XDR-Engineer Cortex XDR Agent Configuration Practice Test 3 — 15 Questions

Question 1

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Quarantines the file and terminates the running process.. When a PUA is detected and the profile action is set to 'Block', the agent quarantines the file and terminates the running process (B). This prevents the PUA from executing or continuing to run, while preserving the file in quarantine for potential analysis or restoration. This is the standard block action for malware and PUA in Cortex XDR.

Answer

Sends an alert to the console but allows the application to continue running.

Answer

Isolates the entire endpoint from the corporate network.

Answer

Deletes the file permanently from the disk without creating a quarantine backup.

Question 2

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. An Agent Settings profile in Cortex XDR is used to configure administrative and operational options for the endpoint agent, including the anti-tampering password, agent logging level, malware scan schedules, and other behavior controls. It is applied to endpoints via policy rules and governs how the agent operates locally rather than defining detection content. This makes it the correct place for administrative parameters such as passwords and operational settings.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 3

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Accepted Answer

Endpoints > Endpoint Management. The Cortex XDR management console provides endpoint inventory and status information under Endpoints > Endpoint Management. This view lists all registered endpoints along with their connection status, agent version, operating system, and other metadata, making it the correct location to review fleet-wide agent health.

Answer

Dashboards > Health > Agents

Answer

Response > Endpoint Status

Answer

Settings > Agent Management > Status

Question 4

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component deployed in network segments without direct internet access to act as a proxy, forwarding agent traffic to the Cortex XDR cloud. It brokers communication between endpoints and the cloud, and can also host local services like the WildFire local analysis and syslog collection. This makes it the correct choice for proxying agent traffic in restricted segments.

Answer

GlobalProtect Gateway

Answer

WildFire Appliance

Answer

Palo Alto Networks Panorama Server

Question 5

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 6

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

Accepted Answer

Generate and download distinct installation packages tailored for each operating system type.. Separate installation packages must be generated for each distinct operating system (Windows, macOS, Linux) in the Cortex XDR management console.

Answer

Convert an MSI package to PKG format using third-party tools.

Answer

Download a single universal installation package that automatically detects the operating system during execution.

Answer

Use the Linux TGZ installer for all operating systems by leveraging containerization.

Question 7

What is the function of an Exploit Protection profile in Cortex XDR?

Accepted Answer

To prevent memory-based attacks and protect applications from exploitation techniques.. An Exploit Protection profile in Cortex XDR is a security policy that defines which exploit mitigation techniques (e.g., DEP, ASLR, SEHOP, Heap Spray, ROP) are applied to protected applications to prevent memory-based attacks such as buffer overflows, ROP chains, and heap sprays. It hardens applications against exploitation techniques rather than scanning for known malware hashes.

Answer

To encrypt endpoint hard drives using BitLocker or FileVault.

Answer

To control USB mass storage device access.

Answer

To detect and block known malware hashes during file scans.

Question 8

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

Accepted Answer

msiexec /i <installer>.msi /qn REBOOT=ReallySuppress. Silent installations of MSI packages are standard using the '/qn' or '/quiet' flags, often combined with REBOOT=ReallySuppress to prevent forced reboots.

Answer

setup.exe /silent /noreboot

Answer

install.bat --silent --no-restart

Answer

cytool install --quiet --suppress-reboot

Question 9

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Accepted Answer

Network connectivity issues or firewall blocks preventing outbound communication to the Cortex XDR backend.. Cortex XDR agents maintain a persistent outbound connection (typically over TCP 443) to the Cortex XDR backend/management service. When that channel is broken — due to proxy misconfiguration, firewall rules, DNS failures, or TLS inspection — the agent cannot check in and the console reports it as 'Disconnected'. This is the most common and first thing to verify before assuming an agent-side or licensing problem.

Answer

The agent license count has been exceeded by one license.

Answer

The Data Collection profile was modified to reduce log verbosity.

Answer

The local endpoint user changed their Windows login password.

