Courseiva

CCNA Troubleshooting Questions

42 questions · Troubleshooting topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQeasy

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

A.A domain administrator Kerberos ticket.
B.An internet connection to the Palo Alto Networks licensing server.
C.An anti-tamper password generated in the Cortex XDR management console.
D.Physical access to the BIOS/UEFI settings.
AnswerC

Cortex XDR anti-tamper blocks local cytool stop commands unless a password generated in the management console is supplied. That password authorises the temporary protection disable, satisfying the requirement to perform the action locally on the endpoint.

Why this answer

Disabling agent protection locally via cytool requires entering a valid anti-tampering password or uninstall password generated in the console.

Practice this question →
2
Multi-Selecthard

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Select 3 answers
A.Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.
B.Export all raw logs to a local spreadsheet application for filtering.
C.Restrict the time range of the query to the smallest necessary window rather than searching over extended periods.
D.Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.
E.Use specific indexed fields in the filter clauses rather than broad wildcard searches across all text attributes.
AnswersA, C, E

Pushing dataset and equality filters to the start of the pipeline shrinks the working set before aggregations run, so the engine scans far fewer records. This directly addresses the query timeouts caused by processing large historical log volumes.

Why this answer

Option A is correct because applying explicit dataset filters and equality checks early in the XQL pipeline reduces the volume of events that must be processed by later stages, so expensive aggregations run against a much smaller, already-narrowed result set. Option C is correct because XQL performance is heavily time-bound; restricting the query to the smallest necessary time window limits how many indexed partitions and raw log records the engine must scan, directly reducing query time and timeout risk. Option E is correct because filtering on specific indexed fields lets the query engine use its indexes for fast lookups, whereas broad wildcard searches across all text attributes force full-text scans that are far slower and more resource-intensive.

Option B is not appropriate because exporting raw logs to a spreadsheet does not optimize XQL query performance and is impractical for large historical datasets. Option D is not correct because increasing Broker VM CPU does not accelerate the cloud XQL execution engines, which run in the cloud rather than on the local Broker VM.

Exam trap

The trap here is that candidates pick infrastructure-scaling answers (like adding CPU to the Broker VM) instead of recognizing that XQL performance is governed by query construction — filters, time range, and indexed fields — not by broker hardware.

Practice this question →
3
Multi-Selecthard

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Select 3 answers
A.Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.
B.Examine the Broker VM export logs for queue backups or delivery error responses from the SIEM receiver.
C.Verify that the destination SIEM listener IP address and port are reachable from the Broker VM using network tools like nc or telnet.
D.Restart the Cortex XDR management console web server.
E.Reinstall the Windows operating system on the SIEM receiver.
AnswersA, B, C

Connection timeouts often stem from a TLS handshake failure, so verifying whether the SIEM mandates mutual TLS and confirming the Broker VM presents a valid client certificate addresses the transport-layer authentication requirement before traffic can be delivered.

Why this answer

Option A is correct because connection timeouts during log forwarding can result from the SIEM requiring mutual TLS (mTLS), where the Broker VM must present a valid client certificate; verifying and configuring the correct client certificate on the Broker VM resolves handshake failures that manifest as timeouts. Option B is correct because examining the Broker VM export logs reveals queue backups or explicit delivery error responses from the SIEM receiver, which directly indicate whether logs are being buffered due to unreachable or rejecting endpoints. Option C is correct because verifying the destination SIEM listener IP address and port are reachable from the Broker VM using tools like nc or telnet confirms basic network connectivity and isolates firewall, routing, or listener-binding issues causing the timeouts.

Option D is not relevant because restarting the Cortex XDR management console web server does not address Broker VM-to-SIEM network or authentication problems. Option E is not appropriate because reinstalling the Windows operating system on the SIEM receiver is a drastic, unrelated action that does not troubleshoot the forwarding connection.

Exam trap

The trap is selecting irrelevant actions like restarting the management console or reinstalling the SIEM OS, which do not address the root cause of log forwarding timeouts.

