XDR-Engineer Maintenance And Troubleshooting — Timed 10 Questions

Question 1

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

10 minute time limit — choose an answer to begin.

Accepted Answer

cytool. CyveraConsole.exe or the cytool utility is the command-line interface provided on endpoints to manage Cortex XDR agent protection modules, configuration, and troubleshooting.

Answer

cortex_cli.sh

Answer

traps_control.exe

Answer

xdr_agent_mgr.exe

Question 2

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Accepted Answer

Add a profile exception under Settings > Configurations > Agent Configurations specifying the exploit module and application path.. BIOC (Behavioral Indicator of Compromise) and Exploit Protection exceptions can be managed via Exception profiles or profile exclusions in Cortex XDR.

Answer

Disable behavioral threat protection globally.

Answer

Create a correlation rule to suppress alerts from that path.

Answer

Modify the Broker VM ingestion filter.

Question 3

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

Accepted Answer

CyveraInstall.log. CyveraInstall.log is the Cortex XDR agent installation log written to the endpoint during MSI/installer execution, and it records service registration, driver installation, and startup failures. When an agent installs but fails to communicate with the management console, this log is the first place to confirm whether the agent service actually started and whether the install completed cleanly. It is the documented first-stop artifact for installation and service-startup troubleshooting.

Answer

CortexDebug.etl

Answer

TrapsConfig.xml

Answer

AgentService.dmp

Question 4

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Accepted Answer

systemctl status pan-syslog-collector. Systemctl is the standard Linux service management tool used on the Broker VM appliance.

Answer

pan_status --all

Answer

broker-vm status-collector

Answer

service broker status

Question 5

An administrator needs to collect troubleshooting logs from a misbehaving Cortex XDR Agent on a Windows endpoint. Which cytool command generates a comprehensive support file archive?

Accepted Answer

cytool log collect. The 'cytool log collect' command packages all relevant diagnostic logs, configuration files, and crash dumps into a support archive.

Answer

cytool diag package

Answer

cytool support export

Answer

cytool dump-all

Question 6

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Accepted Answer

Configure the proxy address, port, and authentication credentials within the Agent Configuration profile under Settings.. Proxy settings for the Cortex XDR agent are configured within the Agent Configuration profile in the Cortex XDR management console before installation or pushed via update.

Answer

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Answer

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Answer

Configure the proxy settings on the Broker VM only.

Question 7

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

Accepted Answer

Settings > Configurations > Data Collection status monitor.. The Cloud Data Collector status page under Settings > Configurations > Data Collection provides health status, error codes, and ingestion latency metrics.

Answer

Dashboards > Executive Summary.

Answer

Incident Response > Queue Manager.

Answer

Endpoint Management > Collector Health.

Question 8

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Accepted Answer

/var/log/pan/syslog_collector.log (or corresponding broker log path). The Broker VM's syslog collector service writes ingestion errors, parsing failures, and message-handling exceptions to /var/log/pan/syslog_collector.log (or the equivalent broker log path on the appliance). This is the dedicated log for the syslog ingestion pipeline, so dropped messages and parser exceptions surface there rather than in general OS logs.

Answer

/var/log/messages

Answer

/var/log/secure

Answer

/opt/panw/broker/cortex.log

Question 9

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Accepted Answer

Select the endpoint in Endpoints > All Endpoints and click Delete.. In Cortex XDR, deleting an endpoint from Endpoints > All Endpoints removes its record from the management console and frees up its license seat. This is the standard procedure for decommissioning endpoints that are offline or no longer in use, as the license is tied to the endpoint registration. Once deleted, the endpoint will no longer consume an active license, and if it reconnects, it will re-register as a new endpoint (potentially consuming a new license).

Answer

Disable the Anti-Malware module.

Answer

Move the endpoint to an unmanaged folder.

Answer

Run 'cytool license release' via remote action.

Question 10

An administrator needs to deploy the Cortex XDR Agent to hundreds of endpoints using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch is required during silent installation to specify the management console registration token?

Accepted Answer

ACTIVATION_KEY=<token_value>. Silent installations of the Cortex XDR agent on Windows require the 'ACTIVATION_KEY' property parameter.

Answer

TOKEN=<token_value>

Answer

REGISTER_ID=<token_value>

Answer

XDR_KEY=<token_value>