XDR-Engineer Maintenance And Troubleshooting — 20 Questions

Question 1

An administrator needs to deploy the Cortex XDR Agent to hundreds of endpoints using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch is required during silent installation to specify the management console registration token?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ACTIVATION_KEY=<token_value>. Silent installations of the Cortex XDR agent on Windows require the 'ACTIVATION_KEY' property parameter.

Answer

TOKEN=<token_value>

Answer

REGISTER_ID=<token_value>

Answer

XDR_KEY=<token_value>

Question 2

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

Accepted Answer

cytool. CyveraConsole.exe or the cytool utility is the command-line interface provided on endpoints to manage Cortex XDR agent protection modules, configuration, and troubleshooting.

Answer

cortex_cli.sh

Answer

traps_control.exe

Answer

xdr_agent_mgr.exe

Question 3

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Accepted Answer

Go to Settings > Configurations > Broker VM.. The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Answer

Go to XQL Search using dataset = broker_vm_logs.

Answer

Go to Dashboards > Broker VM Performance.

Answer

Go to Endpoint Management > Broker VM.

Question 4

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Accepted Answer

TCP port 443. Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Answer

TCP port 389 and 636

Answer

TCP port 22 and 8080

Answer

UDP port 514

Question 5

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

Accepted Answer

Go to Endpoints > All Endpoints and check the Last Connected and Content Version columns.. The Status column and Agent Details view under Endpoints provide real-time connection status and policy sync timestamps.

Answer

Go to Incident Response > Investigations.

Answer

Go to Dashboards > Agent Health widget.

Answer

Go to Settings > Configurations > Agent Management.

Question 6

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Accepted Answer

Add a profile exception under Settings > Configurations > Agent Configurations specifying the exploit module and application path.. BIOC (Behavioral Indicator of Compromise) and Exploit Protection exceptions can be managed via Exception profiles or profile exclusions in Cortex XDR.

Answer

Disable behavioral threat protection globally.

Answer

Create a correlation rule to suppress alerts from that path.

Answer

Modify the Broker VM ingestion filter.

Question 7

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

Accepted Answer

CyveraInstall.log. The CyveraInstall.log file records detailed information about the agent installation process and initial service startup, making it the best first step for troubleshooting installation or service failures.

Answer

CortexDebug.etl

Answer

TrapsConfig.xml

Answer

AgentService.dmp

Question 8

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Accepted Answer

netstat -tulnp. The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Answer

pan_broker_status --syslog

Answer

traceroute -syslog

Answer

systemctl check-syslog

Question 9

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

Accepted Answer

Click the alert in the Incident view, select Add Exception, and define criteria such as file hash or digital signature.. Cortex XDR allows administrators to add exceptions directly from the alert or within the BIOC profile configuration.

Answer

Downgrade the agent content version to a legacy release.

Answer

Delete the default BIOC profile and create an entirely new tenant policy.

Answer

Restart the Cortex XDR Agent service on each developer workstation.

Question 10

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Accepted Answer

systemctl status pan-syslog-collector. Systemctl is the standard Linux service management tool used on the Broker VM appliance.

Answer

pan_status --all

Answer

broker-vm status-collector

Answer

service broker status

Question 11

An administrator needs to collect troubleshooting logs from a misbehaving Cortex XDR Agent on a Windows endpoint. Which cytool command generates a comprehensive support file archive?

Accepted Answer

cytool log collect. The 'cytool log collect' command packages all relevant diagnostic logs, configuration files, and crash dumps into a support archive.

Answer

cytool diag package

Answer

cytool support export

Answer

cytool dump-all

Question 12

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Accepted Answer

Configure the proxy address, port, and authentication credentials within the Agent Configuration profile under Settings.. Proxy settings for the Cortex XDR agent are configured within the Agent Configuration profile in the Cortex XDR management console before installation or pushed via update.

Answer

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Answer

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Answer

Configure the proxy settings on the Broker VM only.

Question 13

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

Accepted Answer

Endpoints > All Endpoints view, under the Content Version column.. The Endpoints table displays the Content Version column for each managed endpoint.

Answer

Settings > Content Updates > Status.

Answer

Incident Response > Endpoint Inventory.

Answer

Dashboards > Content Health.

Question 14

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Accepted Answer

XQL Search. XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Answer

BIOC Generator

Answer

Correlation Rules Builder

Answer

Query Builder for Syslog

Question 15

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

Accepted Answer

Settings > Configurations > Data Collection status monitor.. The Cloud Data Collector status page under Settings > Configurations > Data Collection provides health status, error codes, and ingestion latency metrics.

Answer

Dashboards > Executive Summary.

Answer

Incident Response > Queue Manager.

Answer

Endpoint Management > Collector Health.

Question 16

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Accepted Answer

Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.. Broker VM upgrades are managed directly from the Cortex XDR management console under Settings > Configurations > Broker VM.

Answer

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Answer

Re-deploy a new Broker VM virtual appliance and delete the old one.

Answer

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.

Question 17

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Unisolate.. Administrators can reverse containment by selecting the isolated endpoint in the Endpoints view and clicking 'Unisolate'.

Answer

Delete and recreate the endpoint agent installation token.

Answer

Reboot the endpoint twice in safe mode.

Answer

Run 'cytool set isolation disable' locally via command line.

Question 18

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Accepted Answer

The endpoint must allow PowerShell script execution and the Cortex XDR agent service must be running with administrative privileges.. Remote action scripts executed via Cortex XDR require appropriate PowerShell execution policies and agent permissions on the endpoint.

Answer

The Broker VM must be configured as a script relay server.

Answer

The endpoint must have WinRM enabled on TCP port 5985.

Answer

The user must be logged into an active GUI session.

Question 19

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). Broker VM application and collector logs are located in standard directories such as /var/log/pan/ or specific broker log paths.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 20

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Delete.. Inactive endpoints can be manually deleted or automatically purged based on inactivity settings under endpoint management.

Answer

Disable the Anti-Malware module.

Answer

Move the endpoint to an unmanaged folder.

Answer

Run 'cytool license release' via remote action.