs. Option D is correct because Windows Installer natively supports transforms (.MST files), which let administrators customize an MSI (e.g., preconfigure Cortex XDR registration tokens, tenant IDs, or installation paths) without repackaging, a key advantage for scalable enterprise deployment. Option B is incorrect because MSI is a Windows Installer technology and has no built-in capability to run shell scripts on Linux servers. Option C is incorrect because MSI packages cannot automatically convert EXE payloads into macOS PKG files; that is not a function of Windows Installer. Option E is incorrect because MSI installation does not exempt an agent from UAC prompts, and administrative rights are still required to install system-level services such as the Cortex XDR agent.

Answer

Built-in capability to execute shell scripts on Linux servers

Answer

Automatic conversion of EXE payloads into macOS PKG files

Answer

Exemption from all Windows User Account Control (UAC) prompts without admin rights

Question 3

An organization is preparing to deploy the Cortex XDR agent using Microsoft Active Directory Group Policy Objects (GPO). Which installation package format is natively supported for GPO deployment of the agent on Windows endpoints?

Accepted Answer

Windows Installer Package (.msi). Group Policy deployment natively supports Microsoft Installer (.msi) packages for software distribution.

Answer

Compressed Archive (.zip)

Answer

Executable (.exe)

Answer

PowerShell Script (.ps1)

Question 4

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

Accepted Answer

Agents automatically download and apply content updates periodically from the cloud or Broker VM without requiring agent software upgrades. Cortex XDR agents are designed to automatically pull content updates — exploit signatures, analytics rules, and behavioral detection content — from the Cortex XDR cloud or a Broker VM on a periodic basis, without requiring agent software upgrades. This keeps detection current with minimal administrative effort.

Answer

Content updates must be manually downloaded from the Palo Alto Networks Customer Support Portal and pushed via GPO

Answer

Agents require a full software re-installation every time a content update is released

Answer

Agents only receive content updates when the operating system is rebooted into safe mode

Question 5

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Accepted Answer

To provide pre-packaged integrations, playbooks, dashboards, and automation building blocks. Content packs in Marketplace package pre-built integrations, playbooks, dashboards, and incident types.

Answer

To install local antivirus signatures directly onto endpoint file systems

Answer

To store encrypted backups of Cortex XDR database records

Answer

To compile raw C++ source code for custom endpoint isolation drivers

Question 6

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

Accepted Answer

API Key / Token Authentication. Option A (API Key / Token Authentication) is correct because Cortex XSOAR integrations commonly authenticate to third-party REST APIs by sending a static API key or bearer token in a header or query parameter, which the integration's configuration parameters store and reference. Option C (OAuth2, using either the Authorization Code or Client Credentials flow) is correct because XSOAR supports OAuth2-based integrations where the integration generates and refreshes access tokens against the vendor's authorization server, with Client Credentials used for machine-to-machine access and Authorization Code for user-delegated access. The remaining options are not authentication methods for API integrations: rotary dial pulse signaling and physical punch cards are obsolete telephony and data-entry mechanisms, and plain text Telnet login prompts are an insecure legacy remote-shell authentication method, none of which Cortex XSOAR uses to authenticate API integrations.

Answer

Rotary dial pulse signaling

Answer

Physical punch cards

Answer

Plain text Telnet login prompts

Question 7

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

Accepted Answer

Microsoft Windows. Microsoft Windows (A) is officially supported because Cortex XDR agents are distributed as native Windows installers (MSI/EXE) for supported Windows workstation and server releases. Apple macOS (B) is officially supported via signed PKG/DMG agent packages for supported macOS versions. Linux (E) is officially supported across various distributions such as Red Hat, Ubuntu, and CentOS, using RPM/DEB packages or the installation script. Apple iOS (C) and Google Android (D) are not supported for Cortex XDR agent deployments because those mobile platforms are covered by separate mobile security offerings rather than the endpoint agent.

Answer

Apple iOS

Answer

Google Android

Question 8

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Accepted Answer

Check the script syntax and dependencies for missing PowerShell modules or inaccessible file paths on the host.. Option B is correct because exit code errors frequently stem from the script itself — a syntax mistake, a missing PowerShell module (e.g., not available in the system context), or a file path that does not exist on the endpoint will cause the script to terminate with a non-zero exit code. Option C is correct because Cortex XDR Remote Actions execute scripts non-interactively in the background under the system account, so any cmdlet or script that triggers a GUI prompt (e.g., Read-Host, Out-GridView, credential pop-ups) will hang or fail with an exit code. Option D is correct because the target endpoint's PowerShell execution policy (Restricted, AllSigned, RemoteSigned, Bypass, etc.) governs whether the delivered script can run at all; if it is set to Restricted or AllSigned without a valid signature, execution is blocked and an exit code error results. Option A is not required because Cortex XDR Remote Actions do not depend on Kerberos constrained delegation across the domain — WinRM connectivity to the endpoint is what matters, not domain-wide delegation. Option E is incorrect because the Broker VM is used for network/agent communication and does not need PowerShell remoting enabled; PowerShell execution happens on the target endpoint, not on the Broker VM.

