XDR-Engineer Cortex XDR Agent Configuration — 15 Questions

Question 1

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the status and logs of the Cyvera.Service.exe service on the endpoint.. Checking the Cyvera.Service.exe logs (or collector log files) on the endpoint helps determine if communication with the Cortex XDR server is failing or if registration is corrupted.

Answer

Reboot the Panorama management server to push the updated profile.

Answer

Run the migration tool to upgrade the agent installer package.

Answer

Restart the Palo Alto Networks Cortex Data Lake collector service.

Question 2

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Accepted Answer

Endpoints > Policy Rules > Malware Protection. Exclusions for scans and behavioral monitoring in Cortex XDR are configured within the Malware Protection profile, which is managed under Endpoints > Policy Rules. This is where administrators add folder, file, or process exclusions that apply to the targeted endpoints. The Malware Protection profile is the correct location for both scan exclusions and behavioral monitoring exclusions.

Answer

Response > Live Terminal > Policies

Answer

Settings > Access Control > Exceptions

Answer

Data Collection > Rules > Exclusions

Question 3

A security administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows endpoints. Where is this setting configured in the Cortex XDR management console?

Accepted Answer

Endpoints > Global Settings > Agent Settings. Agent settings, including the anti-tampering password and protection features, are configured under Endpoints > Global Settings > Agent Settings.

Answer

Settings > Configurations > Collector

Answer

Response > Endpoint Management > Settings

Answer

Endpoints > Policy Rules > Malware Protection

Question 4

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Accepted Answer

cytool log collect. The cytool log collect command is the correct utility to gather all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. It bundles agent logs, configuration, and diagnostic data into a zip file that can be sent to support for analysis.

Answer

cytool debug generate

Answer

cytool dump-logs

Answer

cytool export support-bundle

Question 5

An administrator suspects that a Cortex XDR agent on a Windows endpoint is experiencing high CPU utilization due to aggressive behavioral threat monitoring. Which cytool subcommand can be used locally to inspect or modify runtime tracing and debugging levels?

Accepted Answer

cytool log level. The 'cytool runtime' or 'cytool log' commands allow administrators to adjust tracing levels locally for diagnostic purposes. Specifically, cytool management features include runtime parameter inspection.

Answer

cytool trace modify

Answer

cytool monitor cpu-throttle

Answer

cytool runtime query

Question 6

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Accepted Answer

Endpoints > Policy Rules. Security profiles such as Malware Protection and Exploit Protection are created and managed under Endpoints > Policy Rules in the Cortex XDR management console. This section contains the policy rules that bind profiles to endpoint groups, and it is where administrators author and edit the profiles themselves. Navigating here allows creation of new profiles and assignment to targets.

Answer

Settings > Endpoint Configuration

Answer

Dashboards > Profiles

Answer

Response > Profiles

Question 7

An administrator wants to verify which agents are assigned to a specific security profile. Where can this mapping be reviewed in the Cortex XDR management console?

Accepted Answer

Endpoints > Policy Rules. The Endpoints > Policy Rules section displays rule assignments and which endpoints or folders fall under each specific profile.

Answer

Settings > Agents > Mapping

Answer

Response > Inventory > Profiles

Answer

Dashboards > Profile Assignment

Question 8

An administrator needs to deploy Cortex XDR agents across a large Linux environment using Puppet. Which installation parameter is typically required during scripted deployments to ensure the agent registers with the correct Cortex XDR tenant?

Accepted Answer

--tenant-id and --server-url. Scripted and automated installations require specifying parameters such as the server address or registration token/key if not embedded in the package name.

Answer

REGISTER_CLOUD=active

Answer

DOM_JOIN=true and SEC_PASS=password

Answer

CONFIG_PROFILE=default

Question 9

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Accepted Answer

Collect troubleshooting logs into a support archive using `cytool log collect`.. cytool allows administrators to query agent status, check connectivity, manage protection settings, and gather troubleshooting logs locally.

Answer

Reconfigure the endpoint's DHCP IP address lease.

Answer

Perform a firmware update on the endpoint motherboard BIOS.

Answer

Modify local Active Directory Group Policy objects.

