XDR-Engineer Cortex XDR Agent Configuration Practice Test 4 — 15 Questions

Question 1

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Accepted Answer

File, folder, and hash exclusion lists. Option C is correct because a Malware Protection profile in Cortex XDR includes exclusion configuration, allowing administrators to define file, folder, and hash exclusions so that trusted or performance-sensitive items are not scanned or blocked by the malware engine. Option D is correct because the Malware Protection profile lets you set the action taken for Potentially Unwanted Applications (PUA), choosing whether detected PUA is blocked or merely alerted. Option A is incorrect because the anti-tampering password for agent uninstallation is configured in the agent settings or endpoint policy, not inside the Malware Protection profile. Option B is incorrect because Broker VM proxy port forwarding schedules are configured in the Broker VM or network/proxy settings, not in a Malware Protection profile. Option E is incorrect because browser-based exploit mitigation rules are part of exploit protection or the Exploit Protection profile, not the Malware Protection profile.

Answer

Anti-tampering password for agent uninstallation

Answer

Broker VM proxy port forwarding schedules

Answer

Browser-based exploit mitigation rules

Question 2

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently

Question 3

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

Accepted Answer

Microsoft Windows. Microsoft Windows (A) is officially supported because Cortex XDR agents are distributed as native Windows installers (MSI/EXE) for supported Windows workstation and server releases. Apple macOS (B) is officially supported via signed PKG/DMG agent packages for supported macOS versions. Linux (E) is officially supported across various distributions such as Red Hat, Ubuntu, and CentOS, using RPM/DEB packages or the installation script. Apple iOS (C) and Google Android (D) are not supported for Cortex XDR agent deployments because those mobile platforms are covered by separate mobile security offerings rather than the endpoint agent.

Answer

Apple iOS

Answer

Google Android

Question 4

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Accepted Answer

All inbound and outbound network traffic is blocked except for allowed management traffic to Cortex XDR and defined exceptions.. Option C is correct because Cortex XDR network isolation enforces a host-based firewall/network containment policy that blocks all inbound and outbound traffic except the management channel to Cortex XDR (and any administrator-defined exceptions), allowing the agent to remain reachable for response actions. Option D is correct because isolation is designed to preserve remote responder access, so administrators can still use Live Terminal to investigate and remediate the endpoint while it is contained. Option E is correct because the agent can display a user notification banner on the isolated endpoint when that setting is configured, informing the local user of the isolation state. Option A is incorrect because isolation is a software-enforced network containment action and does not cut physical power to the hardware. Option B is incorrect because isolation does not delete local user accounts; account modification is not part of the isolation behavior.

Answer

The endpoint physical hardware power supply is automatically shut off.

Answer

All local user accounts on the machine are permanently deleted.

Question 5

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

Accepted Answer

Check that the installation package was created with the correct tenant parameters and valid token.. Option D is correct because a Cortex XDR agent registration is bound to the tenant-specific installation package, which embeds the correct tenant ID and a valid registration token; if the package was generated for the wrong tenant or the token is expired/invalid, the agent cannot authenticate to the cloud management console and registration fails. Option E is correct because Cortex XDR agents communicate with the Cortex XDR backend over outbound TCP 443 (HTTPS); if firewall, proxy, or network rules block this outbound connectivity, the agent cannot reach the console and will never register. Option A is wrong because printer sharing permissions are unrelated to agent-to-cloud communication. Option B is wrong because refreshing an ISP dynamic IP lease on the local router does not address agent registration, which uses outbound HTTPS sessions rather than inbound IP-dependent connectivity. Option C is wrong because changing the desktop wallpaper theme has no bearing on Cortex XDR agent registration or network connectivity.

Answer

Reconfigure the endpoint's printer sharing permissions.

Answer

Reboot the local office router to refresh the ISP dynamic IP lease.

Answer

Change the Windows desktop wallpaper theme.

Question 6

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Accepted Answer

Collection of process execution and file creation telemetry. In Cortex XDR, a Data Collection profile governs which endpoint telemetry the agent gathers and forwards, so option B is correct because process execution and file creation events are core telemetry categories that can be toggled per profile. Option C is correct because network connection and DNS activity are also telemetry types controlled by the Data Collection profile, enabling or disabling their collection. Option E is correct because script execution logging for PowerShell and bash is a configurable telemetry setting within the profile. Option A is not part of a Data Collection profile, since local firewall blocking rules for network isolation are configured through isolation or firewall policy settings, not telemetry collection. Option D is also unrelated, as the anti-tampering administrator password is an agent security setting managed in the agent configuration, not in the Data Collection profile.

Answer

Defining local firewall blocking rules for network isolation

Answer

Setting the anti-tampering administrator password for agent removal

Question 7

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Accepted Answer

Verify that required kernel headers or dependencies are installed and loaded properly.. Option B is correct because the Cortex XDR agent on Linux relies on kernel modules (e.g., the Traps/Cortex kernel driver) that require matching kernel headers and build dependencies to compile and load; verifying them with tools like `uname -r` and checking for `kernel-devel`/`kernel-headers` packages is a valid advanced troubleshooting step. Option C is correct because agent logs are written to designated directories such as /var/log/traps or /var/log/cortex, and inspecting these logs (e.g., via `tail -f` or `grep`) is essential for diagnosing agent malfunctions. Option E is correct because checking the agent's service status with `systemctl status cxdr` (or legacy daemon names like `traps` or `cytool`) confirms whether the service is running, failed, or disabled, which is a standard Linux troubleshooting action. Option A is not appropriate because reformatting the root filesystem and reinstalling the kernel is a destructive, last-resort OS recovery action, not an agent troubleshooting step. Option D is incorrect because Windows Registry keys do not exist on Linux endpoints and are irrelevant to a Linux Cortex XDR agent.

