CCNA Planning And Installation Questions

MCQmedium

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

A.Settings > Configurations > Agent Settings > Upgrades

B.Help > About > Check for Updates

C.Response > Actions > Push Update

D.Data Collector > Broker VM > Software Distribution

AnswerA

Automated agent upgrade policies are defined within the Agent Settings configuration profiles.

Why this answer

Agent upgrade settings are managed within the Agent Settings profiles in the Cortex XDR console.

Practice this question →

MCQmedium

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

A.A static list of Palo Alto Networks global headquarters IP addresses

B.Only local internal DNS servers

C.Public NTP servers only

D.The specific regional Cortex XDR tenant FQDNs and update distribution domains

AnswerD

Agents must reach their assigned regional tenant FQDNs and content update servers over HTTPS.

Why this answer

Cortex XDR agents require outbound HTTPS access to the specific regional Cortex XDR cloud tenant URLs provided by Palo Alto Networks.

Practice this question →

Multi-Selectmedium

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

Select 2 answers

A.A dedicated service account in Active Directory with read permissions to query user and group objects

B.A physical hardware token connected to the Broker VM USB port

C.Direct SSH root access to every Active Directory Domain Controller

D.Installation of the Cortex XDR Agent on all Domain Controllers as a mandatory prerequisite

E.Network connectivity from the Broker VM to Domain Controllers over TCP port 389 (LDAP) or 636 (LDAPS)

AnswersA, E

A service account is required for the Broker VM to query Active Directory.

Why this answer

AD integration via Broker VM requires LDAP/LDAPS connectivity to domain controllers and valid service account credentials.

Practice this question →

Multi-Selecthard

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

Select 3 answers

A.Proxy server configuration for agent communication traversal

B.GlobalProtect VPN gateway tunnel encryption algorithms

C.Exclusions for specific paths, processes, or file hashes

D.Physical firewall interface IP addresses and routing tables

E.Operational mode (e.g., Normal, Detect-only, or Disabled)

AnswersA, C, E

Proxy configurations are specified within the agent settings profile.

Why this answer

Agent Settings profiles control operational settings such as operational mode, scan schedules, proxy settings, and exclusion rules.

Practice this question →

MCQhard

An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?

A.traceroute -m 64 gateway

B.show broker status and test connection

C.ping -t customer.paloaltonetworks.com

D.tail -f /var/log/pan_broker_vm.log

AnswerB

The Broker VM CLI provides specific operational commands like 'show' and connectivity test utilities.

Why this answer

The Broker VM CLI provides specific troubleshooting commands, including network diagnostics and connectivity tests to verify cloud reachability.

Practice this question →

MCQeasy

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

A.Local Agent SQLite Cache

B.Panorama Log Collector Appliance

C.Cortex Data Lake

D.Broker VM Internal Hard Disk

AnswerC

The Cortex Data Lake stores all ingested logs, telemetry, and forensics data.

Why this answer

The Cortex Data Lake is the cloud-based repository that stores all enterprise telemetry and logs for Cortex XDR.

Practice this question →

MCQeasy

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

A.Configuring an Apple Developer ID certificate in Keychain Access

B.Installing a custom kernel extension compiled locally using Xcode

C.Approving System Extensions, Full Disk Access, and Network Filter permissions via MDM or user prompt

D.Disabling System Integrity Protection (SIP) entirely on every Mac

AnswerC

macOS security frameworks require explicit authorization for system extensions and full disk access.

Why this answer

macOS requires users or MDM profiles to grant Full Disk Access and network filter permissions to the Cortex XDR agent.

Practice this question →

MCQeasy

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

A.To generate weekly compliance PDF reports for external auditors

B.To actively block and remediate threats such as malware, exploits, and ransomware execution on the endpoint

C.To monitor bandwidth usage across enterprise switch ports

D.To automatically patch third-party software vulnerabilities like Adobe Reader

AnswerB

Prevention modules stop malicious activities before or during execution.

Why this answer

Prevention modules block known and unknown malware, exploits, and ransomware execution in real-time on the endpoint.

Practice this question →

Multi-Selecthard

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

Select 3 answers

A.Outbound BitTorrent peer-to-peer traffic for software distribution

B.Inbound Remote Desktop Protocol (RDP) from all internet IP addresses directly to the Broker VM

C.Inbound Syslog (TCP/UDP 514 or custom ports) from network devices to the Broker VM Syslog collector

D.Inbound and outbound LDAP/LDAPS (TCP 389/636) between the Broker VM and Active Directory Domain Controllers

E.Outbound HTTPS (TCP 443) from the Broker VM to the Cortex XDR cloud tenant and content delivery networks

AnswersC, D, E

Network devices send syslog messages to the Broker VM collector.

