XDR-Engineer Planning And Installation — 15 Questions

Question 1

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a Mobile Device Management (MDM) configuration profile containing the required system extension and network filter payloads. On modern macOS versions, system extensions and network filters require an MDM configuration profile to grant explicit pre-approval and avoid manual user authorization prompts.

Answer

Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode

Answer

Modify the /etc/pam.d/authorization file prior to running the PKG installer

Answer

Run the installer using sudo privileges with the --force flag

Question 2

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

Accepted Answer

Cortex XDR Broker VM. In dark site or disconnected environments, the Cortex XDR Collector is used to proxy agent telemetry and updates since agents cannot directly reach the Cortex XDR cloud.

Answer

Prisma Access Remote Networks Connector

Answer

Traps Management Service

Answer

Panorama Management Server

Question 3

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

Accepted Answer

Configure a static IP address via the CLI and enter the Broker VM registration key generated in the Cortex XDR console. To link a newly deployed Broker VM to the cloud tenant, the administrator must register it using a registration key generated in the Cortex XDR console.

Answer

Upload a valid SSL wildcard certificate signed by a public Certificate Authority directly to the hypervisor

Answer

Run the setup wizard using the default admin credentials and map an NFS datastore

Answer

Configure a Syslog forwarding rule in Panorama to push the registration payload

Question 4

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

Accepted Answer

yum install ./cxdr-agent.rpm. Linux agent installations on RHEL utilize standard package managers like yum or rpm with the provided agent package and prerequisites.

Answer

apt-get install ./cortex-xdr.deb

Answer

brew install paloalto-cortex-xdr

Answer

rpm -i ctrex-agent.rpm

Question 5

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the cloud tenant via HTTPS over TCP port 443.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 6

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required when deploying software packages via Active Directory Group Policy Objects (GPOs) on Windows endpoints.

Answer

TGZ

Answer

PKG

Answer

EXE

Question 7

An enterprise environment requires the Cortex XDR Broker VM to be sized correctly for handling log forwarding and agent proxying from 15,000 endpoints. Which minimum hardware specification should the administrator allocate for the Broker VM hypervisor?

Accepted Answer

4 vCPU and 16 GB RAM. For large deployments supporting agent proxying and syslog/API log collection for up to 15,000 endpoints, the recommended Broker VM sizing is typically 4 vCPUs and 16 GB of RAM.

Answer

1 vCPU and 2 GB RAM

Answer

16 vCPU and 64 GB RAM

Answer

2 vCPU and 4 GB RAM

Question 8

During the initial setup of a Cortex XDR tenant, where does the administrator navigate in the management console to download agent installation packages for various operating systems?

Accepted Answer

Endpoints > Installers. Agent installers and packages are located under the 'Installers' menu within the Cortex XDR management console.

Answer

Settings > Configurations > Agents

Answer

Dashboards > Incident Management > Installers

Answer

Endpoints > Agent Settings > Packages

Question 9

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 10

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. Standard Windows Installer (msiexec) uses '/qn' or '/quiet' to perform a completely silent installation.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 11

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

Accepted Answer

An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM. SSL inspection or interception by an explicit proxy or next-generation firewall without proper TLS decryption certificate installation causes SSL handshake failures on the Broker VM.

Answer

The Broker VM registration key contains invalid characters due to copy-paste formatting

Answer

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Answer

The Broker VM kernel version is incompatible with the Linux swap space partition size

Question 12

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

Accepted Answer

Telemetry and Monitoring (Detection-only) Mode. Deploying agents in a non-blocking or telemetry-only mode allows administrators to assess alerts and rule performance safely before enforcing blocks.

Answer

Aggressive Prevention Mode

Answer

Disabled Mode

Answer

Quarantine Mode

Question 13

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

Accepted Answer

Cortex XDR Broker VM with the Syslog Collector module enabled. The Cortex XDR Broker VM supports log collector modules that ingest syslog data from third-party devices and forward it to the Cortex XDR data lake.

Answer

Palo Alto Networks Next-Generation Firewall configured with GlobalProtect

Answer

Cortex XDR Agent installed on a dedicated Linux log server

Answer

Prisma Access Cloud Secure Web Gateway

Question 14

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Different endpoint groups (e.g., servers vs. workstations) require different security thresholds, scan schedules, and operational modes, necessitating multiple profiles.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 15

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

Accepted Answer

Enter the designated Cortex XDR agent uninstallation password when prompted by the uninstaller. Cortex XDR agents are protected against unauthorized removal by an uninstallation password configured in the agent settings profile.

Answer

Revoke the endpoint certificate from the local Certificate Authority (CA) store

Answer

Disable Windows Defender and run the standard Windows Add or Remove Programs wizard

Answer

Boot the endpoint into Safe Mode and delete the agent installation directory manually