Answer

Reformat the Linux root filesystem and reinstall the operating system kernel.

Answer

Modify the Windows Registry keys for the Cortex XDR service.

Question 8

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Accepted Answer

The Agent Settings profile priority for the Finance folder is set lower than a conflicting child assignment or inheritance is broken.. Cortex XDR applies Agent Settings profiles based on folder hierarchy and assignment priority. If the Finance folder has a lower-priority profile than a conflicting child assignment, or if inheritance from the parent is broken, the tamper protection password from the new profile will not be applied. Profile precedence and folder inheritance are the most common reasons a configuration appears not to take effect on a subset of endpoints.

Answer

Tamper protection passwords can only be configured globally and cannot be overridden by profile.

Answer

Tamper protection configuration changes require a manual service restart on every agent.

Answer

Agents require a full endpoint reboot before downloading any configuration changes.

Question 9

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Accepted Answer

Use the .msi package with the /quiet and /norestart parameters.. For silent, unattended deployment via GPO, the correct approach is to use the .msi installer with the /quiet and /norestart parameters. MSI packages are natively supported by Group Policy Software Installation and Windows Installer, and /quiet suppresses all UI while /norestart prevents an automatic reboot during deployment. This is the standard enterprise deployment method for Cortex XDR on Windows.

Answer

Use the .exe package and modify the registry before execution.

Answer

Use the .exe package with the /silent switch.

Answer

Use the .pkg package with the --unattended flag.

Question 10

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Accepted Answer

Deploy a Cortex XDR Broker VM internally to proxy agent communication to the Cortex XDR cloud.. When endpoints cannot reach the public internet, Cortex XDR agents cannot establish their outbound TLS connection to the Cortex XDR cloud. The supported solution is to deploy a Broker VM inside the restricted network; agents connect to the Broker, which proxies their traffic out to the Cortex XDR service. This preserves agent functionality without opening direct internet access from every endpoint.

Answer

Open outbound HTTPS port 443 directly from every endpoint to public DNS root servers.

Answer

Configure agents to communicate via SNMP traps to the primary domain controller.

Answer

Manually export logs via USB on each endpoint on a weekly basis.

Question 11

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

Accepted Answer

cytool. The 'cytool' command-line utility is bundled with the Cortex XDR agent to perform local administrative tasks such as checking status, viewing logs, and running diagnostics.

Answer

traps-cli

Answer

pan-agent-ctl

Answer

xdr-admin

Question 12

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

Accepted Answer

Deploy an Apple MDM configuration profile containing System Extension and Full Disk Access payloads.. macOS endpoints require specific System Extensions and Full Disk Access permissions to be granted, which are typically pre-configured and deployed via Mobile Device Management (MDM) configuration profiles.

Answer

Run the agent installer with sudo privileges twice consecutively.

Answer

Disable Apple SIP (System Integrity Protection) globally on all endpoints.

Answer

Modify the macOS sudoers file to include the Cortex XDR process path.

Question 13

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

Accepted Answer

Ensure outbound TCP port 443 communication is allowed from endpoints to the Cortex XDR server or Broker VM.. Option A is correct because Cortex XDR agents must reach the Cortex XDR management server or a Broker VM over outbound TCP 443 for registration, policy retrieval, and telemetry upload, so this connectivity must be verified before rollout. Option C is correct because agent compatibility is version-specific: the administrator must confirm each target Windows, macOS, and Linux OS version appears in the current Cortex XDR release notes' supported operating systems list, otherwise installation or protection may fail. Option B is not required because agent installation logs are stored locally and forwarded through the agent's own channel, not via a mandatory external Syslog server. Option D is wrong because native OS firewalls should remain enabled and be configured to permit the agent's required traffic, not uninstalled. Option E is wrong because kernel headers are a Linux concern, not Windows, and they are not manually compiled on every endpoint for agent installation.

Answer

Configure an external Syslog server to receive local agent installation logs.

Answer

Uninstall all native operating system firewalls before running the agent installer.

Answer

Manually compile the kernel headers on every target Windows endpoint.

Question 14

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Accepted Answer

Configure the proxy settings in the Agent Settings profile, specifying the proxy address, port, and authentication credentials.. To configure an authenticated forward proxy for Cortex XDR agents, the administrator must use an Agent Settings profile. This profile includes proxy settings where the address, port, and credentials can be specified. Applying the profile to the target Linux endpoints ensures the agents use the proxy for communication. Other methods, such as local file edits or global server settings, are not supported and would not reliably achieve the goal.

Answer

Configure the proxy settings in the Cortex XDR management console under Server Settings, which automatically applies to all agents.

Answer

Use a transparent proxy that does not require authentication, as Cortex XDR agents do not support authenticated proxies.

Answer

Edit the agent configuration file on each Linux endpoint to include the proxy details and restart the agent service.

Question 15

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

Accepted Answer

Create a Behavioral Threat exception rule that targets the specific process and its known memory allocation behavior.. The correct approach is to create a Behavioral Threat exception rule for the specific process and its memory allocation behavior. This preserves the Behavioral Threat Protection module for all other processes while eliminating the false positives caused by the legacy application. The other options either disable protection too broadly or address the wrong module.

Answer

Add the application's executable to the allow list in the Exploit Protection profile.

Answer

Lower the Behavioral Threat Protection action from 'Block' to 'Report' for the entire server group.

Answer

Disable the Behavioral Threat Protection module entirely for the server group.