XDR-Engineer Cortex XDR Agent Configuration Practice Test 2 — 15 Questions

Question 1

An administrator is configuring a new Cortex XDR agent settings profile for a group of Windows servers that must never be rebooted automatically after an agent upgrade. Which setting in the agent settings profile should the administrator configure to control this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable 'Allow Agent to Reboot Endpoint After Upgrade' in the agent settings profile.. The agent settings profile includes a specific setting that governs whether the agent can reboot the endpoint after an upgrade. Disabling this setting prevents automatic reboots, which is critical for servers that must maintain uptime. Other options either control upgrade timing or describe non-existent features, and do not directly prevent the reboot.

Answer

Set the 'Agent Upgrade' policy to 'Manual' so that upgrades are only applied when an administrator approves them.

Answer

Configure a 'Reboot Suppression' exception in the endpoint policy for the server group.

Answer

Enable 'Agent Auto Upgrade' and set the schedule to a maintenance window.

Question 2

An administrator is configuring a Cortex XDR agent policy for a group of Linux servers. The organization requires that the agent automatically isolate an endpoint from the network when a critical malware event is detected, and also wants to collect additional forensic data such as running processes and network connections upon such an event. Which TWO Cortex XDR agent settings should the administrator configure to meet these requirements? (Choose two.)

Accepted Answer

Enable the 'Endpoint Isolation' action in the Malware profile.. To automatically isolate an endpoint and collect forensic data upon a critical malware event, the administrator should enable both 'Endpoint Isolation' and 'Forensic Data Collection' in the Malware profile. These settings work together to contain the threat and gather valuable evidence without manual intervention. Other options do not provide these automated capabilities.

Answer

Configure a 'Live Terminal' session to run automatically on malware detection.

Answer

Create a custom IOC with the action 'Isolate Endpoint'.

Answer

Set the 'Agent Action' to 'Block and Report' for all malware events.

Question 3

A Cortex XDR administrator needs to prevent users in the engineering department from stopping the agent service on their Windows endpoints, while still allowing them to view the agent tray icon and run manual scans. Which agent setting should the administrator configure in the Agent Settings profile?

Accepted Answer

Enable 'Agent Tamper Protection' to prevent unauthorized modification or stopping of the agent service.. Agent Tamper Protection is the specific Cortex XDR agent setting that prevents unauthorized stopping or modification of the agent service. It ensures the agent remains running and protected from tampering, which directly satisfies the requirement to block service stoppage while preserving tray icon visibility and manual scan capabilities. Other settings either do not prevent service stoppage or conflict with the allowed user actions.

Answer

Enable 'Password Protection' and set a strong password that is required to uninstall or stop the agent service.

Answer

Enable 'Behavioral Threat Protection' and set the action to 'Block' for all threat categories.

Answer

Configure 'Agent Settings' to hide the tray icon and disable manual scan options for all users.

Question 4

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not connecting to the management console. The administrator wants to verify the agent's configuration and connectivity. Which TWO actions should the administrator perform to gather relevant information? (Choose two.)

Accepted Answer

Run 'cytool config show' to display the current agent configuration, including proxy settings.. The 'cytool status' command verifies the agent's connection state and version, while 'cytool config show' displays the current configuration, including proxy settings. Together, these two actions provide the necessary information to diagnose why the agent is not connecting to the management console. Other commands either check unrelated aspects or are more suited for deeper log analysis.

Answer

Run 'cytool log collect' to generate a support bundle for analysis.

Answer

Run 'sc query CortexXDR' to verify the agent service is running.

Answer

Run 'netstat -ano | findstr 443' to check if the agent is listening on port 443.

Question 5

A Cortex XDR administrator is configuring a new agent profile for a group of Linux servers. The administrator needs to ensure that the agent can perform live terminal response actions, such as running scripts and retrieving files, without requiring an interactive user session. Which agent setting should be enabled?

Accepted Answer

Enable 'Allow Agent Actions without User Session' in the agent settings to permit background response actions.. The 'Allow Agent Actions without User Session' setting is specifically designed to enable Cortex XDR agent response actions, such as live terminal and file retrieval, on endpoints where no user is logged in. This is critical for servers that run headless. Enabling this setting ensures that the agent can execute commands and scripts in the background, fulfilling the requirement without needing an interactive session.

Answer

Enable 'Remote Shell' and configure it to run as root without requiring a user login.

Answer

Configure the agent to run as a systemd service with the '--allow-interactive' flag.

Answer

Enable 'Live Terminal' in the agent configuration and set the shell to /bin/bash.

Question 6

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints. The security team requires that the agent automatically updates to the latest version without manual intervention. Which agent setting should the administrator configure in the Agent Settings profile?

