XDR-Engineer Cortex XDR Agent Configuration — All Questions With Answers

Question 1hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

Question 2mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Question 3mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows endpoints. Where is this setting configured in the Cortex XDR management console?

Question 4hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Question 5hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator suspects that a Cortex XDR agent on a Windows endpoint is experiencing high CPU utilization due to aggressive behavioral threat monitoring. Which cytool subcommand can be used locally to inspect or modify runtime tracing and debugging levels?

Question 6easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Question 7mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to verify which agents are assigned to a specific security profile. Where can this mapping be reviewed in the Cortex XDR management console?

Question 8hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents across a large Linux environment using Puppet. Which installation parameter is typically required during scripted deployments to ensure the agent registers with the correct Cortex XDR tenant?

Question 9hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Question 10mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE methods can be used to obtain Cortex XDR agent installation packages? (Choose three)

Question 11easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where in the Cortex XDR management console does an administrator generate the installation packages (installer files and matching installation tokens) for endpoints?

Question 12mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to temporarily disable the Cortex XDR agent on a Windows endpoint to troubleshoot a conflicting third-party application. Which method should be used?

Question 13mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

When configuring Agent Settings profiles in Cortex XDR, which THREE behavioral threat protection or prevention modules can be tuned or enabled? (Choose three)

Question 14hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is showing a 'Disconnected' status in the management console. Which THREE troubleshooting steps should the administrator perform using the local 'cytool' utility? (Choose three)

Question 15hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security engineer needs to prevent Cortex XDR agents on a group of Windows servers from automatically upgrading to newer agent versions, while still allowing content updates to be delivered. The servers are managed through an Agent Settings profile. Which configuration should the engineer apply?

Question 16mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a new Cortex XDR agent settings profile for a group of Windows servers that must never be rebooted automatically after an agent upgrade. Which setting in the agent settings profile should the administrator configure to control this behavior?

Question 17hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent policy for a group of Linux servers. The organization requires that the agent automatically isolate an endpoint from the network when a critical malware event is detected, and also wants to collect additional forensic data such as running processes and network connections upon such an event. Which TWO Cortex XDR agent settings should the administrator configure to meet these requirements? (Choose two.)

Question 18mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to prevent users in the engineering department from stopping the agent service on their Windows endpoints, while still allowing them to view the agent tray icon and run manual scans. Which agent setting should the administrator configure in the Agent Settings profile?

Question 19hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not connecting to the management console. The administrator wants to verify the agent's configuration and connectivity. Which TWO actions should the administrator perform to gather relevant information? (Choose two.)

Question 20hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is configuring a new agent profile for a group of Linux servers. The administrator needs to ensure that the agent can perform live terminal response actions, such as running scripts and retrieving files, without requiring an interactive user session. Which agent setting should be enabled?

Question 21easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints. The security team requires that the agent automatically updates to the latest version without manual intervention. Which agent setting should the administrator configure in the Agent Settings profile?

Question 22mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is configuring an Agent Settings profile for a group of Windows endpoints that run critical industrial control software. The administrator needs to ensure that the agent does not interfere with the control software's real-time operations while still maintaining security. Which TWO settings should the administrator configure? (Choose two.)

Question 23hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting an issue where a Windows endpoint agent is not receiving updated policy settings from the management console. The administrator confirms that the endpoint is connected to the network and the agent service is running. Which agent setting should the administrator check to ensure the agent can communicate with the Cortex XDR management server?

Question 24easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Question 25easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Question 26mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Question 27hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Question 28easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

Question 29easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Question 30mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

Question 31hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Question 32easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

What is the primary function of an Agent Settings profile in Cortex XDR?

Question 33easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Question 34mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Question 35hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Question 36mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

Question 37easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

What is the function of an Exploit Protection profile in Cortex XDR?

Question 38hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

Question 39mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Question 40mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Question 41easymultiple choice

Read the full network assurance explanation →

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Question 42hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

Question 43easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Question 44easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

Question 45mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Question 46mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Question 47hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Question 48easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

Question 49hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Question 50easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

Question 51mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Question 52hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Question 53hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Question 54mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Question 55hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Question 56easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

Question 57mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

Question 58hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

Question 59mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Question 60mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

Question 61easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

Question 62hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

Question 63mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Question 64mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

Question 65easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

Question 66hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

Question 67mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Question 68easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

Question 69hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

Question 70mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

Question 71mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

Question 72hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator manages a Cortex XDR deployment where endpoints connect to the Cortex XDR server through an internal proxy. The security team requires that all agent-to-server communication use the proxy, but also wants the agent to bypass the proxy when reaching internal Cortex XDR appliances on the local network. Which configuration in the agent installation package achieves this?

Question 73mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

Question 74easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

Question 75hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

Question 76mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to ensure that all Windows endpoints in a specific department use the same behavioral threat prevention settings and that changes apply immediately when the profile is edited. Which configuration approach should the administrator use?

Question 1hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

Question 2mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Question 3mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator wants to prevent users from tampering with or uninstalling the Cortex XDR agent on Windows endpoints. Where is this setting configured in the Cortex XDR management console?

