XDR-Engineer Cortex XDR Agent Configuration — 20 Questions

Question 1

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the status and logs of the Cyvera.Service.exe service on the endpoint.. Checking the Cyvera.Service.exe logs (or collector log files) on the endpoint helps determine if communication with the Cortex XDR server is failing or if registration is corrupted.

Answer

Reboot the Panorama management server to push the updated profile.

Answer

Run the migration tool to upgrade the agent installer package.

Answer

Restart the Palo Alto Networks Cortex Data Lake collector service.

Question 2

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Accepted Answer

Endpoints > Policy Rules > Malware Protection. Exclusions for scans and behavioral monitoring in Cortex XDR are configured within the Malware Protection profile, which is managed under Endpoints > Policy Rules. This is where administrators add folder, file, or process exclusions that apply to the targeted endpoints. The Malware Protection profile is the correct location for both scan exclusions and behavioral monitoring exclusions.

Answer

Response > Live Terminal > Policies

Answer

Settings > Access Control > Exceptions

Answer

Data Collection > Rules > Exclusions

Question 3

A security administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows endpoints. Where is this setting configured in the Cortex XDR management console?

Accepted Answer

Endpoints > Global Settings > Agent Settings. Agent settings, including the anti-tampering password and protection features, are configured under Endpoints > Global Settings > Agent Settings.

Answer

Settings > Configurations > Collector

Answer

Response > Endpoint Management > Settings

Answer

Endpoints > Policy Rules > Malware Protection

Question 4

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Accepted Answer

cytool log collect. The cytool log collect command is the correct utility to gather all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. It bundles agent logs, configuration, and diagnostic data into a zip file that can be sent to support for analysis.

Answer

cytool debug generate

Answer

cytool dump-logs

Answer

cytool export support-bundle

Question 5

An administrator suspects that a Cortex XDR agent on a Windows endpoint is experiencing high CPU utilization due to aggressive behavioral threat monitoring. Which cytool subcommand can be used locally to inspect or modify runtime tracing and debugging levels?

Accepted Answer

cytool log level. The 'cytool runtime' or 'cytool log' commands allow administrators to adjust tracing levels locally for diagnostic purposes. Specifically, cytool management features include runtime parameter inspection.

Answer

cytool trace modify

Answer

cytool monitor cpu-throttle

Answer

cytool runtime query

Question 6

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Accepted Answer

Endpoints > Policy Rules. Security profiles such as Malware Protection and Exploit Protection are created and managed under Endpoints > Policy Rules in the Cortex XDR management console. This section contains the policy rules that bind profiles to endpoint groups, and it is where administrators author and edit the profiles themselves. Navigating here allows creation of new profiles and assignment to targets.

Answer

Settings > Endpoint Configuration

Answer

Dashboards > Profiles

Answer

Response > Profiles

Question 7

An administrator wants to verify which agents are assigned to a specific security profile. Where can this mapping be reviewed in the Cortex XDR management console?

Accepted Answer

Endpoints > Policy Rules. The Endpoints > Policy Rules section displays rule assignments and which endpoints or folders fall under each specific profile.

Answer

Settings > Agents > Mapping

Answer

Response > Inventory > Profiles

Answer

Dashboards > Profile Assignment

Question 8

An administrator needs to deploy Cortex XDR agents across a large Linux environment using Puppet. Which installation parameter is typically required during scripted deployments to ensure the agent registers with the correct Cortex XDR tenant?

Accepted Answer

--tenant-id and --server-url. Scripted and automated installations require specifying parameters such as the server address or registration token/key if not embedded in the package name.

Answer

REGISTER_CLOUD=active

Answer

DOM_JOIN=true and SEC_PASS=password

Answer

CONFIG_PROFILE=default

Question 9

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Accepted Answer

Collect troubleshooting logs into a support archive using `cytool log collect`.. cytool allows administrators to query agent status, check connectivity, manage protection settings, and gather troubleshooting logs locally.

Answer

Reconfigure the endpoint's DHCP IP address lease.

Answer

Perform a firmware update on the endpoint motherboard BIOS.

Answer

Modify local Active Directory Group Policy objects.