Practice this question →
4
MCQeasy

An administrator needs to quickly identify which Cortex XDR agent version is installed on a specific Windows endpoint that is experiencing performance issues. The administrator has access to the Cortex XDR management console. Where can this information be found?

A.In the Agent Installations page under Settings, download the agent installer and check its version.
B.In the Audit Logs, search for the endpoint name and find the agent version in the log entries.
C.In the Endpoints page, search for the endpoint and view its details, which include the agent version.
D.In the Incidents page, filter by the endpoint name and look for agent version in the incident details.
AnswerC

The Endpoints page in the Cortex XDR management console lists all managed endpoints and provides detailed information for each, including the installed agent version, operating system, and last check-in time. Searching for the specific endpoint and viewing its details is the most direct way to obtain the agent version without accessing the endpoint directly.

Why this answer

The Cortex XDR management console's Endpoints page provides a comprehensive inventory of all managed endpoints, including the agent version. By searching for the specific endpoint, the administrator can quickly view its details, such as agent version, OS, and status. This is the intended and most efficient method for checking agent versions across the environment.

Exam trap

The trap here is assuming that agent version information is found in installation packages or audit logs, rather than in the endpoint inventory view.

Practice this question →
5
Multi-Selecthard

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Select 3 answers
A.Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.
B.Verify the time window and threshold settings configured within the correlation rule definition.
C.Restart all endpoint agents associated with the correlation rule.
D.Reboot the Broker VM log collector service.
E.Test the underlying query logic using XQL Search to ensure matching events are actually present in the dataset.
AnswersA, B, E

Disabled rules or misapplied scopes will not generate incidents.

Why this answer

Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Practice this question →
6
MCQhard

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator wants to retrieve the raw event data for this activity to understand the full context, including the command line and parent process. Which Cortex XDR feature should the administrator use to obtain this detailed event information?

A.Incident details page, which shows the alert and associated artifacts.
B.Agent management console, which logs all process executions and can export raw events.
C.Query Builder, using the 'action_process_image_name' field and filtering by the hostname and time range.
D.Causality Chain view for the alert, which displays the process tree and allows drilling down to raw event data.
AnswerD

The Causality Chain view provides a visual representation of the process tree related to an alert, showing parent-child relationships and the sequence of events. By clicking on a specific process or event, the administrator can view the raw event data, including command line, user, and other fields. This is the most efficient way to get full context for a specific alert.

Why this answer

The Causality Chain view is the correct feature to use. It provides a detailed process tree and allows the administrator to drill down into individual events to see raw data, including command line, parent process, and other metadata. This is essential for understanding the full context of an alert like LSASS access.

Other options either provide summary information or are not designed for this purpose.

Exam trap

The trap here is assuming that the incident details page or Query Builder provides enough detail, when in fact the Causality Chain is needed for full raw event context.

Practice this question →
7
MCQhard

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

A.The Windows Event Log under Applications and Services Logs > Cortex XDR.
B.The connectivity log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Connectivity.log).
C.The Broker VM's log on the management server.
D.The agent's operational log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Agent.log).
AnswerB

The connectivity log specifically records the agent's attempts to communicate with the Cortex XDR management console, including HTTP requests, responses, and any errors. It is the primary log for diagnosing why policy updates are not being received, as it shows the status of the communication channel.

Why this answer

When an endpoint is not receiving policy updates despite being connected, the connectivity log on the endpoint is the most direct source of information. It records the agent's communication with the management console, including any errors or failed requests. Reviewing this log first can quickly identify issues such as network blocks, authentication failures, or server unavailability.

Exam trap

The trap here is assuming that the operational log or Windows Event Log contains sufficient detail for communication troubleshooting, when the connectivity log is specifically designed for that purpose.

Practice this question →
8
Multi-Selectmedium

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Select 2 answers
A.Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.
B.Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.
C.Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.
D.Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.
E.Verify that network access from the collector to the cloud API endpoint is unblocked.
AnswersA, E

Cloud Data Collectors authenticate to Microsoft Entra ID through an app registration, so ingestion fails without the required Graph API permissions and tenant-wide admin consent. Verifying both in the cloud provider portal directly satisfies the stem's prerequisite check, since missing consent blocks token issuance before any log retrieval occurs.

