XDR-Engineer Practice Questions 2 — 50 Questions

Question 1

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Broker VMs ingest syslog over standard ports (such as UDP/TCP 514 or custom ports) and communicate with agents/cloud over TCP 443.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 2

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

Accepted Answer

Ensure the account performing the installation possesses local Administrator or root privileges. Deploying Cortex XDR in hardened environments requires ensuring third-party security software (like legacy AV) is uninstalled or properly excluded, and making sure necessary OS permissions are intact.

Answer

Format all local hard drives with FAT32 to ensure compatibility with Cortex XDR telemetry databases

Answer

Disable Windows User Account Control (UAC) by modifying the hardware BIOS settings

Answer

Disable all local Windows firewall rules and delete the TCP/IP stack registry keys

Question 3

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool command-line utility is built into the Cortex XDR agent on Windows and is used for management, troubleshooting, and querying agent status.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 4

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Accepted Answer

Quarantines the file and terminates the running process.. When PUA prevention is set to block, the agent terminates the execution of the application and prevents it from running.

Answer

Sends an alert to the console but allows the application to continue running.

Answer

Isolates the entire endpoint from the corporate network.

Answer

Deletes the file permanently from the disk without creating a quarantine backup.

Question 5

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR allows administrators to schedule reports through the Reporting section by defining parameters and delivery frequency.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 6

What is the function of an Exploit Protection profile in Cortex XDR?

Accepted Answer

To prevent memory-based attacks and protect applications from exploitation techniques.. Exploit Protection profiles safeguard applications against memory-based attacks, buffer overflows, and software vulnerabilities.

Answer

To encrypt endpoint hard drives using BitLocker or FileVault.

Answer

To control USB mass storage device access.

Answer

To detect and block known malware hashes during file scans.

Question 7

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. Agent Settings profiles control operational aspects of the agent, such as password protection, uninstallation permissions, and update schedules.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 8

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Disabling agent protection locally via cytool requires entering the administrative anti-tampering password defined in the Agent Settings profile.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 9

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Accepted Answer

Endpoints > Policy Rules > Malware Protection. File and folder exclusions that apply to malware scans and behavioral threat protection are configured within the Malware Protection profile under Endpoints > Policy Rules.

Answer

Response > Live Terminal > Policies

Answer

Settings > Access Control > Exceptions

Answer

Data Collection > Rules > Exclusions

Question 10

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM acts as an intermediary collector and proxy for endpoints that cannot reach the cloud directly.

Answer

GlobalProtect Gateway

Answer

WildFire Appliance

Answer

Palo Alto Networks Panorama Server

Question 11

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Accepted Answer

Endpoints > Policy Rules. Security profiles in Cortex XDR are managed under the Endpoints > Policy Rules section.

Answer

Settings > Endpoint Configuration

Answer

Dashboards > Profiles

Answer

Response > Profiles

Question 12

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. When an endpoint is isolated, administrators can define network exceptions (such as specific IP addresses or ports) in the Response or Global Settings to allow remediation traffic.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 13

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning a profile to an installation package ensures that the endpoint immediately adopts the correct configuration, security rules, and data collection settings upon registration.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 14

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Accepted Answer

Network connectivity issues or firewall blocks preventing outbound communication to the Cortex XDR backend.. Network connectivity issues, firewall blocks on outgoing ports (like HTTPS port 443), or proxy misconfigurations commonly cause agents to lose connection to the Cortex XDR cloud.

Answer

The agent license count has been exceeded by one license.

Answer

The Data Collection profile was modified to reduce log verbosity.

Answer

The local endpoint user changed their Windows login password.

Question 15

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Accepted Answer

File, folder, and hash exclusion lists. Malware Protection profiles control scanning parameters, exclusions, and actions for detected threats like malware and PUA.

Answer

Anti-tampering password for agent uninstallation

Answer

Broker VM proxy port forwarding schedules

Answer

Browser-based exploit mitigation rules

Question 16

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Accepted Answer

All inbound and outbound network traffic is blocked except for allowed management traffic to Cortex XDR and defined exceptions.. Endpoint isolation cuts off general network communication while preserving critical management channels such as communication with the Cortex XDR cloud and optionally defined exceptions.

Answer

The endpoint physical hardware power supply is automatically shut off.

Answer

All local user accounts on the machine are permanently deleted.

Question 17

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Accepted Answer

Use the .msi package with the /quiet and /norestart parameters.. To silently install the Cortex XDR agent using GPO or third-party deployment tools, administrators use the MSI installation package with the /quiet and /norestart parameters.

Answer

Use the .exe package and modify the registry before execution.

Answer

Use the .exe package with the /silent switch.

Answer

Use the .pkg package with the --unattended flag.

Question 18

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management view provides a comprehensive inventory table of all deployed agents, their status, versions, and details.

Answer

Dashboards > Health > Agents

Answer

Response > Endpoint Status

Answer

Settings > Agent Management > Status

Question 19

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Accepted Answer

Operating system type (e.g., Windows, macOS, Linux). Dynamic endpoint grouping in Cortex XDR can be based on criteria such as operating system type and Active Directory organizational units or naming patterns.

Answer

Physical office desk location number

Answer

BIOS manufacturer serial number color

Answer

Local user account password expiration date

Question 20

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Accepted Answer

cytool log collect. The 'cytool log collect' command generates a diagnostic archive containing all relevant agent logs for support or advanced troubleshooting.

Answer

cytool debug generate

Answer

cytool dump-logs

Answer

cytool export support-bundle