Why this answer

Broker VM requires outbound HTTPS to the cloud, inbound Syslog/AD traffic from local sources, and DNS resolution.

Practice this question →

Multi-Selectmedium

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

Select 2 answers

A.Install the Broker VM directly on user workstations running Windows 10 Pro

B.Deploy Broker VM instances locally at remote sites or data centers to aggregate logs and reduce WAN bandwidth consumption

C.Configure the Broker VM to store all enterprise log data locally on its virtual disk permanently for 7 years

D.Ensure proper sizing and resource allocation (vCPU and RAM) based on the expected event-per-second (EPS) load

E.Share a single Broker VM instance across 50,000 global endpoints separated by high-latency WAN links

AnswersB, D

Deploying Broker VMs locally at remote locations minimizes WAN traffic for log collection and agent proxying.

Why this answer

Broker VMs should be deployed locally at major remote sites to reduce WAN traffic, and high availability or multiple instances should be considered for redundancy.

Practice this question →

MCQmedium

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

A.Data Collector > Broker VM > Agent Packages

B.Incidents > Actions > Export Agent

C.Settings > Configurations > Endpoint Settings > Install Packages

D.Monitoring > System Health > Agent Distribution

AnswerC

The Install Packages menu allows administrators to build and download tailored agent installers.

Why this answer

Installation packages and transform files are accessed via Settings > Configurations > Endpoint Settings > Install Packages in the Cortex XDR console.

Practice this question →

MCQhard

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

A.Microsoft .NET Framework 4.8 Runtime

B.IIS Web Server Role and ASP.NET

C.Active Directory Domain Services Client tools

D.Kernel headers and dependent build tools matching the running kernel version

AnswerD

Linux kernel modules require matching kernel headers for successful compilation/load.

Why this answer

Linux agents rely on standard kernel headers, build essentials, or specific utilities depending on whether kernel modules or eBPF are utilized.

Practice this question →

MCQeasy

What is the primary function of the Cortex XDR Agent Support File collection tool?

A.To collect diagnostic logs, configuration details, and troubleshooting data for Palo Alto Networks Support

B.To generate a forensic disk image of the entire hard drive

C.To back up the user's personal documents to the cloud data lake

D.To export endpoint cryptographic keys to an external vault

AnswerA

Support files aggregate diagnostic logs for troubleshooting agent issues.

Why this answer

The Support File collection tool gathers diagnostic logs and system states from the endpoint agent to assist Palo Alto Networks support in troubleshooting.

Practice this question →

Multi-Selectmedium

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

Select 2 answers

A.The Broker VM is installed directly on individual macOS endpoints as a kernel extension

B.The Broker VM runs as a virtual appliance on supported hypervisors such as VMware ESXi, KVM, AWS, or Azure

C.The Broker VM hosts modular Cortex XDR apps such as Syslog Collector, Active Directory, and agent proxying

D.The Broker VM replaces the Cortex Data Lake as the primary long-term log storage repository for the entire enterprise

E.The Broker VM requires a physical server with at least 128 cores and 1TB of RAM

AnswersB, C

Broker VM is distributed as virtual appliance images for major hypervisors and clouds.

Why this answer

Broker VM is a virtual appliance running on supported hypervisors that acts as an aggregator, proxy, and collector app host.

Practice this question →

MCQmedium

An administrator is planning network bandwidth utilization for Cortex XDR agents deployed across 10,000 endpoints. Which mechanism does Cortex XDR use to minimize WAN bandwidth consumption during content updates and software upgrades?

A.Incremental, lightweight signature updates delivered dynamically over HTTPS

B.Mandatory FTP file transfer during off-peak midnight hours only

C.Peer-to-peer multicast streaming across all local subnets

D.Local caching and distribution exclusively through Domain Controllers via GPO

AnswerA

Content updates are incremental and small, minimizing bandwidth impact.

Why this answer

Content updates and signatures are lightweight, and proxy/Broker VM caching can further assist, though agents primarily download directly or via designated distribution mechanisms.

Practice this question →

Multi-Selecthard

An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?

