XDR-Engineer Maintenance And Troubleshooting — 25 Questions

Question 1

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cytool. CyveraConsole.exe or the cytool utility is the command-line interface provided on endpoints to manage Cortex XDR agent protection modules, configuration, and troubleshooting.

Answer

cortex_cli.sh

Answer

traps_control.exe

Answer

xdr_agent_mgr.exe

Question 2

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Accepted Answer

Add a profile exception under Settings > Configurations > Agent Configurations specifying the exploit module and application path.. BIOC (Behavioral Indicator of Compromise) and Exploit Protection exceptions can be managed via Exception profiles or profile exclusions in Cortex XDR.

Answer

Disable behavioral threat protection globally.

Answer

Create a correlation rule to suppress alerts from that path.

Answer

Modify the Broker VM ingestion filter.

Question 3

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

Accepted Answer

CyveraInstall.log. CyveraInstall.log is the Cortex XDR agent installation log written to the endpoint during MSI/installer execution, and it records service registration, driver installation, and startup failures. When an agent installs but fails to communicate with the management console, this log is the first place to confirm whether the agent service actually started and whether the install completed cleanly. It is the documented first-stop artifact for installation and service-startup troubleshooting.

Answer

CortexDebug.etl

Answer

TrapsConfig.xml

Answer

AgentService.dmp

Question 4

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Accepted Answer

systemctl status pan-syslog-collector. Systemctl is the standard Linux service management tool used on the Broker VM appliance.

Answer

pan_status --all

Answer

broker-vm status-collector

Answer

service broker status

Question 5

An administrator needs to collect troubleshooting logs from a misbehaving Cortex XDR Agent on a Windows endpoint. Which cytool command generates a comprehensive support file archive?

Accepted Answer

cytool log collect. The 'cytool log collect' command packages all relevant diagnostic logs, configuration files, and crash dumps into a support archive.

Answer

cytool diag package

Answer

cytool support export

Answer

cytool dump-all

Question 6

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Accepted Answer

Configure the proxy address, port, and authentication credentials within the Agent Configuration profile under Settings.. Proxy settings for the Cortex XDR agent are configured within the Agent Configuration profile in the Cortex XDR management console before installation or pushed via update.

Answer

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Answer

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Answer

Configure the proxy settings on the Broker VM only.

Question 7

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

Accepted Answer

Settings > Configurations > Data Collection status monitor.. The Cloud Data Collector status page under Settings > Configurations > Data Collection provides health status, error codes, and ingestion latency metrics.

Answer

Dashboards > Executive Summary.

Answer

Incident Response > Queue Manager.

Answer

Endpoint Management > Collector Health.

Question 8

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). The Broker VM's syslog collector service writes ingestion errors, parsing failures, and message-handling exceptions to /var/log/pan/syslog_collector.log (or the equivalent broker log path on the appliance). This is the dedicated log for the syslog ingestion pipeline, so dropped messages and parser exceptions surface there rather than in general OS logs.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 9

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Delete.. In Cortex XDR, deleting an endpoint from Endpoints > All Endpoints removes its record from the management console and frees up its license seat. This is the standard procedure for decommissioning endpoints that are offline or no longer in use, as the license is tied to the endpoint registration. Once deleted, the endpoint will no longer consume an active license, and if it reconnects, it will re-register as a new endpoint (potentially consuming a new license).

Answer

Disable the Anti-Malware module.

Answer

Move the endpoint to an unmanaged folder.

Answer

Run 'cytool license release' via remote action.

Question 10

An administrator needs to deploy the Cortex XDR Agent to hundreds of endpoints using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch is required during silent installation to specify the management console registration token?

Accepted Answer

ACTIVATION_KEY=<token_value>. Silent installations of the Cortex XDR agent on Windows require the 'ACTIVATION_KEY' property parameter.

Answer

TOKEN=<token_value>

Answer

REGISTER_ID=<token_value>

Answer

XDR_KEY=<token_value>

Question 11

An administrator is troubleshooting a scenario where Cortex XDR incident causality chains appear broken or incomplete. Which local agent component or setting is primarily responsible for tracking process creation and parent-child lineage for causality analysis?

