XDR-Engineer Planning And Installation — Timed 20 Questions

Question 1

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

20 minute time limit — choose an answer to begin.

Accepted Answer

Deploy a Mobile Device Management (MDM) configuration profile containing the required system extension and network filter payloads. On modern macOS versions, system extensions and network filters require an MDM configuration profile to grant explicit pre-approval and avoid manual user authorization prompts.

Answer

Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode

Answer

Modify the /etc/pam.d/authorization file prior to running the PKG installer

Answer

Run the installer using sudo privileges with the --force flag

Question 2

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

Accepted Answer

Cortex XDR Broker VM. In dark site or disconnected environments, the Cortex XDR Collector is used to proxy agent telemetry and updates since agents cannot directly reach the Cortex XDR cloud.

Answer

Prisma Access Remote Networks Connector

Answer

Traps Management Service

Answer

Panorama Management Server

Question 3

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

Accepted Answer

Configure a static IP address via the CLI and enter the Broker VM registration key generated in the Cortex XDR console. To link a newly deployed Broker VM to the cloud tenant, the administrator must register it using a registration key generated in the Cortex XDR console.

Answer

Upload a valid SSL wildcard certificate signed by a public Certificate Authority directly to the hypervisor

Answer

Run the setup wizard using the default admin credentials and map an NFS datastore

Answer

Configure a Syslog forwarding rule in Panorama to push the registration payload

Question 4

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

Accepted Answer

yum install ./cxdr-agent.rpm. Linux agent installations on RHEL utilize standard package managers like yum or rpm with the provided agent package and prerequisites.

Answer

apt-get install ./cortex-xdr.deb

Answer

brew install paloalto-cortex-xdr

Answer

rpm -i ctrex-agent.rpm

Question 5

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the cloud tenant via HTTPS over TCP port 443.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 6

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required when deploying software packages via Active Directory Group Policy Objects (GPOs) on Windows endpoints.

Answer

TGZ

Answer

PKG

Answer

EXE

Question 7

An enterprise environment requires the Cortex XDR Broker VM to be sized correctly for handling log forwarding and agent proxying from 15,000 endpoints. Which minimum hardware specification should the administrator allocate for the Broker VM hypervisor?

Accepted Answer

4 vCPU and 16 GB RAM. For large deployments supporting agent proxying and syslog/API log collection for up to 15,000 endpoints, the recommended Broker VM sizing is typically 4 vCPUs and 16 GB of RAM.

Answer

1 vCPU and 2 GB RAM

Answer

16 vCPU and 64 GB RAM

Answer

2 vCPU and 4 GB RAM

Question 8

During the initial setup of a Cortex XDR tenant, where does the administrator navigate in the management console to download agent installation packages for various operating systems?

Accepted Answer

Endpoints > Installers. Agent installers and packages are located under the 'Installers' menu within the Cortex XDR management console.

Answer

Settings > Configurations > Agents

Answer

Dashboards > Incident Management > Installers

Answer

Endpoints > Agent Settings > Packages

Question 9

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 10

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

Accepted Answer

/qn /norestart. Standard Windows Installer (msiexec) uses '/qn' or '/quiet' to perform a completely silent installation.

Answer

/verysilent /suppressmsgs

Answer

--install --silent

Answer

/silent /norestart

Question 11

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

Accepted Answer

An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM. SSL inspection or interception by an explicit proxy or next-generation firewall without proper TLS decryption certificate installation causes SSL handshake failures on the Broker VM.

Answer

The Broker VM registration key contains invalid characters due to copy-paste formatting

Answer

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Answer

The Broker VM kernel version is incompatible with the Linux swap space partition size

Question 12

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

Accepted Answer

Telemetry and Monitoring (Detection-only) Mode. Deploying agents in a non-blocking or telemetry-only mode allows administrators to assess alerts and rule performance safely before enforcing blocks.