Why this answer

Option A is correct because ingesting Microsoft Entra ID (Azure AD) logs through a Cloud Data Collector requires an app registration in the cloud provider portal with the appropriate API permissions (for example, Microsoft Graph/Office 365 Management APIs) and tenant-wide admin consent granted, otherwise the collector cannot authenticate and pull audit/sign-in logs. Option E is correct because the Cloud Data Collector must be able to reach the cloud API endpoint (for example, graph.microsoft.com and the Office 365 Management API endpoints over TCP 443); if outbound network access, proxy, or firewall rules block these endpoints, ingestion fails even with correct permissions. Option B is wrong because Cortex XDR Agents are endpoint agents for Windows/macOS/Linux hosts, not something installed on Microsoft Entra ID tenant servers, and Entra ID is a cloud service.

Option C is wrong because AD DS LDAP port 389 is irrelevant to cloud-to-cloud Entra ID log ingestion via a Cloud Data Collector. Option D is wrong because a local Broker VM with a syslog listener is used for on-premises/syslog-based log collection, not for API-based Microsoft Entra ID ingestion through a Cloud Data Collector.

Exam trap

The trap is treating cloud SaaS log ingestion like on-premises syslog or agent-based collection; Entra ID requires API permissions with admin consent and HTTPS reachability to Microsoft Graph, not LDAP or local agents.

Practice this question →
9
Multi-Selectmedium

A Cortex XDR administrator is troubleshooting why a custom BIOC rule is not generating alerts on a group of endpoints. The administrator has verified that the rule is enabled and the endpoints are online. Which two actions should the administrator take to further troubleshoot the issue? (Choose two.)

Select 2 answers
A.Verify that the BIOC rule's condition logic matches the expected process behavior.
B.Ensure the endpoints have the latest content update that includes the BIOC engine.
C.Restart the Cortex XDR agent on all endpoints in the group.
D.Check the BIOC rule's scope to ensure it includes the correct endpoint groups.
E.Check the Cortex XDR management console's audit logs for rule modification history.
AnswersA, D

If the condition logic is incorrect, the rule will not match the activity. For example, a typo in a process name or an incorrect operator can prevent alerts. Reviewing the logic against the actual process behavior is essential to ensure the rule triggers as intended.

Why this answer

When a custom BIOC rule does not generate alerts, the most likely causes are incorrect scope or faulty condition logic. Checking the scope ensures the rule applies to the right endpoints, and verifying the logic ensures it matches the intended activity. These two steps directly address common misconfigurations.

Exam trap

The trap here is assuming that agent restarts or content updates will fix a custom BIOC rule issue, when the problem typically lies in the rule's scope or logic.

Practice this question →
10
MCQeasy

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

A.Go to Incident Response > Investigations.
B.Go to Endpoints > All Endpoints and check the Last Connected and Content Version columns.
C.Go to Dashboards > Agent Health widget.
D.Go to Settings > Configurations > Agent Management.
AnswerB

Checking Endpoints > All Endpoints allows administrators to view real-time sync status, agent version, and policy application.

Why this answer

The Status column and Agent Details view under Endpoints provide real-time connection status and policy sync timestamps.

Practice this question →
11
MCQmedium

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

A.Dashboards > Audit Reports
B.Incident Response > Activity Log
C.Settings > Configurations > Audit Trail
D.Help > System Logs
AnswerC

The Audit Trail under Settings > Configurations records administrative and user actions performed in the Cortex XDR console, with timestamps and filtering by date range, letting the administrator export the required 90-day history of admin activity.