Accepted Answer

Behavioral Threat Protection / Behavioral Monitoring driver. Cortex XDR uses behavioral monitoring and kernel/system extension hooks to build causality chains. On Windows, the exploit prevention and behavioral threat protection driver handle process telemetry.

Answer

Local Syslog Forwarder

Answer

Agent GUI Application (Traps.exe)

Answer

Broker VM Parser Module

Question 12

An administrator notices that a Linux endpoint running Cortex XDR Agent has high CPU utilization caused by the agent process. Which command can the administrator use via cytool to temporarily modify debug logging levels or diagnostic tracing to assist support without uninstalling?

Accepted Answer

cytool log set-level. The 'cytool log' command set allows administrators to adjust log levels and debug verbosity on running agents.

Answer

cytool perf-tune

Answer

cytool trace modify

Answer

cytool debug cpu-limit

Question 13

An administrator needs to troubleshoot an endpoint where the Cortex XDR agent has been tampered with or corrupted. Which TWO actions can the administrator take to repair or reinstall the agent safely? (Choose two)

Accepted Answer

Uninstall the agent using the console-generated uninstallation password, then perform a clean reinstallation using the latest installer package.. Option D is correct because when the Cortex XDR agent is tampered with or corrupted, the supported remediation path is to uninstall it using the console-generated uninstallation password (obtained from the management console for that specific endpoint) and then perform a clean reinstall with the latest installer package, ensuring no residual corrupted files or stale registrations remain. Option E is correct because 'cytool' is the Cortex XDR agent's local CLI utility; when run with the appropriate maintenance password it can reset corrupted agent database files and restore default settings, repairing the agent without a full uninstall/reinstall cycle. Option A is not appropriate because formatting the drive and restoring a factory image is a drastic, disruptive action that is unnecessary for repairing a single agent and would destroy user data. Option B is wrong because manually deleting the agent folder in Program Files bypasses the uninstaller, leaving registry entries, drivers, and services behind, which can prevent a clean reinstall and is unsupported. Option C is wrong because forcing an overwrite installation via Windows Group Policy is not a supported Cortex XDR repair method and does not address tampered or corrupted agent components.

Answer

Format the endpoint hard drive and restore from a factory image.

Answer

Delete the agent folder manually in Program Files without using the uninstaller.

Answer

Force an overwrite installation without uninstalling by modifying Windows Group Policy.

Question 14

A Cortex XDR administrator has a Windows endpoint that is repeatedly crashing during boot after a recent agent content update. The administrator needs to boot the endpoint into Safe Mode to remove the problematic agent files, but the Cortex XDR Agent is blocking Safe Mode. What is the recommended method to allow Safe Mode boot?

Accepted Answer

Run the command 'cytool safe-mode enable' from an elevated command prompt.. The Cortex XDR Agent blocks Safe Mode by default to prevent malware from disabling protection. To allow Safe Mode for troubleshooting, administrators can use the Cytool utility with the 'safe-mode' command. This temporarily permits Safe Mode boot without removing the agent, enabling remediation of issues like boot crashes.

Answer

Use the Cytool utility with the 'safe_mode' parameter to enable Safe Mode boot.

Answer

Create a Windows Registry key to allow Safe Mode boot and then reboot the endpoint.

Answer

Use the Cortex XDR Agent uninstall password to disable the agent temporarily.

Question 15

A Cortex XDR administrator is troubleshooting a performance issue on a Windows endpoint. They suspect the Cortex XDR agent's kernel-level driver is causing high CPU usage. They need to obtain detailed diagnostic logs from the agent without disrupting the endpoint's protection. Which action should they take?

Accepted Answer

Enable debug logging via the agent's configuration and collect logs using Cytool.. To troubleshoot high CPU usage potentially caused by the Cortex XDR agent's kernel driver, the administrator should enable debug logging to capture detailed diagnostic information. Cytool can then collect these logs for analysis. This method is non-disruptive to endpoint protection and provides the necessary data to identify the issue.

Answer

Use the Cortex XDR agent's built-in performance monitoring tool from the endpoint's system tray.

Answer

Restart the Cortex XDR agent service and monitor CPU usage in Task Manager.

Answer

Run the Cytool command with the 'support' parameter to generate a support bundle.

