XDR-Engineer Planning And Installation Practice Test 3 — 15 Questions

Question 1

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Broker VM must be able to resolve DNS and communicate outbound to the Cortex XDR cloud over TCP port 443. The Broker VM requires outbound HTTPS access to the Cortex XDR cloud and inbound/outbound connectivity depending on syslog collection and SIEM forwarding roles.

Answer

The Broker VM must operate as an explicit proxy server with Kerberos authentication enabled

Answer

The Broker VM must have ICMP echo requests enabled across all enterprise routers

Answer

The Broker VM must have a direct public IP address assigned to its management interface

Question 2

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Accepted Answer

Ensure the Cortex XDR installer binaries, service executables, and driver certificates are trusted or whitelisted in the local security software. Third-party application whitelisting or restriction software can block the execution of the Cortex XDR installer or core drivers if they are not explicitly trusted or excluded.

Answer

Disable Windows User Account Control (UAC) entirely across all domain controllers

Answer

Configure the local hosts file to resolve the management tenant to localhost

Answer

Convert the file system from NTFS to FAT32 to support raw driver loading

Question 3

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Infrastructure > Broker VMs. Broker VM status and health are viewed under Settings > Configurations > Infrastructure > Broker VMs in the Cortex XDR management console. This is the dedicated management pane where administrators monitor deployed brokers, their connectivity, and health state.

Answer

Settings > Configurations > Broker VMs

Answer

Endpoints > Broker VMs

Answer

XDR Devices > Infrastructure > Broker VMs

Question 4

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

Accepted Answer

Agents automatically download and apply content updates periodically from the cloud or Broker VM without requiring agent software upgrades. Cortex XDR agents are designed to automatically pull content updates — exploit signatures, analytics rules, and behavioral detection content — from the Cortex XDR cloud or a Broker VM on a periodic basis, without requiring agent software upgrades. This keeps detection current with minimal administrative effort.

Answer

Content updates must be manually downloaded from the Palo Alto Networks Customer Support Portal and pushed via GPO

Answer

Agents require a full software re-installation every time a content update is released

Answer

Agents only receive content updates when the operating system is rebooted into safe mode

Question 5

An administrator is planning the deployment of Cortex XDR agent protection on servers running critical databases. To prevent potential performance interference or locks on specific database files during agent scans, what should the administrator configure?

Accepted Answer

Configure custom scanning and monitoring path exclusions within the agent settings profile. Administrators configure scan exclusions and path exclusions in the agent settings profile to prevent interference with critical database files and directories.

Answer

Change the agent operational mode to Quarantine Mode exclusively for database servers

Answer

Disable the entire Cortex XDR agent service whenever database backup jobs run

Answer

Lower the agent thread priority via Windows Task Manager permanently

Question 6

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

Accepted Answer

DNS resolution capable of resolving the Cortex XDR tenant domain name. Option A is correct because Cortex XDR agents must resolve the tenant-specific domain name (e.g., .xdr..paloaltonetworks.com) via DNS so they can locate and communicate with the correct cloud tenant for registration, policy retrieval, and telemetry upload. Option E is correct because agent-to-tenant communication occurs over outbound TCP 443 (HTTPS/TLS), which must be permitted through firewalls and proxies for the agent to check in, download content updates, and send endpoint data. Option B is incorrect because the agent initiates outbound connections to the cloud; inbound TCP 8080 from the tenant to each endpoint is not a deployment prerequisite. Option C is incorrect because UDP 514 syslog peering is unrelated to Cortex XDR agent connectivity and is not required across local subnets. Option D is incorrect because LDAP bind access is not configured on the agent CLI; Active Directory integration is handled at the management/console level, not as an agent network prerequisite.

Answer

Inbound TCP port 8080 access from the cloud tenant to every individual endpoint

Answer

Bidirectional UDP port 514 syslog peering across all local subnets

Answer

Active Directory LDAP bind access configured directly on the agent CLI

Question 7

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

Accepted Answer

The agent installation will fail or certain kernel-dependent prevention and monitoring modules will not load properly. Cortex XDR on Linux relies on kernel modules (e.g., for file monitoring, process execution tracking, and exploit prevention) that must be compiled against the running kernel's headers. If kernel headers or development packages are missing, the RPM installation fails or the agent installs without loading its kernel-dependent prevention modules, leaving the endpoint only partially protected.

Answer

The endpoint will experience an immediate kernel panic and enter a reboot loop

Answer

The agent will automatically download the correct kernel source code from the public Linux kernel archives

Answer

The agent will operate normally without any functional limitations because Linux does not use kernel modules for security

Question 8

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

Accepted Answer

Windows Installer verbose installation logs generated with logging parameters (/L*v). Installation issues can be diagnosed using Windows Installer verbose logs and Event Viewer system/application logs.