Answer

Aggressive Prevention Mode

Answer

Disabled Mode

Answer

Quarantine Mode

Question 13

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

Accepted Answer

Cortex XDR Broker VM with the Syslog Collector module enabled. The Cortex XDR Broker VM supports log collector modules that ingest syslog data from third-party devices and forward it to the Cortex XDR data lake.

Answer

Palo Alto Networks Next-Generation Firewall configured with GlobalProtect

Answer

Cortex XDR Agent installed on a dedicated Linux log server

Answer

Prisma Access Cloud Secure Web Gateway

Question 14

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Different endpoint groups (e.g., servers vs. workstations) require different security thresholds, scan schedules, and operational modes, necessitating multiple profiles.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 15

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

Accepted Answer

Enter the designated Cortex XDR agent uninstallation password when prompted by the uninstaller. Cortex XDR agents are protected against unauthorized removal by an uninstallation password configured in the agent settings profile.

Answer

Revoke the endpoint certificate from the local Certificate Authority (CA) store

Answer

Disable Windows Defender and run the standard Windows Add or Remove Programs wizard

Answer

Boot the endpoint into Safe Mode and delete the agent installation directory manually

Question 16

An administrator needs to upgrade the Cortex XDR agents across all enterprise endpoints. Where should the administrator upload and manage the new agent software versions before rolling them out?

Accepted Answer

Endpoints > Agent Upgrades. Administrators manage and stage agent software versions under the Agent Upgrades section in the Cortex XDR console.

Answer

Dashboards > System Status > Updates

Answer

Administration > Global Protect > Client Versions

Answer

Settings > Tenant Management > Software Repository

Question 17

An administrator is deploying the Cortex XDR agent on a virtual desktop infrastructure (VDI) non-persistent pool. Which configuration consideration is critical to ensure proper management and prevent duplicate endpoint entries in the Cortex XDR console?

Accepted Answer

Enable the VDI optimization setting in the agent installation parameters or profile so the agent cleans up stale records upon shutdown. Non-persistent VDI clones frequently power down and reset, requiring proper master image preparation with VDI flags enabled to prevent cluttering the console with stale offline endpoints.

Answer

Disable all behavioral threat prevention modules on gold master images

Answer

Configure the hypervisor to inject a new license key on every reboot

Answer

Install a unique static IP address allocation script for every virtual machine instance spawned

Question 18

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

Accepted Answer

The Broker VM must be able to resolve DNS and communicate outbound to the Cortex XDR cloud over TCP port 443. The Broker VM requires outbound HTTPS access to the Cortex XDR cloud and inbound/outbound connectivity depending on syslog collection and SIEM forwarding roles.

Answer

The Broker VM must operate as an explicit proxy server with Kerberos authentication enabled

Answer

The Broker VM must have ICMP echo requests enabled across all enterprise routers

Answer

The Broker VM must have a direct public IP address assigned to its management interface

Question 19

An administrator wants to verify the version of the Cortex XDR agent running on a specific macOS endpoint. Which command should be executed in the macOS Terminal?

Accepted Answer

/Library/Application Support/PaloAltoNetworks/Cortex/cytool runtime query version. The cytool utility is available across platforms, including macOS, for checking agent status and version.

Answer

/Library/Application Support/PaloAltoNetworks/Cortex/cytool.sh version

Answer

/Library/Cortex/bin/cytool version query

Answer

/Applications/Cortex.app/Contents/MacOS/cytool query version

Question 20

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Accepted Answer

Ensure the Cortex XDR installer binaries, service executables, and driver certificates are trusted or whitelisted in the local security software. Third-party application whitelisting or restriction software can block the execution of the Cortex XDR installer or core drivers if they are not explicitly trusted or excluded.

Answer

Disable Windows User Account Control (UAC) entirely across all domain controllers

Answer

Configure the local hosts file to resolve the management tenant to localhost

Answer

Convert the file system from NTFS to FAT32 to support raw driver loading