XDR-Engineer Maintenance And Troubleshooting Practice Test 2 — 15 Questions

Question 1

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Accepted Answer

Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.. Broker VM upgrades are managed directly from the Cortex XDR management console under Settings > Configurations > Broker VM.

Answer

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Answer

Re-deploy a new Broker VM virtual appliance and delete the old one.

Answer

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.

Question 2

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Unisolate.. Administrators can reverse containment by selecting the isolated endpoint in the Endpoints view and clicking 'Unisolate'.

Answer

Delete and recreate the endpoint agent installation token.

Answer

Reboot the endpoint twice in safe mode.

Answer

Run 'cytool set isolation disable' locally via command line.

Question 3

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Accepted Answer

The endpoint must allow PowerShell script execution and the Cortex XDR agent service must be running with administrative privileges.. Remote action scripts executed via Cortex XDR require appropriate PowerShell execution policies and agent permissions on the endpoint.

Answer

The Broker VM must be configured as a script relay server.

Answer

The endpoint must have WinRM enabled on TCP port 5985.

Answer

The user must be logged into an active GUI session.

Question 4

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). Broker VM application and collector logs are located in standard directories such as /var/log/pan/ or specific broker log paths.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 5

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Delete.. Inactive endpoints can be manually deleted or automatically purged based on inactivity settings under endpoint management.

Answer

Disable the Anti-Malware module.

Answer

Move the endpoint to an unmanaged folder.

Answer

Run 'cytool license release' via remote action.

Question 6

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Accepted Answer

Settings > Configurations > Audit Trail. Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Answer

Dashboards > Audit Reports

Answer

Incident Response > Activity Log

Answer

Help > System Logs

Question 7

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. macOS uses system extension management commands such as 'systemextensionsctl' to inspect loaded and approved extensions.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status

Question 8

An administrator is troubleshooting a scenario where Cortex XDR incident causality chains appear broken or incomplete. Which local agent component or setting is primarily responsible for tracking process creation and parent-child lineage for causality analysis?

Accepted Answer

Behavioral Threat Protection / Behavioral Monitoring driver. Cortex XDR uses behavioral monitoring and kernel/system extension hooks to build causality chains. On Windows, the exploit prevention and behavioral threat protection driver handle process telemetry.

Answer

Local Syslog Forwarder

Answer

Agent GUI Application (Traps.exe)

Answer

Broker VM Parser Module

Question 9

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Accepted Answer

Settings > Configurations > Licenses. License details and usage quotas are found under Settings > Configurations > Licenses.

Answer

Dashboards > License Widget

Answer

Help > About Cortex XDR

Answer

Endpoints > Licensing Status

Question 10

An administrator notices that a Linux endpoint running Cortex XDR Agent has high CPU utilization caused by the agent process. Which command can the administrator use via cytool to temporarily modify debug logging levels or diagnostic tracing to assist support without uninstalling?

Accepted Answer

cytool log set-level. The 'cytool log' command set allows administrators to adjust log levels and debug verbosity on running agents.

Answer

cytool perf-tune

Answer

cytool trace modify

Answer

cytool debug cpu-limit

Question 11

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Broker VM troubleshooting involves checking system resource consumption, container/service status, and collector log outputs.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 12

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Accepted Answer

An anti-tamper password generated in the Cortex XDR management console.. Disabling agent protection locally via cytool requires entering a valid anti-tampering password or uninstall password generated in the console.

Answer

A domain administrator Kerberos ticket.

Answer

An internet connection to the Palo Alto Networks licensing server.

Answer

Physical access to the BIOS/UEFI settings.

Question 13

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Agent connectivity troubleshooting requires checking outbound HTTPS reachability to the tenant and verifying valid agent proxy or DNS resolution settings.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 14

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

Accepted Answer

openssl s_client -connect :. OpenSSL s_client is the standard command-line tool used to test TLS connectivity, certificate validation, and handshakes.

Answer

syslog-test --handshake

Answer

telnet <siem_ip> 443 --secure

Answer

ping -tls <siem_ip>

Question 15

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Accepted Answer

Configure syslog sources to point to a network load balancer that distributes traffic across multiple Broker VM instances.. Broker VM high availability is achieved by deploying multiple Broker VMs behind a load balancer or configuring multiple syslog forwarders.

Answer

Cluster Broker VMs into a single IP address using Windows Failover Clustering.

Answer

Route all syslog traffic through a single Broker VM to prevent packet loss.

Answer

Configure active-passive clustering using VRRP directly inside the Broker VM appliance settings.