XDR-Engineer Practice Exam 3 — 20 Questions

Question 1

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Syslog (UDP and TCP). The Broker VM Log Collector module natively supports ingestion protocols such as Syslog (UDP/TCP) and HTTP/HTTPS APIs.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 2

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. Standard Windows Installer (msiexec) uses '/qn' or '/quiet' to perform a completely silent installation.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 3

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

Accepted Answer

Agents automatically download and apply content updates periodically from the cloud or Broker VM without requiring agent software upgrades. Cortex XDR agents automatically download content updates directly from the cloud management tenant or via a Broker VM on a regular schedule.

Answer

Content updates must be manually downloaded from the Palo Alto Networks Customer Support Portal and pushed via GPO

Answer

Agents require a full software re-installation every time a content update is released

Answer

Agents only receive content updates when the operating system is rebooted into safe mode

Question 4

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Endpoints can be grouped based on operating system, naming conventions, IP subnets, or domain membership.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 5

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

Accepted Answer

Configure custom Agent Settings profiles with appropriate exclusions for database files and directories.. Creating custom Agent Profiles with tailored scanning exclusions and profile settings ensures critical database directories and processes are not overly impacted by standard scanning behaviors.

Answer

Disable all behavioral threat protection features on database servers.

Answer

Set the agent operating mode to disabled via the command line.

Answer

Install only the Traps module without the Cortex XDR agent core.

Question 6

An administrator is preparing to uninstall the Cortex XDR agent from a protected Windows endpoint for troubleshooting purposes. Which THREE methods or tools can be used to successfully remove the agent? (Choose three)

Accepted Answer

Using the Windows 'Add or Remove Programs' interface provided the uninstallation password is supplied.. Cortex XDR agent uninstallation is strictly controlled. It can be performed using the Uninstallation Password via Windows Apps, via the cytool utility with the proper password, or by sending an uninstall command from the Cortex XDR management console.

Answer

Deleting the Cortex XDR program files folder directly in Windows Explorer while the services are running.

Answer

Running the standard Windows Registry Editor to delete the primary endpoint MAC address key.

Question 7

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

Accepted Answer

The agent installation will fail or certain kernel-dependent prevention and monitoring modules will not load properly. Certain Linux preventive and behavioral monitoring features rely on kernel modules that require matching kernel headers/devel packages to compile successfully during installation.

Answer

The endpoint will experience an immediate kernel panic and enter a reboot loop

Answer

The agent will automatically download the correct kernel source code from the public Linux kernel archives

Answer

The agent will operate normally without any functional limitations because Linux does not use kernel modules for security

Question 8

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

Accepted Answer

Static IP addressing or reserved DHCP lease for the Broker VM.. Deploying a Broker VM requires provisioning adequate virtual hardware resources, ensuring outbound connectivity to the cloud, and configuring proper network reachability for log sources.

Answer

Direct root SSH access enabled by default from external public IP addresses.

Answer

Local installation of a full Microsoft SQL Server database instance on the VM.

Question 9

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM can be configured as a proxy/forwarder to proxy agent connections to the Cortex XDR cloud when direct internet access is prohibited.

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine

Answer

WildFire Appliance

Question 10

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Accepted Answer

Standardized installation parameters and property passing (e.g., /qn, /norestart). MSI packages offer standard command-line properties, easy integration with GPO/SCCM, and built-in support for transforms (MST).

Answer

Built-in capability to execute shell scripts on Linux servers

Answer

Automatic conversion of EXE payloads into macOS PKG files

Answer

Exemption from all Windows User Account Control (UAC) prompts without admin rights

Question 11

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Broker VMs ingest syslog over standard ports (such as UDP/TCP 514 or custom ports) and communicate with agents/cloud over TCP 443.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 12

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

Accepted Answer

Ensure the account performing the installation possesses local Administrator or root privileges. Deploying Cortex XDR in hardened environments requires ensuring third-party security software (like legacy AV) is uninstalled or properly excluded, and making sure necessary OS permissions are intact.

Answer

Format all local hard drives with FAT32 to ensure compatibility with Cortex XDR telemetry databases

Answer

Disable Windows User Account Control (UAC) by modifying the hardware BIOS settings

Answer

Disable all local Windows firewall rules and delete the TCP/IP stack registry keys

Question 13

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool command-line utility is built into the Cortex XDR agent on Windows and is used for management, troubleshooting, and querying agent status.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 14

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Accepted Answer

Quarantines the file and terminates the running process.. When PUA prevention is set to block, the agent terminates the execution of the application and prevents it from running.

Answer

Sends an alert to the console but allows the application to continue running.

Answer

Isolates the entire endpoint from the corporate network.

Answer

Deletes the file permanently from the disk without creating a quarantine backup.

Question 15

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR allows administrators to schedule reports through the Reporting section by defining parameters and delivery frequency.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 16

What is the function of an Exploit Protection profile in Cortex XDR?

Accepted Answer

To prevent memory-based attacks and protect applications from exploitation techniques.. Exploit Protection profiles safeguard applications against memory-based attacks, buffer overflows, and software vulnerabilities.

Answer

To encrypt endpoint hard drives using BitLocker or FileVault.

Answer

To control USB mass storage device access.

Answer

To detect and block known malware hashes during file scans.

Question 17

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. Agent Settings profiles control operational aspects of the agent, such as password protection, uninstallation permissions, and update schedules.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 18

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Disabling agent protection locally via cytool requires entering the administrative anti-tampering password defined in the Agent Settings profile.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 19

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Accepted Answer

Endpoints > Policy Rules > Malware Protection. File and folder exclusions that apply to malware scans and behavioral threat protection are configured within the Malware Protection profile under Endpoints > Policy Rules.

Answer

Response > Live Terminal > Policies

Answer

Settings > Access Control > Exceptions

Answer

Data Collection > Rules > Exclusions

Question 20

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM acts as an intermediary collector and proxy for endpoints that cannot reach the cloud directly.

Answer

GlobalProtect Gateway

Answer

WildFire Appliance

Answer

Palo Alto Networks Panorama Server