Answer

Ensure that WinRM is configured with Kerberos delegation across the entire Active Directory domain.

Answer

Verify that the Cortex XDR Broker VM has PowerShell remoting enabled.

Question 9

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Accepted Answer

Settings > Configurations > Data Integration > Broker VM. Broker VM monitoring and status can be checked under Settings > Configurations > Data Integration > Broker VM.

Answer

Incidents > Response > Broker Status

Answer

Marketplace > Integrations > Instances

Answer

Endpoints > Management > Agent Status

Question 10

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

Accepted Answer

Initiate a file quarantine and retrieval request for forensic analysis.. Option A is correct because Cortex XDR's built-in response actions include quarantining files on the endpoint agent and retrieving them for forensic analysis, allowing automated containment and evidence collection. Option D is correct because terminating a malicious process is a standard endpoint response action that the agent can execute directly on the host. Option E is correct because endpoint isolation is a core Cortex XDR/XSOAR response action that cuts the agent's network connectivity (except to the management console) to stop lateral movement. Options B and C are not valid: full OS reinstallation from a recovery partition and remote BIOS firmware reflashing are not built-in Cortex XDR agent response actions and would require separate imaging or firmware management tooling.

Answer

Force a full operating system reinstallation from a clean recovery partition.

Answer

Reflash the target endpoint device BIOS firmware remotely.

Question 11

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Accepted Answer

The endpoint must allow PowerShell script execution and the Cortex XDR agent service must be running with administrative privileges.. For a PowerShell remediation script to run successfully via Cortex XDR Remote Actions on a Windows endpoint, the endpoint must allow PowerShell script execution (e.g., ExecutionPolicy not restricted) and the Cortex XDR agent service must be running with administrative privileges. The agent service executes scripts in the context of the SYSTEM account, which requires admin rights.

Answer

The Broker VM must be configured as a script relay server.

Answer

The endpoint must have WinRM enabled on TCP port 5985.

Answer

The user must be logged into an active GUI session.

Question 12

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Unisolate.. In Cortex XDR, isolation is a containment action that restricts network connectivity except to the management console. To restore connectivity after remediation, the administrator selects the endpoint in Endpoints > All Endpoints and clicks Unisolate. This action releases the isolation policy and restores normal network access.

Answer

Delete and recreate the endpoint agent installation token.

Answer

Reboot the endpoint twice in safe mode.

Answer

Run 'cytool set isolation disable' locally via command line.

Question 13

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Accepted Answer

Sequence or threshold-based BIOC rule. To evaluate stateful conditions across multiple events over a specific time window, sequence or threshold-based behavioral analytics / BIOC rules must be configured.

Answer

Agent Malware Prevention profile exception

Answer

Local firewall rule configuration

Answer

Static IOC file hash block rule

Question 14

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

Accepted Answer

DNS resolution capable of resolving the Cortex XDR tenant domain name. Option A is correct because Cortex XDR agents must resolve the tenant-specific domain name (e.g., .xdr..paloaltonetworks.com) via DNS so they can locate and communicate with the correct cloud tenant for registration, policy retrieval, and telemetry upload. Option E is correct because agent-to-tenant communication occurs over outbound TCP 443 (HTTPS/TLS), which must be permitted through firewalls and proxies for the agent to check in, download content updates, and send endpoint data. Option B is incorrect because the agent initiates outbound connections to the cloud; inbound TCP 8080 from the tenant to each endpoint is not a deployment prerequisite. Option C is incorrect because UDP 514 syslog peering is unrelated to Cortex XDR agent connectivity and is not required across local subnets. Option D is incorrect because LDAP bind access is not configured on the agent CLI; Active Directory integration is handled at the management/console level, not as an agent network prerequisite.

Answer

Inbound TCP port 8080 access from the cloud tenant to every individual endpoint

Answer

Bidirectional UDP port 514 syslog peering across all local subnets

Answer

Active Directory LDAP bind access configured directly on the agent CLI

Question 15

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

Accepted Answer

Endpoints > All Endpoints view, under the Content Version column.. The Endpoints table displays the Content Version column for each managed endpoint.

Answer

Settings > Content Updates > Status.

Answer

Incident Response > Endpoint Inventory.

Answer

Dashboards > Content Health.