Why this answer

Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Practice this question →
12
Multi-Selectmedium

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Select 2 answers
A.Cluster Broker VMs into a single IP address using Windows Failover Clustering.
B.Configure syslog sources to point to a network load balancer that distributes traffic across multiple Broker VM instances.
C.Route all syslog traffic through a single Broker VM to prevent packet loss.
D.Configure active-passive clustering using VRRP directly inside the Broker VM appliance settings.
E.Deploy multiple Broker VMs in the environment to distribute log forwarding loads from large numbers of sources.
AnswersB, E

A network load balancer fronting multiple Broker VM instances distributes syslog ingestion across them, removing the single point of failure. This satisfies the high-availability and load-balancing requirement by spreading source traffic rather than overloading one collector.

Why this answer

Option B is correct because placing a network load balancer in front of multiple Broker VMs lets syslog sources send to one virtual IP while the load balancer distributes connections across the Broker VM instances, providing both load balancing and failover if one VM becomes unavailable. Option E is correct because deploying multiple Broker VMs horizontally scales log forwarding capacity, so large numbers of endpoints and syslog sources are spread across several appliances rather than overloading a single VM. Options A and D are incorrect because Cortex XDR Broker VMs do not support Windows Failover Clustering or VRRP-based active-passive clustering inside the appliance; high availability is achieved through external load balancing and multiple broker instances, not OS-level clustering.

Option C is incorrect because funneling all syslog traffic through one Broker VM creates a single point of failure and a bottleneck, which is the opposite of the high availability and load balancing goal.

Practice this question →
13
MCQeasy

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

A.Dashboards > Alert Rules
B.Endpoints > Policy > Alerts
C.XQL Search > Alert Action
D.Settings > Configurations > Notifications (or Incident Notifications)
AnswerD

Cortex XDR exposes incident notification configuration under Settings > Configurations > Notifications, where administrators define severity thresholds and email recipients. Configuring critical severity there triggers email alerts whenever a matching incident is detected, satisfying the requirement.

Why this answer

Incident notification settings, including email integrations and webhook alerts, are configured under Settings > Configurations > Integrations > Email or Notifications.

Practice this question →
14
Multi-Selectmedium

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Select 2 answers
A.All local agent prevention modules are automatically disabled.
B.The endpoint automatically shuts down after 10 minutes of isolation.
C.All network traffic is blocked except for communication with the Cortex XDR management console and designated exceptions.
D.Local user login is completely disabled and the physical screen turns black.
E.The administrator retains the ability to manage the endpoint and run remote actions via the Cortex XDR console.
AnswersC, E

Isolation enforces a host firewall ruleset that permits only the Cortex XDR management channel and administrator-defined exceptions, satisfying the stem's requirement that the endpoint retain management connectivity while all other network traffic is blocked. This selective filtering distinguishes isolation from full network disablement, preserving remediation control.

Why this answer

Option C is correct because Cortex XDR network isolation works by blocking all inbound and outbound network traffic on the endpoint while still permitting the agent's communication with the Cortex XDR management console (and any configured isolation exceptions), so the endpoint remains reachable for management. Option E is correct because isolation is designed to contain a threat without losing control: the administrator can still manage the endpoint and execute remote response actions (such as live terminal, file retrieval, or additional response scripts) from the Cortex XDR console. Option A is incorrect because isolation does not disable the local agent's prevention modules; endpoint protection continues to run and enforce policy.

Option B is incorrect because isolation does not power off or shut down the endpoint after any timeout. Option D is incorrect because isolation does not disable local user login or blank the physical screen; the user can still log in locally, only network connectivity is restricted.

Exam trap

XDR-Engineer often tests the misconception that isolation disables all endpoint functionality, including local prevention modules or user login, when in fact it only restricts network traffic while preserving management access and local operations.

Practice this question →
15
MCQeasy

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

A.The Incidents page under the Detection section
B.The Endpoints page under the Inventory section
C.The Policy Management page under the Configuration section
D.The Audit Log page under the Settings section
AnswerB

The Endpoints page in the Inventory section lists all managed endpoints along with their agent status, last seen time, and other details. Searching by hostname there provides a direct way to confirm whether the agent is active and reporting. This is the intended console location for endpoint-level status checks.