Answer

The local BIOS/UEFI secure boot configuration summary file

Answer

The Cisco ISE policy enforcement cache database

Answer

The global Panorama traffic log buffer

Question 9

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Accepted Answer

Syslog (UDP and TCP). The Cortex XDR Broker VM Log Collector natively supports receiving syslog over both UDP and TCP, which is the standard mechanism for ingesting events from third-party security appliances such as firewalls, IDS/IPS, and routers, making option D correct. It also natively supports HTTP/HTTPS ingestion, allowing JSON payloads from cloud APIs and other REST-based sources to be collected, which makes option E correct. Option A is incorrect because AFP is an Apple file-sharing protocol, not a log ingestion format supported by the Broker VM. Option B is incorrect because NetBIOS Datagram Service on UDP port 138 is a Windows name-resolution/datagram service, not a supported log transport. Option C is incorrect because raw disk imaging over NFS v3 is not a log collection method and is unrelated to the Broker VM Log Collector's ingestion capabilities.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 10

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

Accepted Answer

PKG format for macOS endpoints. Option B is correct because macOS natively uses the PKG (flat package) format for software installation and deployment, making it the standard package type for macOS endpoints in agent deployment strategies. Option E is correct because Linux distributions rely on native package managers, where RPM (Red Hat/CentOS/Fedora) and DEB (Debian/Ubuntu) are the two dominant package formats for installing agents on Linux endpoints. Option A is incorrect because MSI is a Windows Installer format, not used on Linux. Option C is incorrect because EXE is a Windows executable format and is not the native deployment package for macOS. Option D is incorrect because DMG is a macOS disk image format, not applicable to headless Linux servers, which use RPM or DEB packages instead.

Answer

MSI format for Linux endpoints

Answer

EXE format for macOS endpoints

Answer

DMG format for headless Linux servers

Question 11

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

Accepted Answer

Ensure all Broker VMs are synchronized with accurate NTP time sources. Deploying multiple Broker VMs behind a load balancer and sizing them appropriately ensures high availability and scalability.

Answer

Assign identical MAC addresses to all Broker VM instances to simplify switch ARP tables

Answer

Configure all agents to connect to a single static Broker VM IP address without failover options

Answer

Run Broker VMs exclusively on physical bare-metal hardware without virtualization hypervisors

Question 12

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

Accepted Answer

Ensure the account performing the installation possesses local Administrator or root privileges. Option C is correct because the Cortex XDR agent installs kernel-level drivers and services (e.g., the Cortex XDR service and its filter drivers), which require local Administrator rights on Windows or root privileges on Linux/macOS to install, register, and operate properly. Option D is correct because legacy or third-party antivirus software can block driver loading, quarantine agent files, or intercept the same OS telemetry hooks, so the administrator must uninstall it or configure mutual exclusions to prevent conflicts with the Cortex XDR agent. Option A is wrong because FAT32 is not required or recommended for Cortex XDR telemetry databases and lacks the security and file-size capabilities of NTFS; formatting drives would be destructive and unnecessary. Option B is wrong because UAC is a Windows OS feature controlled through system settings or Group Policy, not BIOS hardware settings, and disabling it is not a prerequisite for agent installation. Option E is wrong because disabling all firewall rules and deleting TCP/IP stack registry keys would break network connectivity and is not a supported or necessary step for Cortex XDR deployment.

Answer

Format all local hard drives with FAT32 to ensure compatibility with Cortex XDR telemetry databases

Answer

Disable Windows User Account Control (UAC) by modifying the hardware BIOS settings

Answer

Disable all local Windows firewall rules and delete the TCP/IP stack registry keys

Question 13

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Accepted Answer

Standardized installation parameters and property passing (e.g., /qn, /norestart). Option A is correct because MSI packages are installed via msiexec.exe, which provides standardized, documented parameters such as /qn for silent installation and /norestart to suppress reboots, making them ideal for automated software distribution tools that need predictable, scriptable installs. Option D is correct because Windows Installer natively supports transforms (.MST files), which let administrators customize an MSI (e.g., preconfigure Cortex XDR registration tokens, tenant IDs, or installation paths) without repackaging, a key advantage for scalable enterprise deployment. Option B is incorrect because MSI is a Windows Installer technology and has no built-in capability to run shell scripts on Linux servers. Option C is incorrect because MSI packages cannot automatically convert EXE payloads into macOS PKG files; that is not a function of Windows Installer. Option E is incorrect because MSI installation does not exempt an agent from UAC prompts, and administrative rights are still required to install system-level services such as the Cortex XDR agent.

Answer

Built-in capability to execute shell scripts on Linux servers

Answer

Automatic conversion of EXE payloads into macOS PKG files

Answer

Exemption from all Windows User Account Control (UAC) prompts without admin rights

Question 14

An administrator is planning a Cortex XDR deployment across a segmented network architecture where endpoints reside in a zone without direct internet access, but have access to a local proxy. Which TWO configuration steps are required to route agent traffic through this proxy? (Choose two)

Accepted Answer

Specify the proxy server address and port during the agent installation command or via agent settings. Option B is correct because the Cortex XDR agent must be told where the proxy is; this is done by supplying the proxy server address and port in the agent installation command (for example, the proxy settings parameters in the installer) or by configuring the same values in the agent settings after deployment, so the agent knows to send its traffic to the local proxy instead of attempting direct connections. Option E is correct because the local proxy itself must be permitted to forward the agent's traffic outbound to the Cortex XDR cloud endpoints over HTTPS on TCP 443, resolving the required Cortex XDR FQDNs/URLs; without this outbound allow rule the proxy cannot relay heartbeats, telemetry, or content updates. Option A is not correct because disabling TLS would break the agent's secure HTTPS communication and is not a supported or secure way to route traffic through a proxy. Option C is not correct because changing the default gateway to point at the management console is not how proxy routing works and would not provide the required path to the Cortex XDR cloud. Option D is not correct because a Microsoft Exchange server is unrelated to agent proxy traffic and is not needed for alert notifications in this scenario.

Answer

Disable TLS encryption on the proxy to allow raw packet inspection of agent heartbeats

Answer

Change the endpoint default gateway to point directly to the Cortex XDR management console

Answer

Install a local Microsoft Exchange server on the proxy to handle email-based alert notifications

Question 15

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming