Maintenance And Troubleshooting practice questions

cortex_cli.sh

Why it fails: cortex_cli.sh does not exist as an endpoint control utility.

traps_control.exe

Why it fails: traps_control.exe is a legacy Traps command-line utility replaced by cytool in modern Cortex XDR releases.

xdr_agent_mgr.exe

Why it fails: xdr_agent_mgr.exe is a fictional utility name not used by Palo Alto Networks.

Disable behavioral threat protection globally.

Why it fails: Disabling a module globally lowers overall security posture and is not best practice for a single application exception.

Create a correlation rule to suppress alerts from that path.

Why it fails: Correlation rules suppress alerts, but they do not stop local agent prevention modules from blocking an executable.

Modify the Broker VM ingestion filter.

Why it fails: Broker VM filters handle network log collection, not endpoint prevention enforcement.

CortexDebug.etl

Why it fails: CortexDebug.etl is used for deep packet or performance profiling traces, not the standard install logs.

TrapsConfig.xml

Why it fails: TrapsConfig.xml stores the agent's configuration settings rather than runtime events, so it shows no installation or service startup errors. The installation log records those failures; the XML file is consulted when verifying or editing agent configuration.

AgentService.dmp

Why it fails: AgentService.dmp is a crash dump written only when the agent service faults, so it is absent during a normal installation that simply fails to register. The installation log records service startup and console communication errors, making it the first file to review.

pan_status --all

Why it fails: pan_status is not a native Broker VM shell command.

broker-vm status-collector

Why it fails: broker-vm is not a valid CLI binary on the Broker VM.

service broker status

Why it fails: 'service broker status' is not the correct syntax for Broker VM service verification.

cytool diag package

Why it fails: cytool diag package does not exist.

cytool support export

Why it fails: cytool support export is an incorrect syntax.

cytool dump-all

Why it fails: cytool dump-all is not a valid command argument.

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Why it fails: Traps.properties is not the mechanism for configuring proxy routing in Cortex XDR agents.

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Why it fails: Manual registry editing does not scale and is prone to errors; profiles should be managed centrally.

Configure the proxy settings on the Broker VM only.

Why it fails: Broker VM proxies do not configure endpoint agent internet traversal.

Dashboards > Executive Summary.

Why it fails: Executive dashboards show high-level charts, not real-time API connector latency or error logs.

Incident Response > Queue Manager.

Why it fails: Incident Response has no Queue Manager view.

Endpoint Management > Collector Health.

Why it fails: Endpoint management applies to agents, not cloud data collectors.

/var/log/messages

Why it fails: /var/log/messages records kernel and general system events, not application-specific broker parsing errors.

/var/log/secure

Why it fails: /var/log/secure tracks authentication and SSH access attempts.

/opt/panw/broker/cortex.log

Why it fails: This path is fictional; Broker VM logs follow structured paths under /var/log/pan/.

Disable the Anti-Malware module.

Why it fails: Disabling modules stops protection but does not remove the endpoint record or free the license.

Move the endpoint to an unmanaged folder.

Why it fails: Moving endpoints between folders does not release the assigned license.

Run 'cytool license release' via remote action.

Why it fails: Licenses are managed by the cloud console inventory, not released via local cytool commands.

TOKEN=<token_value>

Why it fails: TOKEN is not the correct property name for the installer.

REGISTER_ID=<token_value>

Why it fails: REGISTER_ID is a fictional property name.

XDR_KEY=<token_value>

Why it fails: XDR_KEY is not recognized by the Cortex XDR Windows installer.

Local Syslog Forwarder

Why it fails: A syslog forwarder exports agent telemetry to external SIEM or log collectors; it does not observe process creation locally. Parent-child lineage requires the kernel filter driver intercepting process-start events. Syslog forwarding would be the right choice when centralising Cortex XDR logs into a third-party platform.

Agent GUI Application (Traps.exe)

Why it fails: Traps.exe is the endpoint console for user interaction and alerts, not the lineage engine. Causality chains are built by the agent's kernel-level process monitor, which hooks process-creation events. The GUI would only be relevant when an administrator needs to view or manually act on detections locally.