Question 4hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Question 5hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator suspects that a Cortex XDR agent on a Windows endpoint is experiencing high CPU utilization due to aggressive behavioral threat monitoring. Which cytool subcommand can be used locally to inspect or modify runtime tracing and debugging levels?

Question 6easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Question 7mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to verify which agents are assigned to a specific security profile. Where can this mapping be reviewed in the Cortex XDR management console?

Question 8hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents across a large Linux environment using Puppet. Which installation parameter is typically required during scripted deployments to ensure the agent registers with the correct Cortex XDR tenant?

Question 9hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Question 10mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE methods can be used to obtain Cortex XDR agent installation packages? (Choose three)

Question 11easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where in the Cortex XDR management console does an administrator generate the installation packages (installer files and matching installation tokens) for endpoints?

Question 12mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to temporarily disable the Cortex XDR agent on a Windows endpoint to troubleshoot a conflicting third-party application. Which method should be used?

Question 13mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

When configuring Agent Settings profiles in Cortex XDR, which THREE behavioral threat protection or prevention modules can be tuned or enabled? (Choose three)

Question 14hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is showing a 'Disconnected' status in the management console. Which THREE troubleshooting steps should the administrator perform using the local 'cytool' utility? (Choose three)

Question 15hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security engineer needs to prevent Cortex XDR agents on a group of Windows servers from automatically upgrading to newer agent versions, while still allowing content updates to be delivered. The servers are managed through an Agent Settings profile. Which configuration should the engineer apply?

Question 16mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a new Cortex XDR agent settings profile for a group of Windows servers that must never be rebooted automatically after an agent upgrade. Which setting in the agent settings profile should the administrator configure to control this behavior?

Question 17hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent policy for a group of Linux servers. The organization requires that the agent automatically isolate an endpoint from the network when a critical malware event is detected, and also wants to collect additional forensic data such as running processes and network connections upon such an event. Which TWO Cortex XDR agent settings should the administrator configure to meet these requirements? (Choose two.)

Question 18mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to prevent users in the engineering department from stopping the agent service on their Windows endpoints, while still allowing them to view the agent tray icon and run manual scans. Which agent setting should the administrator configure in the Agent Settings profile?

Question 19hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not connecting to the management console. The administrator wants to verify the agent's configuration and connectivity. Which TWO actions should the administrator perform to gather relevant information? (Choose two.)

Question 20hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is configuring a new agent profile for a group of Linux servers. The administrator needs to ensure that the agent can perform live terminal response actions, such as running scripts and retrieving files, without requiring an interactive user session. Which agent setting should be enabled?

Question 21easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints. The security team requires that the agent automatically updates to the latest version without manual intervention. Which agent setting should the administrator configure in the Agent Settings profile?

Question 22mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is configuring an Agent Settings profile for a group of Windows endpoints that run critical industrial control software. The administrator needs to ensure that the agent does not interfere with the control software's real-time operations while still maintaining security. Which TWO settings should the administrator configure? (Choose two.)

Question 23hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting an issue where a Windows endpoint agent is not receiving updated policy settings from the management console. The administrator confirms that the endpoint is connected to the network and the agent service is running. Which agent setting should the administrator check to ensure the agent can communicate with the Cortex XDR management server?

Question 24easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Question 25easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Question 26mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Question 27hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Question 28easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

Question 29easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Question 30mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

Question 31hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Question 32easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

What is the primary function of an Agent Settings profile in Cortex XDR?

Question 33easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Question 34mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Question 35hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Question 36mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

Question 37easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

What is the function of an Exploit Protection profile in Cortex XDR?

Question 38hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

Question 39mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Question 40mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Question 41easymultiple choice

Read the full network assurance explanation →

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Question 42hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

Question 43easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Question 44easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

Question 45mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Question 46mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Question 47hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Question 48easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

Question 49hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Question 50easymulti select

Read the full Cortex XDR Agent Configuration explanation →

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

Question 51mediummulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Question 52hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Question 53hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Question 54mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Question 55hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Question 56easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

Question 57mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

Question 58hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

Question 59mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Question 60mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

Question 61easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

Question 62hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

Question 63mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Question 64mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

Question 65easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

Question 66hardmulti select

Read the full Cortex XDR Agent Configuration explanation →

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

Question 67mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Question 68easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

Question 69hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

Question 70mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

Question 71mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

Question 72hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

An administrator manages a Cortex XDR deployment where endpoints connect to the Cortex XDR server through an internal proxy. The security team requires that all agent-to-server communication use the proxy, but also wants the agent to bypass the proxy when reaching internal Cortex XDR appliances on the local network. Which configuration in the agent installation package achieves this?

Question 73mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

Question 74easymultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

Question 75hardmultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

Question 76mediummultiple choice

Read the full Cortex XDR Agent Configuration explanation →

A Cortex XDR administrator needs to ensure that all Windows endpoints in a specific department use the same behavioral threat prevention settings and that changes apply immediately when the profile is edited. Which configuration approach should the administrator use?