XDR-Engineer Maintenance And Troubleshooting Practice Test 3 — 15 Questions

Question 1

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netstat -tulnp. The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Answer

pan_broker_status --syslog

Answer

traceroute -syslog

Answer

systemctl check-syslog

Question 2

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

Accepted Answer

Click the alert in the Incident view, select Add Exception, and define criteria such as file hash or digital signature.. Adding an exception directly from the alert in the Incident view allows the administrator to define precise criteria (e.g., file hash, digital signature) to exclude legitimate activity from triggering the BIOC. This is the most efficient method because it leverages the built-in exception mechanism without writing custom XQL queries. It also ensures the exception is scoped to the specific behavior, reducing false positives while maintaining security coverage.

Answer

Downgrade the agent content version to a legacy release.

Answer

Delete the default BIOC profile and create an entirely new tenant policy.

Answer

Restart the Cortex XDR Agent service on each developer workstation.

Question 3

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

Accepted Answer

Endpoints > All Endpoints view, under the Content Version column.. The Endpoints table displays the Content Version column for each managed endpoint.

Answer

Settings > Content Updates > Status.

Answer

Incident Response > Endpoint Inventory.

Answer

Dashboards > Content Health.

Question 4

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Accepted Answer

XQL Search. XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Answer

BIOC Generator

Answer

Correlation Rules Builder

Answer

Query Builder for Syslog

Question 5

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Accepted Answer

Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.. The recommended and supported method to upgrade the Cortex XDR Broker VM is through the Cortex XDR management console. Under Settings > Configurations > Broker VM, administrators can initiate the upgrade, which pushes the new version to the Broker VM. This ensures compatibility and proper validation by Palo Alto Networks.

Answer

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Answer

Re-deploy a new Broker VM virtual appliance and delete the old one.

Answer

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.

Question 6

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Unisolate.. In Cortex XDR, isolation is a containment action that restricts network connectivity except to the management console. To restore connectivity after remediation, the administrator selects the endpoint in Endpoints > All Endpoints and clicks Unisolate. This action releases the isolation policy and restores normal network access.

Answer

Delete and recreate the endpoint agent installation token.

Answer

Reboot the endpoint twice in safe mode.

Answer

Run 'cytool set isolation disable' locally via command line.

Question 7

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Accepted Answer

The endpoint must allow PowerShell script execution and the Cortex XDR agent service must be running with administrative privileges.. For a PowerShell remediation script to run successfully via Cortex XDR Remote Actions on a Windows endpoint, the endpoint must allow PowerShell script execution (e.g., ExecutionPolicy not restricted) and the Cortex XDR agent service must be running with administrative privileges. The agent service executes scripts in the context of the SYSTEM account, which requires admin rights.

Answer

The Broker VM must be configured as a script relay server.

Answer

The endpoint must have WinRM enabled on TCP port 5985.

Answer

The user must be logged into an active GUI session.

Question 8

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Accepted Answer

Settings > Configurations > Audit Trail. Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Answer

Dashboards > Audit Reports

Answer

Incident Response > Activity Log

Answer

Help > System Logs

Question 9

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. On macOS, system extensions (including Endpoint Security extensions) are managed by the systemextensionsctl command. Running 'systemextensionsctl list' displays all installed system extensions and their approval status, which is critical for diagnosing why a kernel extension might fail to start. This command is the correct local diagnostic tool for verifying system extension approval.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status

Question 10

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Accepted Answer

Settings > Configurations > Licenses. License details and usage quotas are found under Settings > Configurations > Licenses.

Answer

Dashboards > License Widget

Answer

Help > About Cortex XDR

Answer

Endpoints > Licensing Status

Question 11

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion. Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 12

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Accepted Answer

An anti-tamper password generated in the Cortex XDR management console.. Disabling agent protection locally via cytool requires entering a valid anti-tampering password or uninstall password generated in the console.

Answer

A domain administrator Kerberos ticket.

Answer

An internet connection to the Palo Alto Networks licensing server.

Answer

Physical access to the BIOS/UEFI settings.

Question 13

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Option C is correct because Cortex XDR agents often sit behind corporate proxies, so the administrator must confirm the endpoint's local proxy settings and ensure the agent profile contains valid proxy credentials (username/password or certificate) if the proxy requires authentication; otherwise the agent cannot reach the cloud. Option D is correct because the agent communicates with the Cortex XDR management console over outbound TCP 443 to the tenant-specific URL (e.g., .xdr..paloaltonetworks.com), so any firewall, security gateway, or SSL-inspection device blocking that traffic will break communication. Option A is wrong because the Broker VM does not require SSH access to endpoints; it is used for local agent communication and log collection, not remote shell management. Option B is wrong because UDP 514 is syslog, not a Cortex XDR agent communication channel, and the agent does not listen on it for cloud connectivity. Option E is wrong because inbound TCP 22 (SSH) is not needed for the agent to reach the cloud console and is unrelated to agent-cloud communication.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 14

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

openssl s_client -connect :. The `openssl s_client -connect :` command is the correct tool because it initiates a full TLS handshake with the remote SIEM listener, verifying both network reachability (TCP connection) and TLS negotiation success. This directly addresses the administrator's need to confirm that the Broker VM can establish a secure channel to the SIEM over HTTPS Syslog. Unlike basic connectivity tests, it validates certificate exchange, protocol version, and cipher suite compatibility, which are critical for HTTPS-based syslog forwarding.

Answer

syslog-test --handshake

Answer

telnet <siem_ip> 443 --secure

Answer

ping -tls <siem_ip>

Question 15

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Accepted Answer

Configure syslog sources to point to a network load balancer that distributes traffic across multiple Broker VM instances.. Option B is correct because placing a network load balancer in front of multiple Broker VMs lets syslog sources send to one virtual IP while the load balancer distributes connections across the Broker VM instances, providing both load balancing and failover if one VM becomes unavailable. Option E is correct because deploying multiple Broker VMs horizontally scales log forwarding capacity, so large numbers of endpoints and syslog sources are spread across several appliances rather than overloading a single VM. Options A and D are incorrect because Cortex XDR Broker VMs do not support Windows Failover Clustering or VRRP-based active-passive clustering inside the appliance; high availability is achieved through external load balancing and multiple broker instances, not OS-level clustering. Option C is incorrect because funneling all syslog traffic through one Broker VM creates a single point of failure and a bottleneck, which is the opposite of the high availability and load balancing goal.

Answer

Cluster Broker VMs into a single IP address using Windows Failover Clustering.

Answer

Route all syslog traffic through a single Broker VM to prevent packet loss.

Answer

Configure active-passive clustering using VRRP directly inside the Broker VM appliance settings.