Accepted Answer

Enable 'Auto Upgrade' and specify a maintenance window for updates.. Auto Upgrade is the Cortex XDR agent setting that enables automatic updates of the agent software to the latest version. By configuring Auto Upgrade and optionally setting a maintenance window, the administrator ensures macOS endpoints receive updates without manual effort. Other settings like Content Update only handle security content, not the agent binary.

Answer

Configure 'Content Update' to automatically download the latest security content.

Answer

Enable 'Live Update' to allow the agent to fetch updates from the cloud.

Answer

Set 'Agent Version' to 'Latest' in the installation package configuration.

Question 7

A Cortex XDR administrator is configuring an Agent Settings profile for a group of Windows endpoints that run critical industrial control software. The administrator needs to ensure that the agent does not interfere with the control software's real-time operations while still maintaining security. Which TWO settings should the administrator configure? (Choose two.)

Accepted Answer

Add the control software's executable paths to the 'Behavioral Threat Protection Exclusions' list.. To prevent interference with critical control software, the administrator should exclude the software's executables from Behavioral Threat Protection and set BTP to Monitor mode. These two settings ensure that the agent does not block the software's real-time operations while still logging potential threats. Other options either do not address behavioral interference or weaken security without solving the problem.

Answer

Enable 'Exploit Protection' and set it to 'Block' for all modules.

Answer

Disable 'Content Update' to prevent the agent from downloading new signatures that might flag the control software.

Answer

Add the control software's installation directory to the 'Malware Exclusions' list.

Question 8

A Cortex XDR administrator is troubleshooting an issue where a Windows endpoint agent is not receiving updated policy settings from the management console. The administrator confirms that the endpoint is connected to the network and the agent service is running. Which agent setting should the administrator check to ensure the agent can communicate with the Cortex XDR management server?

Accepted Answer

Check the 'Management Server' URL and ensure it is reachable and correctly configured in the agent settings.. The 'Management Server' URL setting is critical for agent-to-console communication. If the URL is incorrect or unreachable, the agent cannot receive policy updates even if the network is otherwise functional. Checking this setting ensures the agent is pointing to the correct Cortex XDR management server and can establish a connection to retrieve policies. Other settings like proxy or content update are less directly related to policy delivery.

Answer

Verify that the 'Agent Proxy' setting is configured correctly if the endpoint uses a proxy to access the internet.

Answer

Ensure that 'Content Update' is enabled so the agent can download the latest policy definitions.

Answer

Verify that 'Behavioral Threat Protection' is enabled and not blocking the agent's communication.

Question 9

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Accepted Answer

Approve Full Disk Access and System Extensions.. macOS requires the administrator to manually approve System Extensions and Full Disk Access permissions for the Cortex XDR agent to function correctly.

Answer

Disable SIP (System Integrity Protection).

Answer

Configure a custom kernel panic handler in the boot-args.

Answer

Install a local proxy certificate in the Keychain Access utility.

Question 10

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool utility is the command-line interface on Windows endpoints for querying and managing the Cortex XDR agent. Running commands such as 'cytool status' or 'cytool info' displays the agent's operational status, connection state to the management server, and installed version. It is the standard tool for local agent diagnostics on Windows.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 11

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 12

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. Cortex XDR allows administrators to configure isolation exception rules that specify IP addresses or hostnames permitted to communicate with an isolated endpoint. This is the supported mechanism to allow a remediation server or management IP to reach an isolated endpoint while keeping all other traffic blocked. The exception is configured in the isolation policy or as a standalone exception rule.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 13

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required for deployment via Active Directory Group Policy Objects (GPO) or other enterprise software distribution tools that natively support Windows Installer packages.

Answer

EXE

Answer

PKG

Answer

TGZ

Question 14

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning an agent profile to an installation package ensures that when the agent registers with the Cortex XDR cloud, it automatically receives the configuration and security settings defined in that profile. This streamlines deployment by applying the correct policy set without manual intervention. The profile determines settings like Malware Protection, Exploit Protection, and Agent Settings for the endpoint.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 15

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

Accepted Answer

Create a new installation package with the upgraded version and push it using software distribution tools or the console upgrade feature.. Deploying an upgraded installation package or using the console's upgrade mechanism ensures consistency, but for Linux, deploying the updated package via software deployment tools or the console upgrade task is standard.

Answer

Delete the endpoint from the console and re-enroll it with the latest agent version.

Answer

Modify the local yum/apt repository configuration to pull updates from Palo Alto Networks public cloud.

Answer

Uninstall the existing agent completely, reboot the server, and manually install the new version via CLI.