XDR-Engineer Planning And Installation — 40 Questions

Question 1

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a static IP address via the CLI and enter the Broker VM registration key generated in the Cortex XDR console. To link a newly deployed Broker VM to the cloud tenant, the administrator must register it using a registration key generated in the Cortex XDR console.

Answer

Upload a valid SSL wildcard certificate signed by a public Certificate Authority directly to the hypervisor

Answer

Run the setup wizard using the default admin credentials and map an NFS datastore

Answer

Configure a Syslog forwarding rule in Panorama to push the registration payload

Question 2

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

Accepted Answer

yum install ./cxdr-agent.rpm. For RHEL 8, the native package manager is yum (or dnf), which can install local RPM packages. The command 'yum install ./cxdr-agent.rpm' correctly uses yum to install the Cortex XDR agent RPM package, resolving dependencies automatically. This is the supported method for deploying the agent on RHEL-based systems.

Answer

apt-get install ./cortex-xdr.deb

Answer

brew install paloalto-cortex-xdr

Answer

rpm -i ctrex-agent.rpm

Question 3

An enterprise environment requires the Cortex XDR Broker VM to be sized correctly for handling log forwarding and agent proxying from 15,000 endpoints. Which minimum hardware specification should the administrator allocate for the Broker VM hypervisor?

Accepted Answer

4 vCPU and 16 GB RAM. For large deployments supporting agent proxying and syslog/API log collection for up to 15,000 endpoints, the recommended Broker VM sizing is typically 4 vCPUs and 16 GB of RAM.

Answer

1 vCPU and 2 GB RAM

Answer

16 vCPU and 64 GB RAM

Answer

2 vCPU and 4 GB RAM

Question 4

During the initial setup of a Cortex XDR tenant, where does the administrator navigate in the management console to download agent installation packages for various operating systems?

Accepted Answer

Endpoints > Installers. Agent installers and packages are located under the 'Installers' menu within the Cortex XDR management console.

Answer

Settings > Configurations > Agents

Answer

Dashboards > Incident Management > Installers

Answer

Endpoints > Agent Settings > Packages

Question 5

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. The Cortex XDR agent MSI is a standard Windows Installer package, so it accepts native msiexec command-line switches. /qn sets the UI level to 'quiet, no UI' and /norestart prevents the installer from rebooting the endpoint automatically — the correct combination for unattended SCCM mass deployment. SCCM typically invokes msiexec with these flags so the install runs silently in SYSTEM context without prompting users or forcing reboots mid-deployment.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 6

An administrator needs to upgrade the Cortex XDR agents across all enterprise endpoints. Where should the administrator upload and manage the new agent software versions before rolling them out?

Accepted Answer

Endpoints > Agent Upgrades. Administrators manage and stage agent software versions under the Agent Upgrades section in the Cortex XDR console.

Answer

Dashboards > System Status > Updates

Answer

Administration > Global Protect > Client Versions

Answer

Settings > Tenant Management > Software Repository

Question 7

An administrator is deploying the Cortex XDR agent on a virtual desktop infrastructure (VDI) non-persistent pool. Which configuration consideration is critical to ensure proper management and prevent duplicate endpoint entries in the Cortex XDR console?

Accepted Answer

Enable the VDI optimization setting in the agent installation parameters or profile so the agent cleans up stale records upon shutdown. Non-persistent VDI clones frequently power down and reset, requiring proper master image preparation with VDI flags enabled to prevent cluttering the console with stale offline endpoints.

Answer

Disable all behavioral threat prevention modules on gold master images

Answer

Configure the hypervisor to inject a new license key on every reboot

Answer

Install a unique static IP address allocation script for every virtual machine instance spawned

Question 8

An administrator wants to verify the version of the Cortex XDR agent running on a specific macOS endpoint. Which command should be executed in the macOS Terminal?

Accepted Answer

/Library/Application Support/PaloAltoNetworks/Cortex/cytool runtime query version. The cytool utility is available across platforms, including macOS, for checking agent status and version.

Answer

/Library/Application Support/PaloAltoNetworks/Cortex/cytool.sh version

Answer

/Library/Cortex/bin/cytool version query

Answer

/Applications/Cortex.app/Contents/MacOS/cytool query version

Question 9

An administrator is troubleshooting an agent installation failure on a Windows endpoint. Where is the primary installation log file generated by the MSI installer located for review?

Accepted Answer

The user or system Temp folder (e.g., %TEMP% or C:\Users\...\AppData\Local\Temp) containing msiexec verbose logs. Windows Installer generates verbose MSI logs when requested, but standard installer diagnostic logs for Cortex XDR can be found in the system temp directory or installation logs path.