Question 10

Which THREE methods can be used to obtain Cortex XDR agent installation packages? (Choose three)

Accepted Answer

Downloading directly from the Endpoints > Distributions page in the Cortex XDR management console. Option A is correct because the Cortex XDR management console provides a dedicated Endpoints > Distributions page where administrators can download the standard agent installation packages for supported operating systems directly. Option B is correct because the console allows you to create custom installation packages that are bound to a specific agent profile, ensuring the endpoint registers with the intended policy configuration upon installation. Option D is correct because Cortex XDR exposes API endpoints that enable automated generation and retrieval of agent installation packages, which is useful for large-scale or scripted deployments. Option C is incorrect because Palo Alto Networks does not distribute Cortex XDR agent installers via physical USB flash drives from hardware support. Option E is incorrect because Cortex XDR agent installers are proprietary and are not published to public repositories such as npm or PyPI.

Answer

Requesting physical USB flash drives shipped directly from Palo Alto Networks hardware support

Answer

Downloading installers from public software repositories like npm or PyPI

Question 11

Where in the Cortex XDR management console does an administrator generate the installation packages (installer files and matching installation tokens) for endpoints?

Accepted Answer

Under Endpoints > Global Settings > Install Packages. Administrators generate agent installation packages under Endpoints > Global Settings > Install Packages.

Answer

Under Dashboards > Agent Status > Download

Answer

Under Response > Content Updates > Agents

Answer

Under Settings > Configurations > Endpoints

Question 12

An administrator needs to temporarily disable the Cortex XDR agent on a Windows endpoint to troubleshoot a conflicting third-party application. Which method should be used?

Accepted Answer

Execute 'cytool protection disable' locally using the authorized disable password.. To disable agent protection features without uninstalling, the administrator must use the 'Disable Agent' action from the Cortex XDR console or use the cytool command-line utility locally with the correct authorization password.

Answer

Delete the Cortex XDR driver files from System32/drivers.

Answer

Disable the Windows Firewall network adapter binding.

Answer

Stop the Cortex XDR service from the Windows Services management console (services.msc).

Question 13

When configuring Agent Settings profiles in Cortex XDR, which THREE behavioral threat protection or prevention modules can be tuned or enabled? (Choose three)

Accepted Answer

Behavioral Threat Protection. Cortex XDR Agent Settings profiles allow administrators to configure modules such as Anti-Malware, Exploit Protection, and Behavioral Threat Protection.

Answer

Active Directory Domain Controller Replication

Answer

BGP Routing Table Synchronization

Question 14

An administrator is troubleshooting an endpoint where the Cortex XDR agent is showing a 'Disconnected' status in the management console. Which THREE troubleshooting steps should the administrator perform using the local 'cytool' utility? (Choose three)

Accepted Answer

Run 'cytool log collect' to gather diagnostic logs for analysis or support escalation.. Using cytool locally, an administrator can verify the connection status, check the management server address configuration, and test or restart the agent service.

Answer

Run 'cytool policy wipe' to factory reset the operating system network stack.

Answer

Run 'cytool kernel compile' to rebuild the Windows kernel table.

Question 15

A security engineer needs to prevent Cortex XDR agents on a group of Windows servers from automatically upgrading to newer agent versions, while still allowing content updates to be delivered. The servers are managed through an Agent Settings profile. Which configuration should the engineer apply?

Accepted Answer

Disable the 'Allow Agent Upgrade' setting in the Agent Settings profile and leave content updates enabled.. The requirement is to stop agent version upgrades while keeping content updates. Cortex XDR provides the 'Allow Agent Upgrade' setting within Agent Settings profiles to control automatic upgrades. Disabling this setting prevents version changes without affecting content delivery, which is managed separately. The other options either reference non-existent settings or use unsupported methods, so only the profile-based toggle achieves the goal.

Answer

Set the agent version to a fixed version in the Agent Settings profile and enable 'Content Update' only.

Answer

Create a new agent installation package with the desired version and deploy it via a software distribution tool, then disable automatic upgrades globally.

Answer

Modify the content update schedule to exclude agent binaries and enable 'Prevent Agent Downgrade'.

Question 16

An administrator is configuring a new Cortex XDR agent settings profile for a group of Windows servers that must never be rebooted automatically after an agent upgrade. Which setting in the agent settings profile should the administrator configure to control this behavior?