Broker VM Parser Module

Why it fails: The Broker VM Parser Module normalises and forwards logs collected from external sources; it does not observe endpoint process creation, so it cannot supply parent-child lineage. It is the correct component for ingesting third-party syslog or network flow data into Cortex XDR.

cytool perf-tune

Why it fails: cytool perf-tune does not exist.

cytool trace modify

Why it fails: cytool trace modify is not a valid subcommand.

cytool debug cpu-limit

Why it fails: CPU limits are managed via agent configuration profiles, not local trace commands.

Format the endpoint hard drive and restore from a factory image.

Why it fails: Formatting is unnecessary for agent corruption issues that can be resolved via standard uninstall/reinstall procedures.

Delete the agent folder manually in Program Files without using the uninstaller.

Why it fails: Manual deletion leaves registry keys, drivers, and services corrupted, preventing successful reinstallation.

Force an overwrite installation without uninstalling by modifying Windows Group Policy.

Why it fails: Overwriting a corrupted agent without cleaning up anti-tamper hooks typically fails.

Use the Cytool utility with the 'safe_mode' parameter to enable Safe Mode boot.

Why it fails: Cytool is used for agent management, but it does not have a parameter to enable Safe Mode boot. The correct utility for this purpose is the Cortex XDR Agent Configuration tool or a specific command-line option. Cytool is primarily for status and basic operations, not for altering boot restrictions.

Create a Windows Registry key to allow Safe Mode boot and then reboot the endpoint.

Why it fails: While Registry modifications can influence boot behavior, the Cortex XDR Agent specifically monitors and blocks Safe Mode. Simply adding a Registry key will not bypass the agent's protection; the agent must be explicitly configured to permit Safe Mode via its own settings or a supported bypass mechanism.

Use the Cortex XDR Agent uninstall password to disable the agent temporarily.

Why it fails: The uninstall password allows removal of the agent, but it does not specifically enable Safe Mode boot. Disabling the agent temporarily would require a reboot, which is not possible if the endpoint is crashing. The scenario requires a method to boot into Safe Mode while the agent is installed.

Use the Cortex XDR agent's built-in performance monitoring tool from the endpoint's system tray.

Why it fails: The Cortex XDR agent does not include a built-in performance monitoring tool accessible from the system tray. The tray icon provides status and basic actions like disabling protection, but not detailed performance diagnostics. This option is plausible but incorrect because such a tool does not exist.

Restart the Cortex XDR agent service and monitor CPU usage in Task Manager.

Why it fails: Restarting the agent service may temporarily reduce CPU usage but does not provide diagnostic data to identify the root cause. Task Manager only shows overall CPU usage, not detailed driver-level activity. This action is a troubleshooting step but not a method to obtain detailed logs.

Run the Cytool command with the 'support' parameter to generate a support bundle.

Why it fails: The support parameter of Cytool collects system and agent logs into a bundle for support analysis, but it does not provide real-time performance monitoring of the kernel driver. It is useful for offline diagnostics but does not directly address the need to troubleshoot high CPU usage in real time.

Query Builder

Why it fails: Query Builder is used to create and run queries against endpoint data, but it does not simulate BIOC rules. While it can be used to search for specific events, it does not evaluate the BIOC rule logic itself. The administrator needs a tool that specifically tests BIOC rules against historical data.

Live Terminal

Why it fails: Live Terminal provides remote shell access to endpoints for live investigation, but it does not simulate BIOC rules. It is used for interactive troubleshooting on a single endpoint, not for testing detection logic across historical data. This feature is not suitable for verifying BIOC rule behavior.

Action Center

Why it fails: Action Center is used to manage and execute response actions on endpoints, such as isolating or scanning. It does not provide functionality to test BIOC rules. Using Action Center would not help verify why the BIOC rule is not triggering alerts; it is for remediation, not detection testing.

Run the 'broker_status' command from the Cortex XDR agent on any managed endpoint to query the broker's performance counters.