Answer

C:\Windows\Logs\Cortex\install.log

Answer

C:\ProgramData\Palo Alto Networks\Cortex\Logs\

Answer

C:\System32\Drivers\PaloAlto\install_debug.txt

Question 10

An organization has strict compliance requirements preventing direct internet access from any server. The administrator deploys a Broker VM to act as an agent proxy. How must the agent installation command be modified so that endpoints know to communicate through the Broker VM instead of directly reaching the cloud?

Accepted Answer

Include the PROXY_SERVER parameter with the IP address or FQDN of the Broker VM during the MSI installation command. When deploying agents in environments using a Broker VM for proxying, the installation command or transform must specify the Broker VM address parameter.

Answer

Modify the Windows routing table using route add to forward port 443 traffic to the Broker VM IP

Answer

Configure a DHCP option 152 scope to distribute the Broker VM address automatically to all DHCP clients

Answer

Rename the agent executable file to match the Broker VM hostname before execution

Question 11

An administrator is preparing to uninstall the Cortex XDR agent from a protected Windows endpoint for troubleshooting purposes. Which THREE methods or tools can be used to successfully remove the agent? (Choose three)

Accepted Answer

Using the Windows 'Add or Remove Programs' interface provided the uninstallation password is supplied.. Option B is correct because the Cortex XDR agent registers a standard Windows uninstaller entry, so an administrator can remove it through 'Add or Remove Programs' (Apps & features) as long as the uninstall password set in the agent profile is provided to authorize the removal. Option C is correct because the agent ships with the cytool utility, and running 'cytool uninstall' from an elevated command prompt with the correct uninstall password performs a supported, clean removal of the agent and its services/drivers. Option E is correct because the Cortex XDR management console provides endpoint actions that include an uninstall/remove agent action, allowing the administrator to trigger removal remotely without touching the endpoint directly. Option A is not valid because simply deleting the program files folder in Explorer leaves the agent's kernel drivers, services, and registry entries intact, so the agent is not truly uninstalled and the deletion may be blocked by self-protection. Option D is not valid because editing the registry to delete a MAC address key does not uninstall the agent and can corrupt its configuration or licensing state rather than removing the product.

Answer

Deleting the Cortex XDR program files folder directly in Windows Explorer while the services are running.

Answer

Running the standard Windows Registry Editor to delete the primary endpoint MAC address key.

Question 12

An administrator is planning the installation of Cortex XDR agents on a set of Linux servers that are part of a high-availability cluster. The administrator must ensure that the agent does not interfere with the cluster's heartbeat network communication. Which configuration should be applied during agent installation?

Accepted Answer

Configure a bypass rule in the agent settings to exclude the heartbeat network interface from all protection modules.. Creating a bypass rule to exclude the heartbeat network interface from all protection modules ensures that the agent does not inspect or interfere with cluster heartbeat traffic. This maintains cluster high availability while keeping the agent active for other network traffic, balancing security and operational requirements.

Answer

Add the cluster heartbeat IP addresses to the agent's allow list for network exclusions.

Answer

Disable the agent's network protection module entirely on all cluster nodes.

Answer

Install the agent with the '--no-network' command-line option to skip network driver installation.

Question 13

A security engineer is preparing to install the Cortex XDR agent on a Windows Server 2019 host that will be used as a jump server. The engineer needs to ensure the agent installation does not require an immediate reboot. Which deployment method should be used?

Accepted Answer

Install the agent using the MSI package with the REBOOT=ReallySuppress property.. The REBOOT=ReallySuppress property instructs the Windows Installer to suppress any reboot initiated by the installation, allowing the administrator to defer the reboot to a maintenance window. While a reboot may still be required for full functionality, this method prevents an immediate restart. The other options either do not suppress the reboot effectively or do not address the requirement.

Answer

Deploy the agent using the Cortex XDR management console's push installation feature.

Answer

Install the agent using the standalone executable with the /quiet and /norestart options.

Answer

Install the agent using the MSI package with the /norestart flag.

Question 14

An administrator is planning the installation of Cortex XDR agents on a large number of endpoints. The administrator wants to ensure that the agents can be centrally managed and that endpoint data is properly sent to the Cortex XDR console. Which two components are required for the agents to communicate with the Cortex XDR cloud? (Choose two.)

Accepted Answer

The endpoints must have outbound HTTPS connectivity to the Cortex XDR cloud.. For Cortex XDR agents to communicate with the Cortex XDR cloud, two key requirements are that the management console is accessible and that endpoints have outbound HTTPS connectivity. These ensure agents can register, send telemetry, and receive updates. Other components like Broker VM or Cortex Data Lake are not strictly required for basic communication.

Answer

A Cortex Data Lake instance must be deployed in the same region as the endpoints.

Answer

The endpoints must have the Cortex XDR agent installed and registered.

