XDR-Engineer Practice Test 2 — 25 Questions

Question 1

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.. SIEM forwarding troubleshooting involves verifying network connectivity, TLS/certificate parameters, and destination port accessibility.

Answer

Restart the Cortex XDR management console web server.

Answer

Reinstall the Windows operating system on the SIEM receiver.

Question 2

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Accepted Answer

All network traffic is blocked except for communication with the Cortex XDR management console and designated exceptions.. Network isolation blocks all inbound and outbound network traffic except for communication with the Cortex XDR management console.

Answer

All local agent prevention modules are automatically disabled.

Answer

The endpoint automatically shuts down after 10 minutes of isolation.

Answer

Local user login is completely disabled and the physical screen turns black.

Question 3

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

Accepted Answer

yum install ./cxdr-agent.rpm. Linux agent installations on RHEL utilize standard package managers like yum or rpm with the provided agent package and prerequisites.

Answer

apt-get install ./cortex-xdr.deb

Answer

brew install paloalto-cortex-xdr

Answer

rpm -i ctrex-agent.rpm

Question 4

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Broker VM troubleshooting involves checking system resource consumption, container/service status, and collector log outputs.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 5

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. macOS uses system extension management commands such as 'systemextensionsctl' to inspect loaded and approved extensions.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status

Question 6

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.. Content update failures on isolated endpoints usually stem from firewall blocking content distribution URLs or proxy issues.

Answer

Broker VM database corruption.

Answer

Lack of available disk space in the /boot partition of the endpoint.

Answer

Failure of the local endpoint DNS server to resolve Active Directory domain controllers.

Question 7

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). Broker VM application and collector logs are located in standard directories such as /var/log/pan/ or specific broker log paths.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 8

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Different endpoint groups (e.g., servers vs. workstations) require different security thresholds, scan schedules, and operational modes, necessitating multiple profiles.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 9

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Agent connectivity troubleshooting requires checking outbound HTTPS reachability to the tenant and verifying valid agent proxy or DNS resolution settings.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 10

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Accepted Answer

Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.. Cloud Data Collectors connecting to external APIs require correct tenant permissions, API keys, or service principal credentials.

Answer

Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.

Answer

Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.

Answer

Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.

Question 11

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the cloud tenant via HTTPS over TCP port 443.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 12

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

Accepted Answer

PKG format for macOS endpoints. macOS uses PKG installer packages, while Linux distributions typically use RPM or DEB packages.

Answer

MSI format for Linux endpoints

Answer

EXE format for macOS endpoints

Answer

DMG format for headless Linux servers

Question 13

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Accepted Answer

Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.. Optimizing XQL queries involves narrowing time ranges, filtering early, and utilizing indexed fields.

Answer

Export all raw logs to a local spreadsheet application for filtering.

Answer

Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.

Question 14

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Infrastructure > Broker VMs. Broker VM health and status are monitored under the Broker VMs page in the Cortex XDR console.

Answer

Settings > Configurations > Broker VMs

Answer

Endpoints > Broker VMs

Answer

XDR Devices > Infrastructure > Broker VMs

Question 15

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

Accepted Answer

DNS resolution capable of resolving the Cortex XDR tenant domain name. Agents require outbound HTTPS (TCP 443) connectivity and valid DNS resolution to connect to the Cortex XDR cloud tenant.

Answer

Inbound TCP port 8080 access from the cloud tenant to every individual endpoint

Answer

Bidirectional UDP port 514 syslog peering across all local subnets

Answer

Active Directory LDAP bind access configured directly on the agent CLI

Question 16

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Accepted Answer

Syslog (UDP and TCP). The Broker VM Log Collector module natively supports ingestion protocols such as Syslog (UDP/TCP) and HTTP/HTTPS APIs.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 17

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. Standard Windows Installer (msiexec) uses '/qn' or '/quiet' to perform a completely silent installation.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 18

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

Accepted Answer

Agents automatically download and apply content updates periodically from the cloud or Broker VM without requiring agent software upgrades. Cortex XDR agents automatically download content updates directly from the cloud management tenant or via a Broker VM on a regular schedule.

Answer

Content updates must be manually downloaded from the Palo Alto Networks Customer Support Portal and pushed via GPO

Answer

Agents require a full software re-installation every time a content update is released

Answer

Agents only receive content updates when the operating system is rebooted into safe mode

Question 19

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Endpoints can be grouped based on operating system, naming conventions, IP subnets, or domain membership.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 20

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

Accepted Answer

Configure custom Agent Settings profiles with appropriate exclusions for database files and directories.. Creating custom Agent Profiles with tailored scanning exclusions and profile settings ensures critical database directories and processes are not overly impacted by standard scanning behaviors.

Answer

Disable all behavioral threat protection features on database servers.

Answer

Set the agent operating mode to disabled via the command line.

Answer

Install only the Traps module without the Cortex XDR agent core.