XDR-Engineer Planning And Installation Practice Test 5 — 15 Questions

Question 1

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Download the Cortex XDR agent installer from the Cortex XDR management console and create a deployment package in MECM.. The correct approach is to download the Cortex XDR agent installer from the management console and package it for MECM. This ensures the correct version, tenant-specific settings, and integration with MECM's deployment capabilities. Other methods either rely on manual user actions, use incorrect sources, or are not applicable to third-party software distribution.

Answer

Retrieve the agent installer from the Palo Alto Networks Customer Support Portal and upload it to MECM.

Answer

Use the Cortex XDR API to generate a one-time installation link and send it to all users via email.

Answer

Configure MECM to pull the agent installer directly from the Microsoft Update Catalog.

Question 2

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

Accepted Answer

Cortex XDR Broker VM. The Broker VM is designed to serve as an on-premises proxy and cache for Cortex XDR agents, enabling them to receive content updates even when they cannot directly reach the internet. It is the recommended component for environments with restricted connectivity, as it centralizes update distribution and reduces external exposure.

Answer

Cortex XDR agent with a proxy configuration pointing to an external web proxy

Answer

Cortex XDR agent with a local content update repository on each server

Answer

Cortex XDR management console with a content update schedule

Question 3

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints across multiple geographic locations. To optimize bandwidth and reduce latency for agent communication, the administrator decides to deploy Broker VMs. Which component of the Cortex XDR architecture is responsible for forwarding endpoint data to the Cortex XDR cloud when a Broker VM is used?

Accepted Answer

The Broker VM acts as a proxy, aggregating and forwarding endpoint data to the Cortex XDR cloud.. The Broker VM functions as a proxy, aggregating endpoint traffic and forwarding it to the Cortex XDR cloud. This reduces direct internet connections from endpoints, optimizes bandwidth usage, and can improve latency by localizing communication. The other options incorrectly describe the agent-cloud relationship or the Broker VM's role.

Answer

The Cortex XDR management console directly polls each endpoint for data, eliminating the need for a Broker VM.

Answer

The Broker VM stores all endpoint data locally and only sends summary reports to the cloud.

Answer

The Cortex XDR agent establishes a direct connection to the Cortex XDR cloud, bypassing the Broker VM.

Question 4

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to obtain the agent installation package that includes the tenant-specific configuration. Where should the administrator download this package?

Accepted Answer

From the Cortex XDR management console under Settings > Agent Installation.. The agent installation package with tenant configuration is available in the Cortex XDR management console under Settings > Agent Installation. This package includes the necessary tenant ID and settings to ensure agents register correctly. Using this package simplifies mass deployment via third-party tools, as no additional configuration is needed.

Answer

From the Cortex XDR agent installation directory on an existing endpoint.

Answer

From the Cortex XDR API using the /public_api/v1/agent_installers endpoint.

Answer

From the Palo Alto Networks Customer Support Portal under Software Downloads.

Question 5

A security administrator is installing a Cortex XDR Broker VM in a highly secure environment where internet access is restricted. The Broker VM must be able to communicate with the Cortex XDR cloud to receive updates and forward data. Which network configuration must be allowed to ensure successful operation?

Accepted Answer

Outbound TCP 443 to the Cortex XDR cloud FQDNs and inbound TCP 443 from agents.. The Broker VM must have outbound TCP 443 access to the Cortex XDR cloud for updates and data forwarding, and it must accept inbound TCP 443 from agents to receive their telemetry. This ensures secure, reliable communication. The other options either use incorrect protocols or ports, which would break functionality.

Answer

Outbound TCP 8443 to the Cortex XDR cloud and inbound TCP 8443 from agents.

Answer

Outbound TCP 443 to the Cortex XDR cloud and inbound UDP 514 from agents.

Answer

Outbound UDP 514 to the Cortex XDR cloud and inbound TCP 443 from agents.

Question 6

A Cortex XDR engineer is deploying the Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must be able to receive updates and communicate with the Cortex XDR cloud. Which configuration should the engineer implement to allow this communication?

Accepted Answer

Allow outbound access to the required Cortex XDR cloud FQDNs and IP addresses on the firewall.. The Broker VM initiates outbound connections to the Cortex XDR cloud for updates and management. In a restricted environment, the firewall must be configured to allow these outbound connections to the specific FQDNs and IP addresses used by Cortex XDR. This direct approach is recommended and avoids the complexity of proxy configurations.

Answer

Configure a forward proxy on the Broker VM to route traffic through an internal proxy server.

Answer

Set up a reverse proxy on the Broker VM to accept incoming connections from the Cortex XDR cloud.

Answer

Configure the Broker VM to use a custom update server and allow outbound access to it.

Question 7

An administrator is planning to deploy Cortex XDR agents to a group of endpoints that do not have direct internet access. The administrator has deployed a Broker VM to act as a proxy. Which agent installation parameter must be specified during installation to ensure the agent communicates with the Broker VM instead of the Cortex XDR cloud?

Accepted Answer

The Broker VM's IP address or FQDN using the SERVER parameter.. To direct an agent to a Broker VM, the SERVER parameter must be set to the Broker VM's IP address or FQDN during installation. This ensures the agent sends data to the Broker VM, which then forwards it to the Cortex XDR cloud. The other parameters either do not exist or serve different purposes, such as specifying an HTTP proxy.

Answer

The Broker VM's IP address or FQDN using the PROXY_SERVER parameter.

Answer

The Broker VM's IP address or FQDN using the BROKER_VM parameter.

Answer

The Cortex XDR cloud FQDN using the CLOUD_SERVER parameter.