Accepted Answer

Disable 'Allow Agent to Reboot Endpoint After Upgrade' in the agent settings profile.. The agent settings profile includes a specific setting that governs whether the agent can reboot the endpoint after an upgrade. Disabling this setting prevents automatic reboots, which is critical for servers that must maintain uptime. Other options either control upgrade timing or describe non-existent features, and do not directly prevent the reboot.

Answer

Set the 'Agent Upgrade' policy to 'Manual' so that upgrades are only applied when an administrator approves them.

Answer

Configure a 'Reboot Suppression' exception in the endpoint policy for the server group.

Answer

Enable 'Agent Auto Upgrade' and set the schedule to a maintenance window.

Question 17

An administrator is configuring a Cortex XDR agent policy for a group of Linux servers. The organization requires that the agent automatically isolate an endpoint from the network when a critical malware event is detected, and also wants to collect additional forensic data such as running processes and network connections upon such an event. Which TWO Cortex XDR agent settings should the administrator configure to meet these requirements? (Choose two.)

Accepted Answer

Enable the 'Endpoint Isolation' action in the Malware profile.. To automatically isolate an endpoint and collect forensic data upon a critical malware event, the administrator should enable both 'Endpoint Isolation' and 'Forensic Data Collection' in the Malware profile. These settings work together to contain the threat and gather valuable evidence without manual intervention. Other options do not provide these automated capabilities.

Answer

Configure a 'Live Terminal' session to run automatically on malware detection.

Answer

Create a custom IOC with the action 'Isolate Endpoint'.

Answer

Set the 'Agent Action' to 'Block and Report' for all malware events.

Question 18

A Cortex XDR administrator needs to prevent users in the engineering department from stopping the agent service on their Windows endpoints, while still allowing them to view the agent tray icon and run manual scans. Which agent setting should the administrator configure in the Agent Settings profile?

Accepted Answer

Enable 'Agent Tamper Protection' to prevent unauthorized modification or stopping of the agent service.. Agent Tamper Protection is the specific Cortex XDR agent setting that prevents unauthorized stopping or modification of the agent service. It ensures the agent remains running and protected from tampering, which directly satisfies the requirement to block service stoppage while preserving tray icon visibility and manual scan capabilities. Other settings either do not prevent service stoppage or conflict with the allowed user actions.

Answer

Enable 'Password Protection' and set a strong password that is required to uninstall or stop the agent service.

Answer

Enable 'Behavioral Threat Protection' and set the action to 'Block' for all threat categories.

Answer

Configure 'Agent Settings' to hide the tray icon and disable manual scan options for all users.

Question 19

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not connecting to the management console. The administrator wants to verify the agent's configuration and connectivity. Which TWO actions should the administrator perform to gather relevant information? (Choose two.)

Accepted Answer

Run 'cytool config show' to display the current agent configuration, including proxy settings.. The 'cytool status' command verifies the agent's connection state and version, while 'cytool config show' displays the current configuration, including proxy settings. Together, these two actions provide the necessary information to diagnose why the agent is not connecting to the management console. Other commands either check unrelated aspects or are more suited for deeper log analysis.

Answer

Run 'cytool log collect' to generate a support bundle for analysis.

Answer

Run 'sc query CortexXDR' to verify the agent service is running.

Answer

Run 'netstat -ano | findstr 443' to check if the agent is listening on port 443.

Question 20

A Cortex XDR administrator is configuring a new agent profile for a group of Linux servers. The administrator needs to ensure that the agent can perform live terminal response actions, such as running scripts and retrieving files, without requiring an interactive user session. Which agent setting should be enabled?

Accepted Answer

Enable 'Allow Agent Actions without User Session' in the agent settings to permit background response actions.. The 'Allow Agent Actions without User Session' setting is specifically designed to enable Cortex XDR agent response actions, such as live terminal and file retrieval, on endpoints where no user is logged in. This is critical for servers that run headless. Enabling this setting ensures that the agent can execute commands and scripts in the background, fulfilling the requirement without needing an interactive session.

Answer

Enable 'Remote Shell' and configure it to run as root without requiring a user login.

Answer

Configure the agent to run as a systemd service with the '--allow-interactive' flag.

Answer

Enable 'Live Terminal' in the agent configuration and set the shell to /bin/bash.