Question 16

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Accepted Answer

BIOC Rule Simulator. The BIOC Rule Simulator is designed to test BIOC rules against historical data. It allows administrators to validate rule logic, ensuring that the rule would have generated alerts if the activity occurred. This is the most efficient way to troubleshoot why a BIOC rule is not firing, as it directly evaluates the rule against past events.

Answer

Query Builder

Answer

Live Terminal

Answer

Action Center

Question 17

An administrator is troubleshooting a performance issue on a Cortex XDR Broker VM. The broker is currently handling a high volume of traffic from thousands of endpoints. The administrator suspects that the broker is overwhelmed and wants to verify the current CPU and memory utilization. Which action should the administrator take to obtain this information?

Accepted Answer

In the Cortex XDR management console, navigate to Settings > Broker VMs and select the specific broker to view its resource utilization metrics.. The Cortex XDR management console includes a dedicated section for Broker VM management and monitoring. Under Settings > Broker VMs, administrators can view live CPU and memory utilization for each broker, which directly addresses the need to verify if the broker is overwhelmed. This is the supported and most efficient method, avoiding the need for direct SSH access or non-existent commands.

Answer

Run the 'broker_status' command from the Cortex XDR agent on any managed endpoint to query the broker's performance counters.

Answer

Check the Windows Event Log on the Broker VM for performance monitor entries that report CPU and memory usage.

Answer

Access the Broker VM console via SSH and run the 'top' command to view real-time CPU and memory usage.

Question 18

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Linux endpoint fails to start after a recent update. The administrator needs to collect relevant logs to diagnose the problem. Which two actions should they take? (Choose two.)

Accepted Answer

Run the 'cytool' command with the 'support' parameter to generate a support bundle.. For a Linux endpoint where the Cortex XDR agent fails to start, the administrator should collect a support bundle using cytool and check the systemd journal for the agent service. These actions provide the necessary logs to diagnose the startup failure without requiring the agent to be operational.

Answer

Run 'service cortex-xdr status' to check the agent status.

Answer

Enable debug logging by editing the agent configuration file and restarting the agent.

Answer

Review the Windows Event Viewer for Cortex XDR errors.

Question 19

A Cortex XDR administrator needs to install the Cortex XDR agent on a large number of Windows endpoints using Microsoft Endpoint Configuration Manager (MECM/SCCM). The administrator wants to ensure the agent is installed silently without user interaction and with the correct tenant settings preconfigured. Which installation method should the administrator use?

Accepted Answer

Create an application in MECM that runs the agent MSI with the /quiet and /norestart flags, and include the tenant ID in the command line.. The correct approach is to deploy the agent through MECM as an application, using the MSI with silent flags and embedding the tenant ID in the command line. This ensures a silent, unattended installation that automatically registers with the correct tenant. MECM provides robust reporting and troubleshooting capabilities, which are essential for large-scale deployments. Other methods may work but lack the automation, reliability, and preconfiguration needed for enterprise-wide rollouts.

Answer

Use a PowerShell script that downloads the agent installer from the Cortex XDR console and runs it with default settings.

Answer

Deploy the agent using a Group Policy Object (GPO) with the MSI file and a transform (MST) file containing the tenant ID.

Answer

Deploy the agent using a logon script that executes the installer with the /passive flag.

Question 20

A security engineer is investigating a series of alerts indicating that a Cortex XDR agent on a Linux server is repeatedly failing to connect to the Broker VM. The agent logs show 'connection refused' errors. The engineer confirms that the Broker VM is up and running, and other agents are communicating fine. Which of the following is the most likely cause of this specific agent's connectivity issue?

Accepted Answer

The Linux server's firewall is blocking outbound traffic to the Broker VM on the required port.. The 'connection refused' error indicates that the agent's connection attempt reached the Broker VM but was actively rejected on the port. Since the Broker VM is healthy and other agents connect, the problem is isolated to the Linux server. A local firewall blocking outbound traffic to the required port is the most likely cause. The engineer should verify firewall rules and ensure the port is open.

Answer

The Broker VM's disk is full, causing it to reject new connections from some agents.

Answer

The Broker VM's SSL certificate has expired, causing all agents to fail connection.

Answer

The Cortex XDR agent on the Linux server has not been assigned a valid license.