Question 10

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Accepted Answer

Device Control. Device Control rules in Cortex XDR allow administrators to restrict or block access to peripheral devices such as USB storage.

Answer

Endpoint Isolation

Answer

Disk Encryption Management

Answer

Behavioral Threat Protection

Question 11

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Accepted Answer

Data Collection profile. The Data Collection profile in Cortex XDR is the configuration object that governs which endpoint telemetry types (process, file, network, registry, etc.) are collected and forwarded to the Cortex XDR console for threat hunting, causality analysis, and forensic investigation. It is separate from protection profiles, which control prevention behavior rather than data gathering.

Answer

Agent Settings profile

Answer

Malware Protection profile

Answer

Network Control profile

Question 12

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

Accepted Answer

MSI verbose installation log (e.g., generated with /l*v). Standard Windows Installer (MSI) verbose logging captures every action taken during installation and is invaluable for troubleshooting setup failures.

Answer

PanXdrInstall.txt

Answer

CortexAgent_Debug.log

Answer

CyveraInstall.log

Question 13

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Accepted Answer

Isolate an endpoint from the network during an incident.. Option B is correct because the Endpoint Management view in Cortex XDR lets an administrator select an endpoint and run the Isolate action, which cuts the endpoint off from the network (except for the Cortex XDR communication channel) during incident response. Option D is correct because the same view provides endpoint actions such as initiating a manual malware scan on one or more selected endpoints to detect threats on demand. Option A is not part of Cortex XDR endpoint actions, since perimeter gateway firewall policies are configured on Palo Alto Networks next-generation firewalls (or Panorama), not from the Endpoint Management view. Option C is also incorrect because firewall traffic filters are created and deployed through firewall management tools, not through Cortex XDR's endpoint management. Option E is incorrect because DNS server IP address assignments are handled by DHCP/DNS or endpoint network configuration, not by Cortex XDR's Endpoint Management view.

Answer

Configure firewall security policies for perimeter gateways.

Answer

Create and deploy Palo Alto Networks firewall traffic filters.

Answer

Manage DNS server IP address assignments.

Question 14

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

Accepted Answer

A valid Cortex XDR agent installation token or profile mapping. Option A is correct because deploying the Cortex XDR agent requires a valid installation token (or a profile mapping in a managed deployment) so the endpoint can authenticate to the Cortex XDR management server and register into the correct tenant and agent profile. Option D is correct because the Cortex XDR agent for Windows is distributed as an MSI installation package, which is the actual installer executed on the endpoint (silently or interactively) to install the agent service. Option B is not required, since GlobalProtect is a separate VPN client and is not a prerequisite for Cortex XDR agent installation. Option C is not required, as Cisco AnyConnect is an unrelated VPN client and has no role in Cortex XDR agent deployment. Option E is not required, because the Cortex XDR agent does not depend on a local Microsoft SQL Server Express instance; endpoint data is sent to the Cortex XDR management console/cloud.

Answer

An active GlobalProtect VPN tunnel client

Answer

A Cisco AnyConnect configuration profile

Answer

A local Microsoft SQL Server Express instance

Question 15

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Accepted Answer

Operating system type (e.g., Windows, macOS, Linux). Option B is correct because Cortex XDR dynamic endpoint groups can filter endpoints by operating system type (Windows, macOS, Linux), allowing an agent profile to be assigned automatically to all endpoints running a given OS. Option C is correct because hostname or naming-convention patterns (for example, matching a prefix like 'SRV-' or a regex) are supported dynamic filter criteria used to group endpoints and bind them to an agent profile. Option A is not a supported grouping criterion, as Cortex XDR does not use physical desk location numbers for dynamic endpoint grouping. Option D is nonsensical and not a valid attribute; BIOS serial numbers are not used as a color-based grouping criterion. Option E is irrelevant, since local account password expiration dates are not endpoint attributes exposed for dynamic grouping or agent profile assignment.

Answer

Physical office desk location number

Answer

BIOS manufacturer serial number color

Answer

Local user account password expiration date