XDR-Engineer Cortex XDR Agent Configuration — 25 Questions

Question 1

A security administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows endpoints. Where is this setting configured in the Cortex XDR management console?

Accepted Answer

Endpoints > Global Settings > Agent Settings. Agent settings, including the anti-tampering password and protection features, are configured under Endpoints > Global Settings > Agent Settings.

Answer

Settings > Configurations > Collector

Answer

Response > Endpoint Management > Settings

Answer

Endpoints > Policy Rules > Malware Protection

Question 2

An administrator suspects that a Cortex XDR agent on a Windows endpoint is experiencing high CPU utilization due to aggressive behavioral threat monitoring. Which cytool subcommand can be used locally to inspect or modify runtime tracing and debugging levels?

Accepted Answer

cytool log level. The 'cytool runtime' or 'cytool log' commands allow administrators to adjust tracing levels locally for diagnostic purposes. Specifically, cytool management features include runtime parameter inspection.

Answer

cytool trace modify

Answer

cytool monitor cpu-throttle

Answer

cytool runtime query

Question 3

An administrator wants to verify which agents are assigned to a specific security profile. Where can this mapping be reviewed in the Cortex XDR management console?

Accepted Answer

Endpoints > Policy Rules. The Endpoints > Policy Rules section displays rule assignments and which endpoints or folders fall under each specific profile.

Answer

Settings > Agents > Mapping

Answer

Response > Inventory > Profiles

Answer

Dashboards > Profile Assignment

Question 4

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Accepted Answer

Collect troubleshooting logs into a support archive using `cytool log collect`.. cytool allows administrators to query agent status, check connectivity, manage protection settings, and gather troubleshooting logs locally.

Answer

Reconfigure the endpoint's DHCP IP address lease.

Answer

Perform a firmware update on the endpoint motherboard BIOS.

Answer

Modify local Active Directory Group Policy objects.

Question 5

Where in the Cortex XDR management console does an administrator generate the installation packages (installer files and matching installation tokens) for endpoints?

Accepted Answer

Under Endpoints > Global Settings > Install Packages. Administrators generate agent installation packages under Endpoints > Global Settings > Install Packages.

Answer

Under Dashboards > Agent Status > Download

Answer

Under Response > Content Updates > Agents

Answer

Under Settings > Configurations > Endpoints

Question 6

When configuring Agent Settings profiles in Cortex XDR, which THREE behavioral threat protection or prevention modules can be tuned or enabled? (Choose three)

Accepted Answer

Behavioral Threat Protection. Cortex XDR Agent Settings profiles allow administrators to configure modules such as Anti-Malware, Exploit Protection, and Behavioral Threat Protection.

Answer

Active Directory Domain Controller Replication

Answer

BGP Routing Table Synchronization

Question 7

An administrator is troubleshooting an endpoint where the Cortex XDR agent is showing a 'Disconnected' status in the management console. Which THREE troubleshooting steps should the administrator perform using the local 'cytool' utility? (Choose three)

Accepted Answer

Run 'cytool log collect' to gather diagnostic logs for analysis or support escalation.. Using cytool locally, an administrator can verify the connection status, check the management server address configuration, and test or restart the agent service.

Answer

Run 'cytool policy wipe' to factory reset the operating system network stack.

Answer

Run 'cytool kernel compile' to rebuild the Windows kernel table.

Question 8

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

Accepted Answer

Verify the status and logs of the Cyvera.Service.exe service on the endpoint.. Checking the Cyvera.Service.exe logs (or collector log files) on the endpoint helps determine if communication with the Cortex XDR server is failing or if registration is corrupted.

Answer

Reboot the Panorama management server to push the updated profile.

Answer

Run the migration tool to upgrade the agent installer package.

Answer

Restart the Palo Alto Networks Cortex Data Lake collector service.

Question 9

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Accepted Answer

Approve Full Disk Access and System Extensions.. macOS requires the administrator to manually approve System Extensions and Full Disk Access permissions for the Cortex XDR agent to function correctly.

Answer

Disable SIP (System Integrity Protection).

Answer

Configure a custom kernel panic handler in the boot-args.

Answer

Install a local proxy certificate in the Keychain Access utility.

Question 10

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Accepted Answer

Endpoints > Policy Rules > Malware Protection. File and folder exclusions that apply to malware scans and behavioral threat protection are configured within the Malware Protection profile under Endpoints > Policy Rules.

Answer

Response > Live Terminal > Policies

Answer

Settings > Access Control > Exceptions

Answer

Data Collection > Rules > Exclusions

Question 11

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool command-line utility is built into the Cortex XDR agent on Windows and is used for management, troubleshooting, and querying agent status.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 12

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 13

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. When an endpoint is isolated, administrators can define network exceptions (such as specific IP addresses or ports) in the Response or Global Settings to allow remediation traffic.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 14

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required for deployment via Active Directory Group Policy Objects (GPO) or other enterprise software distribution tools that natively support Windows Installer packages.

Answer

EXE

Answer

PKG

Answer

TGZ

Question 15

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning a profile to an installation package ensures that the endpoint immediately adopts the correct configuration, security rules, and data collection settings upon registration.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 16

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Accepted Answer

cytool log collect. The 'cytool log collect' command generates a diagnostic archive containing all relevant agent logs for support or advanced troubleshooting.

Answer

cytool debug generate

Answer

cytool dump-logs

Answer

cytool export support-bundle

Question 17

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

Accepted Answer

Create a new installation package with the upgraded version and push it using software distribution tools or the console upgrade feature.. Deploying an upgraded installation package or using the console's upgrade mechanism ensures consistency, but for Linux, deploying the updated package via software deployment tools or the console upgrade task is standard.

Answer

Delete the endpoint from the console and re-enroll it with the latest agent version.

Answer

Modify the local yum/apt repository configuration to pull updates from Palo Alto Networks public cloud.

Answer

Uninstall the existing agent completely, reboot the server, and manually install the new version via CLI.

Question 18

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Accepted Answer

Quarantines the file and terminates the running process.. When PUA prevention is set to block, the agent terminates the execution of the application and prevents it from running.

Answer

Sends an alert to the console but allows the application to continue running.

Answer

Isolates the entire endpoint from the corporate network.

Answer

Deletes the file permanently from the disk without creating a quarantine backup.

Question 19

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. Agent Settings profiles control operational aspects of the agent, such as password protection, uninstallation permissions, and update schedules.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 20

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management view provides a comprehensive inventory table of all deployed agents, their status, versions, and details.

Answer

Dashboards > Health > Agents

Answer

Response > Endpoint Status

Answer

Settings > Agent Management > Status