Question 10

Which THREE methods can be used to obtain Cortex XDR agent installation packages? (Choose three)

Accepted Answer

Downloading directly from the Endpoints > Distributions page in the Cortex XDR management console. Option A is correct because the Cortex XDR management console provides a dedicated Endpoints > Distributions page where administrators can download the standard agent installation packages for supported operating systems directly. Option B is correct because the console allows you to create custom installation packages that are bound to a specific agent profile, ensuring the endpoint registers with the intended policy configuration upon installation. Option D is correct because Cortex XDR exposes API endpoints that enable automated generation and retrieval of agent installation packages, which is useful for large-scale or scripted deployments. Option C is incorrect because Palo Alto Networks does not distribute Cortex XDR agent installers via physical USB flash drives from hardware support. Option E is incorrect because Cortex XDR agent installers are proprietary and are not published to public repositories such as npm or PyPI.

Answer

Requesting physical USB flash drives shipped directly from Palo Alto Networks hardware support

Answer

Downloading installers from public software repositories like npm or PyPI

Question 11

Where in the Cortex XDR management console does an administrator generate the installation packages (installer files and matching installation tokens) for endpoints?

Accepted Answer

Under Endpoints > Global Settings > Install Packages. Administrators generate agent installation packages under Endpoints > Global Settings > Install Packages.

Answer

Under Dashboards > Agent Status > Download

Answer

Under Response > Content Updates > Agents

Answer

Under Settings > Configurations > Endpoints

Question 12

An administrator needs to temporarily disable the Cortex XDR agent on a Windows endpoint to troubleshoot a conflicting third-party application. Which method should be used?

Accepted Answer

Execute 'cytool protection disable' locally using the authorized disable password.. To disable agent protection features without uninstalling, the administrator must use the 'Disable Agent' action from the Cortex XDR console or use the cytool command-line utility locally with the correct authorization password.

Answer

Delete the Cortex XDR driver files from System32/drivers.

Answer

Disable the Windows Firewall network adapter binding.

Answer

Stop the Cortex XDR service from the Windows Services management console (services.msc).

Question 13

When configuring Agent Settings profiles in Cortex XDR, which THREE behavioral threat protection or prevention modules can be tuned or enabled? (Choose three)

Accepted Answer

Behavioral Threat Protection. Cortex XDR Agent Settings profiles allow administrators to configure modules such as Anti-Malware, Exploit Protection, and Behavioral Threat Protection.

Answer

Active Directory Domain Controller Replication

Answer

BGP Routing Table Synchronization

Question 14

An administrator is troubleshooting an endpoint where the Cortex XDR agent is showing a 'Disconnected' status in the management console. Which THREE troubleshooting steps should the administrator perform using the local 'cytool' utility? (Choose three)

Accepted Answer

Run 'cytool log collect' to gather diagnostic logs for analysis or support escalation.. Using cytool locally, an administrator can verify the connection status, check the management server address configuration, and test or restart the agent service.

Answer

Run 'cytool policy wipe' to factory reset the operating system network stack.

Answer

Run 'cytool kernel compile' to rebuild the Windows kernel table.

Question 15

A security engineer needs to prevent Cortex XDR agents on a group of Windows servers from automatically upgrading to newer agent versions, while still allowing content updates to be delivered. The servers are managed through an Agent Settings profile. Which configuration should the engineer apply?

Accepted Answer

Disable the 'Allow Agent Upgrade' setting in the Agent Settings profile and leave content updates enabled.. The requirement is to stop agent version upgrades while keeping content updates. Cortex XDR provides the 'Allow Agent Upgrade' setting within Agent Settings profiles to control automatic upgrades. Disabling this setting prevents version changes without affecting content delivery, which is managed separately. The other options either reference non-existent settings or use unsupported methods, so only the profile-based toggle achieves the goal.

Answer

Set the agent version to a fixed version in the Agent Settings profile and enable 'Content Update' only.

Answer

Create a new agent installation package with the desired version and deploy it via a software distribution tool, then disable automatic upgrades globally.

Answer

Modify the content update schedule to exclude agent binaries and enable 'Prevent Agent Downgrade'.