Answer

A Broker VM must be deployed on-premises.

Question 15

An administrator is preparing to install the Cortex XDR agent on a Windows Server 2019 endpoint that hosts a critical SQL database. To minimize performance impact, which installation option should be selected?

Accepted Answer

Disable the Behavioral Threat and Exploit protection modules during installation. Disabling resource-intensive modules like Behavioral Threat and Exploit protection during installation is recommended for database servers to avoid performance issues. These modules can be re-enabled after validating that the server's performance remains acceptable, balancing security and operational stability.

Answer

Install with the 'Server' installation type

Answer

Enable all protection modules by default

Answer

Install the agent in 'Audit' mode only

Question 16

A security administrator is deploying Cortex XDR agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to ensure that the agent automatically registers with the correct Cortex XDR tenant and receives the appropriate policy. Which installation parameter must be included in the deployment script?

Accepted Answer

The tenant ID, distribution ID, and registration token. When deploying Cortex XDR agents via third-party tools, the installation command must include the tenant ID, distribution ID, and registration token to ensure the agent registers with the correct tenant and receives the intended policy. These parameters are typically provided in the agent installation package or the management console.

Answer

The distribution ID and registration token

Answer

The policy name and registration token

Answer

The tenant ID and registration token

Question 17

A Cortex XDR administrator is planning to deploy agents to endpoints that are often offline or have intermittent connectivity. The administrator wants to ensure that these agents receive policy updates and can upload alerts as soon as they reconnect. Which agent setting should be configured to achieve this?

Accepted Answer

Ensure the agent has a persistent local cache and configure it to sync upon reconnection.. Cortex XDR agents are designed to operate offline and cache alerts and policy updates locally. When the endpoint reconnects, the agent automatically synchronizes with the cloud, uploading cached alerts and downloading any pending policy changes. This built-in capability ensures that intermittent connectivity does not result in data loss or stale policies.

Answer

Increase the agent's heartbeat interval to reduce bandwidth usage.

Answer

Enable the 'Offline Mode' setting in the agent configuration profile.

Answer

Configure the agent to use a Broker VM as a proxy for communication.

Question 18

A security engineer is planning to deploy Cortex XDR agents to 2,000 endpoints in a network that uses a proxy for all internet traffic. The proxy requires authentication and cannot be bypassed. The engineer needs to ensure agents can communicate with the Cortex XDR cloud and receive updates. What should the engineer configure during agent installation?

Accepted Answer

Set the agent to use the system proxy settings and provide proxy credentials in the agent configuration.. In environments with authenticated proxies, the Cortex XDR agent must be explicitly configured with the proxy address, port, and credentials. This allows the agent to authenticate and communicate with the Cortex XDR cloud for updates and management, ensuring continuous protection and visibility.

Answer

Configure the agent to connect directly to the Cortex XDR cloud, ignoring the proxy, as the agent uses a proprietary protocol that bypasses proxies.

Answer

Deploy a Broker VM to act as a proxy for the agents, and configure the agents to connect to the Broker VM instead of the proxy.

Answer

Install the agent without proxy settings and rely on the operating system's proxy auto-configuration (PAC) file to route traffic.

Question 19

A security administrator is installing the Cortex XDR agent on a Windows Server 2016 endpoint that also runs a line-of-business application requiring kernel-level drivers. To avoid conflicts, the administrator wants to know which built-in protection module should be disabled during installation. Which Cortex XDR agent module is most likely to cause compatibility issues with third-party kernel drivers?

Accepted Answer

Kernel-level driver (e.g., file system filter). The Cortex XDR agent includes a kernel-level driver for deep system monitoring, which can conflict with other kernel-mode drivers. When a server runs a line-of-business application with its own kernel drivers, the administrator should consider disabling the agent's kernel driver during installation to prevent conflicts. This is a known compatibility consideration in hardened or specialized server environments.

Answer

Exploit Protection

Answer

Behavioral Threat Protection

Answer

Local Analysis

Question 20

A security architect is planning a Cortex XDR deployment for a large enterprise with 10,000 endpoints. The architect needs to ensure the agent can communicate with the Cortex XDR cloud and receive updates even if the primary data center loses internet connectivity. The architect decides to deploy Broker VMs in multiple locations. Which two Broker VM components are required to provide high availability and local caching for agent updates? (Choose two.)

Accepted Answer

Proxy. For high availability and local caching of agent updates, the Proxy component is required on each Broker VM, and deploying them in a cluster with load balancing ensures redundancy. The Proxy handles agent-cloud communication and caches content, while clustering prevents a single point of failure. Other components like Syslog Collector or File Collector serve different purposes and do not provide these capabilities.

Answer

Syslog Collector

Answer

File Collector

Answer

Log Staging