Planning And Installation practice questions

Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode

Why wrong: Disabling SIP is insecure, not recommended, and not required for Cortex XDR agent deployments.

Modify the /etc/pam.d/authorization file prior to running the PKG installer

Why wrong: Modifying PAM configuration files does not resolve modern macOS system extension approval requirements.

Run the installer using sudo privileges with the --force flag

Why wrong: The force flag bypasses certain checks but cannot automatically bypass macOS system extension security prompts.

Prisma Access Remote Networks Connector

Why wrong: Prisma Access Connectors provide secure access to cloud-managed enterprise networks, not Cortex XDR agent proxying.

Traps Management Service

Why wrong: Traps Management Service is the legacy management plane name and is not deployed on-premises for proxying.

Panorama Management Server

Why wrong: Panorama manages Palo Alto Networks firewalls, not Cortex XDR agent telemetry and proxy services.

Upload a valid SSL wildcard certificate signed by a public Certificate Authority directly to the hypervisor

Why wrong: Certificates are managed within the Broker VM interface or auto-generated; they are not uploaded directly to the hypervisor.

Run the setup wizard using the default admin credentials and map an NFS datastore

Why wrong: NFS datastores are not required for Broker VM registration.

Configure a Syslog forwarding rule in Panorama to push the registration payload

Why wrong: Panorama is not involved in registering or linking Broker VMs.

apt-get install ./cortex-xdr.deb

Why wrong: apt-get is used for Debian and Ubuntu distributions, not RHEL.

brew install paloalto-cortex-xdr

Why wrong: Homebrew (brew) is a package manager for macOS and Linux desktops, not enterprise RHEL servers.

rpm -i ctrex-agent.rpm

Why wrong: While rpm can install the package, yum or dnf is preferred to automatically handle dependencies like libselinux.

TCP ports 22, 80, and 443

Why wrong: Port 22 (SSH) is not used for agent-to-cloud communications.

UDP port 514 and TCP port 6514

Why wrong: These ports are used for Syslog forwarding, not standard Cortex XDR agent telemetry.

TCP port 80 and 443

Why wrong: Port 80 is insecure and not used for Cortex XDR cloud communications.

TGZ

Why wrong: TGZ is a compressed archive format used for Linux agent deployments.

PKG

Why wrong: PKG is the installer format used exclusively for macOS endpoints.

EXE

Why wrong: EXE packages are typically used for manual installations or third-party deployment tools, not standard AD GPO deployment.

1 vCPU and 2 GB RAM

Why wrong: This specification is insufficient and below the minimum requirements for a Broker VM.

16 vCPU and 64 GB RAM

Why wrong: This specification exceeds normal Broker VM requirements and is oversized unless multiple heavy third-party log collectors are combined.

2 vCPU and 4 GB RAM

Why wrong: This is the minimum sizing for small environments, not an environment with 15,000 endpoints.

Settings > Configurations > Agents

Why wrong: This path does not exist for downloading installers.

Dashboards > Incident Management > Installers

Why wrong: Dashboards are for viewing alerts and incidents, not downloading installers.

Endpoints > Agent Settings > Packages

Why wrong: Agent settings control behavior, but package downloads are managed from a dedicated Installers menu.

Modify the Windows Registry on each endpoint to point to separate cloud regions

Why wrong: Manual registry manipulation is not a scalable or supported method for multi-tenant isolation.

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Why wrong: VLAN tagging at the hypervisor level does not logically isolate endpoint data inside the Cortex XDR cloud tenant.

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Why wrong: Installing multiple Cortex XDR agents on a single endpoint is unsupported and will cause conflicts.

/verysilent /suppressmsgs

Why wrong: These switches are specific to Inno Setup installers, not MSI packages.

--install --silent

Why wrong: These are not valid msiexec command-line flags.

/silent /norestart

Why wrong: These are typical switches for EXE installers, not standard msiexec MSI parameters.