Select 3 answers

A.Verify that the operating system version meets the minimum requirements supported by the current Cortex XDR agent release

B.Confirm outbound network connectivity over TCP port 443 to the regional Cortex XDR tenant FQDNs

C.Disable all local network interface cards permanently

D.Ensure that competing third-party endpoint security agents that may conflict with kernel hooks are uninstalled or properly configured

E.Reformat the local hard drive to use the FAT32 file system for compatibility

AnswersA, B, D

Checking OS compatibility prevents installation failures on unsupported platforms.

Why this answer

Before agent installation, administrators should verify OS compatibility, ensure no conflicting security software is present, and check network connectivity.

Practice this question →

Multi-Selecthard

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?

Select 3 answers

A.The Windows System and Application Event Logs for MSIInstaller or service creation errors

B.The agent installation log files located in the Windows %TEMP% directory or Cyvera installation logs

C.The Windows Installer verbose log generated during the installation process (e.g., using msiexec /i installer.msi /l*v install.log)

D.The BIOS firmware boot order configuration screen

E.The local router routing table via the arp -a command

AnswersA, B, C

Event logs record Windows Service control manager and installer events.

Why this answer

Windows agent installation logs can be found in the system TEMP directory, MSI installer verbose logs, and Cortex XDR installation logs.

Practice this question →

MCQeasy

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

A.To upgrade the core operating system of the host endpoint

B.To update detection rules, behavioral heuristics, and malware signatures on the agent

C.To upgrade the Broker VM hypervisor kernel version

D.To renew the TLS certificates of the Palo Alto Networks support portal

AnswerB

Content updates provide new detection capabilities and rules to the agent.

Why this answer

Content updates deliver updated detection rules, behavioral signatures, and policy adjustments to the endpoint agent without requiring a full software upgrade.

Practice this question →

Multi-Selecthard

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Select 3 answers

A.Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console

B.Leveraging hypervisor-level high availability (such as VMware vSphere HA) for the Broker VM virtual machines

C.Deploying multiple Broker VM instances in an active-active or active-passive configuration across different hypervisor hosts

D.Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

E.Running the Broker VM software directly inside a web browser tab

AnswersA, B, C

Proactive monitoring ensures administrators catch appliance issues early.

Why this answer

High availability for Broker VMs is achieved by deploying multiple instances, leveraging hypervisor HA, and monitoring health status.

Practice this question →

MCQmedium

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

A.Fibre Channel HBA connected to an enterprise SAN storage array

B.Dedicated high-end NVIDIA GPU for deep learning processing

C.Dual 10Gbps SFP+ physical network interface cards passed through directly

D.Sufficient vCPU and RAM allocation per published system requirements

AnswerD

Broker VM performance depends heavily on allocated vCPU and RAM to handle ingestion queues.

Why this answer

Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Practice this question →

MCQhard

An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?

A.Broker VM App Domains

B.Tenant Management and Endpoint Groups with RBAC scoping

C.Global Protect Gateway Zones

D.Virtual Router Contexts within the Agent Core

AnswerB

Cortex XDR uses Tenant Management, Endpoint Groups, and RBAC scoping to isolate visibility and control.

Why this answer

Multi-tenancy and role-based access control (RBAC) along with Endpoint Groups allow administrative segregation within a single tenant or via multi-tenant architecture.

Practice this question →

MCQhard

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

A.TCP/UDP port 514

B.TCP port 636 for secure LDAP syslog

C.UDP port 123 for Network Time Protocol

D.TCP port 8080 for HTTP forwarding

AnswerA

Standard syslog traffic uses port 514 by default.

Why this answer

By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Practice this question →

MCQmedium

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

A.On the local Broker VM CLI configuration menu

B.Via the Palo Alto Networks Firewall URL Filtering profile

C.Directly inside the Windows registry under HKLM\Software\Cyvera\Proxy

D.In the Agent Settings profile within the Cortex XDR management console

AnswerD

Agent proxy settings are pushed centrally via the Agent Settings profile.

Why this answer

Proxy settings for Cortex XDR agents are configured within the Agent Settings profile in the Cortex XDR management console.

Practice this question →

Multi-Selectmedium

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

Select 2 answers

A.Sending the installer executable as an email attachment to all employees with instructions to self-install

B.Manually walking to every workstation with a USB flash drive to execute the GUI installer interactively

C.Broadcasting the installer binary over unauthenticated public FTP servers

D.Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune using the .msi package

E.Active Directory Group Policy Object (GPO) Software Installation

AnswersD, E

SCCM and Intune are standard enterprise tools for deploying MSI packages.

