XDR-Engineer Practice Test 2 — 30 Questions

Question 1

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.. Content update failures on isolated endpoints usually stem from firewall blocking content distribution URLs or proxy issues.

Answer

Broker VM database corruption.

Answer

Lack of available disk space in the /boot partition of the endpoint.

Answer

Failure of the local endpoint DNS server to resolve Active Directory domain controllers.

Question 2

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). Broker VM application and collector logs are located in standard directories such as /var/log/pan/ or specific broker log paths.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 3

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Different endpoint groups (e.g., servers vs. workstations) require different security thresholds, scan schedules, and operational modes, necessitating multiple profiles.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 4

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Agent connectivity troubleshooting requires checking outbound HTTPS reachability to the tenant and verifying valid agent proxy or DNS resolution settings.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 5

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Accepted Answer

Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.. Cloud Data Collectors connecting to external APIs require correct tenant permissions, API keys, or service principal credentials.

Answer

Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.

Answer

Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.

Answer

Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.

Question 6

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the cloud tenant via HTTPS over TCP port 443.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 7

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

Accepted Answer

PKG format for macOS endpoints. macOS uses PKG installer packages, while Linux distributions typically use RPM or DEB packages.

Answer

MSI format for Linux endpoints

Answer

EXE format for macOS endpoints

Answer

DMG format for headless Linux servers

Question 8

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Accepted Answer

Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.. Optimizing XQL queries involves narrowing time ranges, filtering early, and utilizing indexed fields.

Answer

Export all raw logs to a local spreadsheet application for filtering.

Answer

Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.

Question 9

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Infrastructure > Broker VMs. Broker VM health and status are monitored under the Broker VMs page in the Cortex XDR console.

Answer

Settings > Configurations > Broker VMs

Answer

Endpoints > Broker VMs

Answer

XDR Devices > Infrastructure > Broker VMs

Question 10

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

Accepted Answer

DNS resolution capable of resolving the Cortex XDR tenant domain name. Agents require outbound HTTPS (TCP 443) connectivity and valid DNS resolution to connect to the Cortex XDR cloud tenant.

Answer

Inbound TCP port 8080 access from the cloud tenant to every individual endpoint

Answer

Bidirectional UDP port 514 syslog peering across all local subnets

Answer

Active Directory LDAP bind access configured directly on the agent CLI

Question 11

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Accepted Answer

Syslog (UDP and TCP). The Broker VM Log Collector module natively supports ingestion protocols such as Syslog (UDP/TCP) and HTTP/HTTPS APIs.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 12

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. Standard Windows Installer (msiexec) uses '/qn' or '/quiet' to perform a completely silent installation.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 13

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

Accepted Answer

Agents automatically download and apply content updates periodically from the cloud or Broker VM without requiring agent software upgrades. Cortex XDR agents automatically download content updates directly from the cloud management tenant or via a Broker VM on a regular schedule.

Answer

Content updates must be manually downloaded from the Palo Alto Networks Customer Support Portal and pushed via GPO

Answer

Agents require a full software re-installation every time a content update is released

Answer

Agents only receive content updates when the operating system is rebooted into safe mode

Question 14

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Endpoints can be grouped based on operating system, naming conventions, IP subnets, or domain membership.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 15

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

Accepted Answer

Configure custom Agent Settings profiles with appropriate exclusions for database files and directories.. Creating custom Agent Profiles with tailored scanning exclusions and profile settings ensures critical database directories and processes are not overly impacted by standard scanning behaviors.

Answer

Disable all behavioral threat protection features on database servers.

Answer

Set the agent operating mode to disabled via the command line.

Answer

Install only the Traps module without the Cortex XDR agent core.

Question 16

An administrator is preparing to uninstall the Cortex XDR agent from a protected Windows endpoint for troubleshooting purposes. Which THREE methods or tools can be used to successfully remove the agent? (Choose three)

Accepted Answer

Using the Windows 'Add or Remove Programs' interface provided the uninstallation password is supplied.. Cortex XDR agent uninstallation is strictly controlled. It can be performed using the Uninstallation Password via Windows Apps, via the cytool utility with the proper password, or by sending an uninstall command from the Cortex XDR management console.

Answer

Deleting the Cortex XDR program files folder directly in Windows Explorer while the services are running.

Answer

Running the standard Windows Registry Editor to delete the primary endpoint MAC address key.

Question 17

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

Accepted Answer

The agent installation will fail or certain kernel-dependent prevention and monitoring modules will not load properly. Certain Linux preventive and behavioral monitoring features rely on kernel modules that require matching kernel headers/devel packages to compile successfully during installation.

Answer

The endpoint will experience an immediate kernel panic and enter a reboot loop

Answer

The agent will automatically download the correct kernel source code from the public Linux kernel archives

Answer

The agent will operate normally without any functional limitations because Linux does not use kernel modules for security

Question 18

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

Accepted Answer

Static IP addressing or reserved DHCP lease for the Broker VM.. Deploying a Broker VM requires provisioning adequate virtual hardware resources, ensuring outbound connectivity to the cloud, and configuring proper network reachability for log sources.

Answer

Direct root SSH access enabled by default from external public IP addresses.

Answer

Local installation of a full Microsoft SQL Server database instance on the VM.

Question 19

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM can be configured as a proxy/forwarder to proxy agent connections to the Cortex XDR cloud when direct internet access is prohibited.

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine

Answer

WildFire Appliance

Question 20

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Accepted Answer

Standardized installation parameters and property passing (e.g., /qn, /norestart). MSI packages offer standard command-line properties, easy integration with GPO/SCCM, and built-in support for transforms (MST).

Answer

Built-in capability to execute shell scripts on Linux servers

Answer

Automatic conversion of EXE payloads into macOS PKG files

Answer

Exemption from all Windows User Account Control (UAC) prompts without admin rights