The Broker VM registration key contains invalid characters due to copy-paste formatting

Why wrong: Registration key errors occur during initial registration, not when pulling periodic updates.

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Why wrong: License expiration affects overall tenant access and agent registration, but does not specifically manifest as a local SSL handshake failure on the Broker VM.

The Broker VM kernel version is incompatible with the Linux swap space partition size

Why wrong: Swap space size does not cause SSL handshake failures.

Aggressive Prevention Mode

Why wrong: Aggressive mode immediately blocks suspicious behaviors, which can cause false positives during initial rollout.

Disabled Mode

Why wrong: Disabled mode stops all agent protection and telemetry collection.

Quarantine Mode

Why wrong: Quarantine mode isolates endpoints from the network, which disrupts business operations if used prematurely.

Palo Alto Networks Next-Generation Firewall configured with GlobalProtect

Why wrong: Firewalls secure network perimeters; they do not act as log collectors for Cortex XDR.

Cortex XDR Agent installed on a dedicated Linux log server

Why wrong: Agents are installed on endpoints for telemetry collection, not as network syslog collectors.

Prisma Access Cloud Secure Web Gateway

Why wrong: Prisma Access provides secure web gateway services, not local syslog collection.

To assign different cloud tenants to individual users

Why wrong: Profiles do not govern cloud tenant assignment.

To support different operating system architectures within the same profile

Why wrong: A single profile can apply across architectures, but different security postures require distinct configurations.

To manage software license renewals automatically

Why wrong: Licenses are managed centrally, not via agent settings profiles.

Revoke the endpoint certificate from the local Certificate Authority (CA) store

Why wrong: Certificates do not govern agent uninstallation.

Disable Windows Defender and run the standard Windows Add or Remove Programs wizard

Why wrong: Windows Defender is unrelated to Cortex XDR tamper protection.

Boot the endpoint into Safe Mode and delete the agent installation directory manually

Why wrong: Manual deletion leaves behind registry keys, drivers, and service entries, corrupting the system state.

Dashboards > System Status > Updates

Why wrong: Dashboards do not support software uploads.

Administration > Global Protect > Client Versions

Why wrong: GlobalProtect is a separate product managed under its own tabs.

Settings > Tenant Management > Software Repository

Why wrong: This path is incorrect for agent version management.

Disable all behavioral threat prevention modules on gold master images

Why wrong: Disabling security modules lowers protection and is unnecessary for VDI environments.

Configure the hypervisor to inject a new license key on every reboot

Why wrong: Cortex XDR licensing is tenant-based, not injected per VM reboot.

Install a unique static IP address allocation script for every virtual machine instance spawned

Why wrong: Static IPs do not resolve non-persistent VDI record management in Cortex XDR.

The Broker VM must operate as an explicit proxy server with Kerberos authentication enabled

Why wrong: Kerberos authentication is not a requirement for Broker VM operation.

The Broker VM must have ICMP echo requests enabled across all enterprise routers

Why wrong: ICMP is not required for Broker VM functionality.

The Broker VM must have a direct public IP address assigned to its management interface

Why wrong: A public IP address is not required; standard outbound internet access via NAT is sufficient.

/Library/Application Support/PaloAltoNetworks/Cortex/cytool.sh version

Why wrong: The binary is named cytool directly without a .sh extension.

/Library/Cortex/bin/cytool version query

Why wrong: This path or subcommand syntax is incorrect.

/Applications/Cortex.app/Contents/MacOS/cytool query version

Why wrong: This is an invalid path and syntax.

Disable Windows User Account Control (UAC) entirely across all domain controllers

Why wrong: Disabling UAC is a severe security risk and does not solve third-party application whitelisting blocks.

Configure the local hosts file to resolve the management tenant to localhost

Why wrong: Modifying the hosts file in this manner breaks cloud connectivity.

Convert the file system from NTFS to FAT32 to support raw driver loading

Why wrong: FAT32 is obsolete, insecure, and incompatible with modern enterprise OS requirements.