Why this answer

Mass deployment on Windows is typically achieved using Endpoint Management tools like SCCM/Intune or Active Directory GPO.

Practice this question →

MCQmedium

You are planning the deployment of Cortex XDR agents across a mixed environment containing Windows, macOS, and Linux servers. During the sizing phase, you need to determine the resource allocation requirements for the Broker VM instances. Which hypervisor platform is officially supported for hosting the Broker VM image?

A.Docker Engine on Bare Metal Linux

B.Microsoft Hyper-V Generation 1 only

C.Citrix Hypervisor XenServer v6.5

D.VMware ESXi

AnswerD

VMware ESXi is fully supported for running the Broker VM OVA image.

Why this answer

Palo Alto Networks provides the Broker VM as an OVF/OVA template supported on VMware ESXi as well as KVM, AWS, and Azure.

Practice this question →

Multi-Selecthard

An administrator is troubleshooting a Broker VM that fails to connect to the Cortex XDR cloud management console after deployment. Which THREE potential causes should be investigated?

Select 3 answers

A.Incorrect fiber channel zoning on the enterprise SAN switch

B.An expired or incorrect registration token used during the initial setup wizard

C.DNS resolution failure preventing the Broker VM from resolving the tenant URL

D.Firewall blocking outbound HTTPS traffic on TCP port 443 from the Broker VM IP address

E.Insufficient physical RAM installed on the host laptop running Windows 11

AnswersB, C, D

Registration tokens are time-sensitive and unique; invalid tokens prevent pairing.

Why this answer

Broker VM connection failures are commonly caused by DNS resolution issues, firewall blocks on TCP 443, or incorrect/expired registration tokens.

Practice this question →

Multi-Selectmedium

When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?

Select 2 answers

A.Apple macOS (supported modern versions with System Extensions)

B.Atari TOS v4.04

C.Commodore AmigaOS 3.1

D.Microsoft Windows (Windows 10, Windows 11, and supported Server editions)

E.MS-DOS 6.22 operating system

AnswersA, D

macOS endpoints are fully supported by Cortex XDR agents.

Why this answer

Cortex XDR supports multiple operating systems including Windows, macOS, and various Linux distributions.

Practice this question →

MCQeasy

When planning a Cortex XDR deployment, what is the primary function of the Cortex XDR server component within the cloud architecture?

A.To replace the Panorama management server for firewall policy enforcement

B.To locally store raw endpoint memory dumps indefinitely without cloud transmission

C.To act as the centralized management console, analytics engine, and data lake for security events

D.To execute automated sandbox detonation for all enterprise email traffic

AnswerC

The Cortex XDR cloud service acts as the central management plane, analytics engine, and scalable data lake.

Why this answer

The Cortex XDR cloud backend hosts the analysis engine, data lake, and management console for threat investigation and policy configuration.

Practice this question →

MCQeasy

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

A.Panther Agent Gateway

B.Cortex XDR Broker VM

C.Cortex XDR Agent Collector Service

D.Panorama Log Forwarding App

AnswerB

The Broker VM is specifically designed to handle off-network agent communications and log forwarding.

Why this answer

The Broker VM serves as a local aggregator and proxy for Cortex XDR agents that are off-network, enabling secure communication with the Cortex XDR management console.

Practice this question →

MCQhard

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

A..rpm Red Hat Package Manager file

B..msi Windows Installer package

C..exe self-extracting archive with embedded arguments

D..dmg disk image format

AnswerB

GPO deployments natively consume standard .msi installation packages.

Why this answer

Group Policy Software Installation (MSI) requires an .msi installation package.

Practice this question →

MCQeasy

Before installing Cortex XDR agents on Windows endpoints, an administrator wants to verify system compatibility. Which minimum Windows operating system version is officially required for the current generation Cortex XDR Agent?

A.Windows XP Service Pack 3

B.Windows 2000 Server Advanced

C.Windows 7 Service Pack 1 / Windows 10 and Windows Server 2012

D.Windows Vista Enterprise

AnswerC

Cortex XDR supports modern Windows releases starting from Windows 7 SP1 and Windows Server 2012 (along with specific support extensions for older servers).

Why this answer

Cortex XDR supports modern Windows operating systems starting from Windows 7 SP1 / Windows 10 and Windows Server 2008 R2 / 2012 and above, with exact support matrices updated per release.

