XDR-Engineer Planning And Installation Practice Test 2 — 15 Questions

Question 1

A security administrator is deploying Cortex XDR agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to ensure that the agent automatically registers with the correct Cortex XDR tenant and receives the appropriate policy. Which installation parameter must be included in the deployment script?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The tenant ID, distribution ID, and registration token. When deploying Cortex XDR agents via third-party tools, the installation command must include the tenant ID, distribution ID, and registration token to ensure the agent registers with the correct tenant and receives the intended policy. These parameters are typically provided in the agent installation package or the management console.

Answer

The distribution ID and registration token

Answer

The policy name and registration token

Answer

The tenant ID and registration token

Question 2

A Cortex XDR administrator is planning to deploy agents to endpoints that are often offline or have intermittent connectivity. The administrator wants to ensure that these agents receive policy updates and can upload alerts as soon as they reconnect. Which agent setting should be configured to achieve this?

Accepted Answer

Ensure the agent has a persistent local cache and configure it to sync upon reconnection.. Cortex XDR agents are designed to operate offline and cache alerts and policy updates locally. When the endpoint reconnects, the agent automatically synchronizes with the cloud, uploading cached alerts and downloading any pending policy changes. This built-in capability ensures that intermittent connectivity does not result in data loss or stale policies.

Answer

Increase the agent's heartbeat interval to reduce bandwidth usage.

Answer

Enable the 'Offline Mode' setting in the agent configuration profile.

Answer

Configure the agent to use a Broker VM as a proxy for communication.

Question 3

A security engineer is planning to deploy Cortex XDR agents to 2,000 endpoints in a network that uses a proxy for all internet traffic. The proxy requires authentication and cannot be bypassed. The engineer needs to ensure agents can communicate with the Cortex XDR cloud and receive updates. What should the engineer configure during agent installation?

Accepted Answer

Set the agent to use the system proxy settings and provide proxy credentials in the agent configuration.. In environments with authenticated proxies, the Cortex XDR agent must be explicitly configured with the proxy address, port, and credentials. This allows the agent to authenticate and communicate with the Cortex XDR cloud for updates and management, ensuring continuous protection and visibility.

Answer

Configure the agent to connect directly to the Cortex XDR cloud, ignoring the proxy, as the agent uses a proprietary protocol that bypasses proxies.

Answer

Deploy a Broker VM to act as a proxy for the agents, and configure the agents to connect to the Broker VM instead of the proxy.

Answer

Install the agent without proxy settings and rely on the operating system's proxy auto-configuration (PAC) file to route traffic.

Question 4

A security administrator is installing the Cortex XDR agent on a Windows Server 2016 endpoint that also runs a line-of-business application requiring kernel-level drivers. To avoid conflicts, the administrator wants to know which built-in protection module should be disabled during installation. Which Cortex XDR agent module is most likely to cause compatibility issues with third-party kernel drivers?

Accepted Answer

Kernel-level driver (e.g., file system filter). The Cortex XDR agent includes a kernel-level driver for deep system monitoring, which can conflict with other kernel-mode drivers. When a server runs a line-of-business application with its own kernel drivers, the administrator should consider disabling the agent's kernel driver during installation to prevent conflicts. This is a known compatibility consideration in hardened or specialized server environments.

Answer

Exploit Protection

Answer

Behavioral Threat Protection

Answer

Local Analysis

Question 5

A security architect is planning a Cortex XDR deployment for a large enterprise with 10,000 endpoints. The architect needs to ensure the agent can communicate with the Cortex XDR cloud and receive updates even if the primary data center loses internet connectivity. The architect decides to deploy Broker VMs in multiple locations. Which two Broker VM components are required to provide high availability and local caching for agent updates? (Choose two.)

Accepted Answer

Proxy. For high availability and local caching of agent updates, the Proxy component is required on each Broker VM, and deploying them in a cluster with load balancing ensures redundancy. The Proxy handles agent-cloud communication and caches content, while clustering prevents a single point of failure. Other components like Syslog Collector or File Collector serve different purposes and do not provide these capabilities.

Answer

Syslog Collector

Answer

File Collector

Answer

Log Staging

Question 6

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

Accepted Answer

Deploy a Mobile Device Management (MDM) configuration profile containing the required system extension and network filter payloads. On modern macOS versions, system extensions and network filters require an MDM configuration profile to grant explicit pre-approval and avoid manual user authorization prompts.

Answer

Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode

Answer

Modify the /etc/pam.d/authorization file prior to running the PKG installer

Answer

Run the installer using sudo privileges with the --force flag

Question 7

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

Accepted Answer

Cortex XDR Broker VM. In dark site or disconnected environments, the Cortex XDR Collector is used to proxy agent telemetry and updates since agents cannot directly reach the Cortex XDR cloud.

Answer

Prisma Access Remote Networks Connector

Answer

Traps Management Service

Answer

Panorama Management Server

Question 8

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the management tenant exclusively over outbound TCP 443 (HTTPS/TLS). This single port carries telemetry upload, policy retrieval, and command-and-control traffic, so it is the only destination port that must be allowed for agent-cloud communication.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 9

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required when deploying software packages via Active Directory Group Policy Objects (GPOs) on Windows endpoints.

Answer

TGZ

Answer

PKG

Answer

EXE

Question 10

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 11

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

Accepted Answer

An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM. SSL inspection or interception by an explicit proxy or next-generation firewall without proper TLS decryption certificate installation causes SSL handshake failures on the Broker VM.

Answer

The Broker VM registration key contains invalid characters due to copy-paste formatting

Answer

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Answer

The Broker VM kernel version is incompatible with the Linux swap space partition size

Question 12

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

Accepted Answer

Telemetry and Monitoring (Detection-only) Mode. Deploying agents in a non-blocking or telemetry-only mode allows administrators to assess alerts and rule performance safely before enforcing blocks.

Answer

Aggressive Prevention Mode

Answer

Disabled Mode

Answer

Quarantine Mode

Question 13

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

Accepted Answer

Cortex XDR Broker VM with the Syslog Collector module enabled. The Cortex XDR Broker VM supports log collector modules that ingest syslog data from third-party devices and forward it to the Cortex XDR data lake.

Answer

Palo Alto Networks Next-Generation Firewall configured with GlobalProtect

Answer

Cortex XDR Agent installed on a dedicated Linux log server

Answer

Prisma Access Cloud Secure Web Gateway

Question 14

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Agent settings profiles let administrators bundle distinct security policy configurations — malware protection, exploit protection, behavioral threat settings, endpoint operational modes (e.g., block vs. report), and exclusions — and then assign each profile to different endpoint groups. This allows one tenant to enforce different postures for servers, workstations, or business units without duplicating the whole tenant configuration.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 15

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

Accepted Answer

Enter the designated Cortex XDR agent uninstallation password when prompted by the uninstaller. Cortex XDR agents are protected against unauthorized removal by an uninstallation password configured in the agent settings profile.

Answer

Revoke the endpoint certificate from the local Certificate Authority (CA) store

Answer

Disable Windows Defender and run the standard Windows Add or Remove Programs wizard

Answer

Boot the endpoint into Safe Mode and delete the agent installation directory manually