Question 8

A security architect is planning a Cortex XDR deployment for a large enterprise with 8,000 endpoints across three geographic regions. The company requires that all endpoint telemetry and alerts be stored within the region where each endpoint resides, and that no data leaves that region. Which Cortex XDR deployment architecture should the architect recommend?

Accepted Answer

Deploy separate Cortex XDR tenants in each region, with endpoints connecting to the tenant in their own region.. Cortex XDR tenants are provisioned in specific geographic regions, and all endpoint data, alerts, and incidents are stored within that region. To meet strict data residency requirements per region, separate tenants must be deployed in each region so endpoints report to a local tenant. A single tenant cannot enforce per-endpoint data residency, and Broker VMs do not change the tenant's data storage location.

Answer

Deploy a Cortex XDR tenant in the primary region and use Broker VMs in each remote region to locally cache and process all endpoint data.

Answer

Deploy Cortex XDR agents in each region and forward all telemetry to a central syslog server in the primary region.

Answer

Deploy a single Cortex XDR tenant in the primary region and configure regional data residency settings for each endpoint group.

Question 9

A Cortex XDR administrator is planning to deploy the agent on a Windows Server 2019 that hosts a Microsoft SQL Server database. The database server has high I/O and memory usage. The administrator wants to ensure that the Cortex XDR agent does not degrade database performance. Which action should the administrator take?

Accepted Answer

Create a new agent settings profile that excludes the database files and processes from scanning, and apply it to the server.. For performance-sensitive servers like database hosts, Cortex XDR administrators should create agent settings profiles that exclude specific files, folders, or processes from scanning. This reduces the agent's impact on database operations while maintaining protection. Disabling the agent or using monitor-only mode without exclusions does not adequately balance security and performance.

Answer

Disable the Cortex XDR agent on the database server and rely on network-based protection.

Answer

Install the agent in monitor-only mode without any exclusions.

Answer

Install the agent with the default protection policy and monitor performance.

Question 10

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

Accepted Answer

Ensure that the installation is performed with administrative privileges on each endpoint.. The two essential considerations are including the tenant ID or registration token and ensuring administrative privileges. The tenant ID ensures proper registration, and admin rights are needed for installation. Other factors like disabling security software, static IPs, or pre-installing content are not required and could introduce issues.

Answer

Configure the agent to use a static IP address for communication with the Cortex XDR cloud.

Answer

Disable all other security software on the endpoints before installation.

Answer

Pre-install the Cortex XDR content update package on each endpoint to reduce initial cloud traffic.

Question 11

A Cortex XDR administrator is planning to deploy agents to endpoints that are behind a web proxy that requires authentication. The administrator wants to ensure that the agents can register and communicate with the Cortex XDR cloud without manual intervention. What should the administrator do?

Accepted Answer

Configure the agents to use the system proxy settings and provide proxy credentials in the agent settings profile.. Cortex XDR agent settings profiles support proxy configuration, including authentication credentials. By configuring the agent to use the system proxy and supplying the necessary credentials, the agent can authenticate to the web proxy and communicate with the Cortex XDR cloud. This approach scales across many endpoints without manual intervention.

Answer

Disable the web proxy authentication requirement for the Cortex XDR cloud URLs.

Answer

Deploy a Broker VM in the same network segment as the endpoints to bypass the web proxy.

Answer

Install the agents with a command-line option that specifies the proxy server address and port, but not credentials.

Question 12

An administrator is planning to deploy Cortex XDR agents on macOS endpoints and needs to ensure that the agents have the necessary permissions to monitor system activity. Which TWO actions must be performed on each macOS endpoint? (Choose two.)

Accepted Answer

Approve the system extension in Security & Privacy settings. On macOS, Cortex XDR requires Full Disk Access to monitor files and processes, and the system extension must be approved to enable network and endpoint monitoring. These two actions are essential for the agent to function properly and provide full protection.

Answer

Install the agent using the 'sudo' command

Answer

Disable System Integrity Protection (SIP)

Answer

Add the agent to the list of allowed kernel extensions

Question 13

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 14

An administrator is designing a Cortex XDR deployment for a network with strict egress filtering. The security team wants to ensure that agents can communicate with the Cortex XDR cloud and receive updates. Which outbound communication method should be allowed to meet this requirement with minimal open ports?

Accepted Answer

Allow outbound HTTPS (TCP 443) to the Cortex XDR cloud endpoints. Cortex XDR agents use HTTPS over TCP 443 to communicate with the Cortex XDR cloud. This single outbound port is sufficient for registration, policy updates, and content delivery, making it the optimal choice for environments with strict egress filtering.

Answer

Allow outbound TCP 8080 to the Cortex XDR cloud endpoints

Answer

Allow outbound UDP 53 to the Cortex XDR cloud endpoints

Answer

Allow outbound TCP 4443 to the Cortex XDR cloud endpoints

Question 15

A security administrator is planning to deploy the Cortex XDR agent to 500 Linux servers across multiple data centers. The organization wants to minimize administrative effort and ensure the agent is always running with the latest features. The servers have varying Linux distributions and kernel versions. Which deployment method should the administrator use?

Accepted Answer

Use the Cortex XDR agent installation script with a configuration file to automate deployment and enable automatic upgrades.. The Cortex XDR agent installation script with a configuration file enables automated, consistent deployment across diverse Linux servers and supports automatic upgrades, reducing administrative overhead and ensuring agents remain current. This approach is scalable and recommended for large fleets, unlike manual methods or unconfigured third-party tools.

Answer

Install the agent using the graphical user interface on each server to ensure proper configuration.

Answer

Manually install the agent on each server using the RPM package and configure a cron job for updates.

Answer

Deploy the agent via a third-party configuration management tool like Ansible, using the default package without modifications.