Practice this question →

MCQeasy

Which Cortex XDR license tier is required to ingest third-party logs (such as firewall, identity, and network logs) via the Broker VM Collector?

A.Cortex XDR Pro (Analytics or Per TB)

B.Cortex XDR Prevent (Base Edition)

C.Palo Alto Networks GlobalProtect Free Tier

D.WildFire Standalone API License

AnswerA

Cortex XDR Pro enables advanced analytics and third-party data ingestion via Broker VM.

Why this answer

Ingesting third-party logs for analytics requires the Cortex XDR Pro per TB or Pro per Endpoint license tier with data ingestion capabilities.

Practice this question →

MCQhard

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

A.TCP port 22 for SSH tunnel maintenance

B.TCP port 389 and 636 for directory synchronization

C.TCP port 443 for HTTPS API and tenant communication

D.TCP port 6514 for secure syslog ingestion

AnswerC

Outbound TCP 443 is required for the Broker VM to reach the Cortex XDR cloud backend.

Why this answer

Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Practice this question →

MCQhard

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

A.Global Agent Profile Exclusions (Path, Process, and File Hash exclusions)

B.Broker VM Firewall Rules

C.Kernel Module Blacklisting via /etc/modprobe.d

D.Linux iptables PREROUTING chains

AnswerA

Exclusions are configured within the Agent Settings profile to prevent scanning interference.

Why this answer

Administrators configure Malware Scan Exclusions or Profile Exclusions in the Cortex XDR console to exempt specific paths or processes.

Practice this question →

MCQeasy

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

A.To license the endpoint for Palo Alto Networks Next-Generation Firewall features

B.To authenticate the agent against the local Active Directory domain controller

C.To encrypt all local agent SQLite databases at rest

D.To authenticate the agent installation and prevent unauthorized uninstallation or tampering

AnswerD

Installation passwords/tokens ensure only authorized administrators can install or uninstall the agent.

Why this answer

Installation tokens/passwords protect the agent from unauthorized removal, tampering, or uninstallation by local end-users.

Practice this question →

MCQmedium

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

A.A pre-shared IPSec tunnel key configured on the perimeter firewall

B.A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM

C.An imported enterprise PKI root certificate bundle

D.An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

AnswerB

Administrators generate a Broker VM registration token directly in the Cortex XDR console UI.

Why this answer

Pairing a Broker VM requires generating a registration token in the Cortex XDR console and entering it into the Broker VM setup wizard.

Practice this question →

MCQhard

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

A.Via dial-up modem backup lines connected directly to Palo Alto Networks support

B.Air-gapped environments are not supported by Cortex XDR under any circumstances

C.Updates are physically loaded via USB thumb drive into every endpoint agent daily

D.Through a Broker VM configured to download and distribute content updates locally within the air-gapped network

AnswerD

Broker VM supports offline/air-gapped environments by acting as a local distribution point for content updates.

Why this answer

In air-gapped environments, agents receive updates through a local Broker VM configured as a content proxy/gateway that syncs from an internal source or offline bundle.

Practice this question →

MCQmedium

An administrator needs to verify that the Broker VM is successfully running and communicating with all configured apps. Where in the Cortex XDR management console can the administrator check the real-time operational status and health of the Broker VM?

A.Settings > Configurations > Broker VM

B.Dashboards > Incident Overview > Broker Status

C.Endpoints > All Endpoints > Infrastructure View

D.Reports > Scheduled Reports > VM Health

AnswerA

The Broker VM configuration page displays status, connected apps, and heartbeat health.

Why this answer

Broker VM health and status can be monitored in the Cortex XDR console under Settings > Configurations > Broker VM.

Practice this question →

Multi-Selectmedium

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Select 2 answers

A.Manually write custom assembly code for every endpoint CPU architecture

B.Physically replace all enterprise core switches with Palo Alto Networks firewalls

C.Disable all cloud logging features to prevent data ingestion

D.Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles

E.Create and customize Agent Installation Packages and Settings profiles

AnswersD, E

Setting up admin accounts and RBAC ensures secure administrative access.

Why this answer

Initial setup requires defining admin accounts/RBAC and configuring agent installation packages and profiles.

Practice this question →

MCQhard

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

A.Push an XML configuration update using Panorama

B.Reboot the Broker VM hypervisor with the Syslog ISO attached

C.Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM

D.Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

AnswerC

Broker VM apps are managed and enabled directly through the Cortex XDR console configuration menus.

Why this answer

After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Practice this question →