Why it fails: The Cortex XDR agent on endpoints does not have a 'broker_status' command, nor does it query broker performance counters. Endpoint agents communicate with the broker for data relay but do not expose broker health metrics. This command does not exist in the product, making this option invalid and misleading for troubleshooting broker resource issues.

Check the Windows Event Log on the Broker VM for performance monitor entries that report CPU and memory usage.

Why it fails: The Broker VM is typically a Linux-based appliance, and its performance metrics are not logged in Windows Event Log. Even if it were Windows, event logs would not provide the real-time utilization view needed. The console-based monitoring is the correct place to check resource utilization, not the operating system event logs.

Access the Broker VM console via SSH and run the 'top' command to view real-time CPU and memory usage.

Why it fails: While SSH access can provide system-level metrics, the Broker VM is designed to be managed through the Cortex XDR management console, which offers a dedicated monitoring interface. Using SSH and 'top' is not the recommended method and may not reflect the aggregated health status that the console provides. This approach is also less secure and not part of the standard troubleshooting workflow.

Run 'service cortex-xdr status' to check the agent status.

Why it fails: While checking the service status can confirm that the agent is not running, it does not provide detailed logs for diagnosing the failure. The command shows the current state but not the underlying errors. The systemd journal and support bundle are more informative for troubleshooting startup issues.

Enable debug logging by editing the agent configuration file and restarting the agent.

Why it fails: If the agent fails to start, editing the configuration file and restarting may not be possible because the agent cannot load the configuration. Additionally, enabling debug logging requires the agent to be running to generate logs. This action is more appropriate for runtime issues, not startup failures.

Review the Windows Event Viewer for Cortex XDR errors.

Why it fails: The Windows Event Viewer is not available on Linux endpoints. This option is incorrect because the scenario specifies a Linux endpoint, and Windows Event Viewer is specific to Windows operating systems. The administrator should use Linux-native tools instead.

Use a PowerShell script that downloads the agent installer from the Cortex XDR console and runs it with default settings.

Why it fails: While a PowerShell script can be used, downloading the installer at runtime introduces dependencies on network access and may fail if the endpoint cannot reach the console. Additionally, running with default settings may not include the tenant ID, causing the agent to fail registration. This method lacks the reliability and preconfiguration that MECM application deployment with explicit parameters provides.

Deploy the agent using a Group Policy Object (GPO) with the MSI file and a transform (MST) file containing the tenant ID.

Why it fails: Using a GPO with an MST is a viable deployment method, but it is not the recommended method for MECM/SCCM environments. MECM provides native support for MSI deployment with command-line parameters, allowing for more granular control and reporting. GPO deployment lacks the detailed status and error reporting that MECM offers, making it less suitable for large-scale deployments where troubleshooting is essential.

Deploy the agent using a logon script that executes the installer with the /passive flag.

Why it fails: A logon script runs only when users log on, which is not suitable for servers or endpoints that may not have interactive logons. The /passive flag shows a progress bar, which still requires user interaction. This method is unreliable for ensuring all endpoints receive the agent promptly and silently, and it does not preconfigure the tenant ID, leading to potential registration failures.

The Broker VM's disk is full, causing it to reject new connections from some agents.

Why it fails: A full disk on the Broker VM could lead to service degradation, but it would likely affect multiple agents, not just one. Moreover, a disk full condition would more often cause timeouts or internal errors rather than immediate 'connection refused' responses. The symptom is specific to one agent, pointing to a local configuration issue rather than a broker resource problem.

The Broker VM's SSL certificate has expired, causing all agents to fail connection.

Why it fails: If the Broker VM's SSL certificate had expired, all agents connecting to that broker would experience failures, not just one. The scenario states that other agents are communicating fine, so a global certificate issue is inconsistent with the observed behavior. This option is a plausible but incorrect cause because it does not match the scope of the problem.

The Cortex XDR agent on the Linux server has not been assigned a valid license.

Why it fails: License issues would generally prevent the agent from registering with the management server, but they would not cause 'connection refused' errors when attempting to reach the Broker VM. License validation occurs at a different layer and typically results in different error messages, such as authentication failures. Therefore, this is not the most likely cause of the reported connectivity problem.