Why this answer

The Endpoints page under Inventory is the central place to search for a managed endpoint by hostname and view its agent status, including last seen time and operational state. Other console areas focus on incidents, policy configuration, or audit events, none of which directly provide endpoint agent connectivity status.

Exam trap

The trap here is confusing incident or policy views with the endpoint inventory, which is the authoritative source for agent status and connectivity.

Practice this question →
16
MCQhard

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

A.Download the RPM package from Customer Support Portal and compile it manually via SSH.
B.Re-deploy a new Broker VM virtual appliance and delete the old one.
C.Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.
D.Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.
AnswerD

The Cortex XDR management console provides the supported upgrade path for Broker VM software, pushing the new version to the appliance under Settings > Configurations > Broker VM. Manual or CLI upgrades fall outside Palo Alto's supported method and risk an unsupported configuration.

Why this answer

The recommended and supported method to upgrade the Cortex XDR Broker VM is through the Cortex XDR management console. Under Settings > Configurations > Broker VM, administrators can initiate the upgrade, which pushes the new version to the Broker VM. This ensures compatibility and proper validation by Palo Alto Networks.

Exam trap

XDR-Engineer often tests the supported upgrade path for Broker VM. Candidates might think manual package management or re-deployment is acceptable, but Palo Alto Networks only supports console-initiated upgrades.

How to eliminate wrong answers

Option A is wrong because manually downloading and compiling an RPM package via SSH is not supported and can lead to an inconsistent or broken Broker VM. Option B is wrong because re-deploying a new Broker VM and deleting the old one is disruptive, loses configuration, and is not the recommended upgrade path. Option C is wrong because running 'apt-get upgrade pan-broker' is not a supported method; the Broker VM is not managed via standard Linux package managers for upgrades, and this could break the appliance.

Practice this question →
17
Multi-Selecthard

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Select 3 answers
A.Ensure that WinRM is configured with Kerberos delegation across the entire Active Directory domain.
B.Check the script syntax and dependencies for missing PowerShell modules or inaccessible file paths on the host.
C.Verify that the script does not require interactive GUI user prompts, as remote actions run in the background system context.
D.Ensure the PowerShell execution policy on the target endpoint permits script execution (e.g., Bypass or RemoteSigned).
E.Verify that the Cortex XDR Broker VM has PowerShell remoting enabled.
AnswersB, C, D

Script failures frequently stem from unresolved dependencies: a required PowerShell module absent on the target host, or a file path the script references that the endpoint cannot reach. Verifying syntax and module availability directly addresses the exit-code errors arising from Cortex XDR Remote Actions executing in the host's own context, where local module and path conditions govern success.

Why this answer

Option B is correct because exit code errors frequently stem from the script itself — a syntax mistake, a missing PowerShell module (e.g., not available in the system context), or a file path that does not exist on the endpoint will cause the script to terminate with a non-zero exit code. Option C is correct because Cortex XDR Remote Actions execute scripts non-interactively in the background under the system account, so any cmdlet or script that triggers a GUI prompt (e.g., Read-Host, Out-GridView, credential pop-ups) will hang or fail with an exit code. Option D is correct because the target endpoint's PowerShell execution policy (Restricted, AllSigned, RemoteSigned, Bypass, etc.) governs whether the delivered script can run at all; if it is set to Restricted or AllSigned without a valid signature, execution is blocked and an exit code error results.

Option A is not required because Cortex XDR Remote Actions do not depend on Kerberos constrained delegation across the domain — WinRM connectivity to the endpoint is what matters, not domain-wide delegation. Option E is incorrect because the Broker VM is used for network/agent communication and does not need PowerShell remoting enabled; PowerShell execution happens on the target endpoint, not on the Broker VM.

Practice this question →
18
MCQhard

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Windows endpoint is not blocking a known malicious file, even though the prevention policy is set to block. The administrator has confirmed that the policy is applied and the agent is connected. Which of the following is the most likely reason for the agent's failure to block?

A.The Cortex XDR agent is in 'Report Only' mode for the prevention policy.
B.The malicious file is located on a network share that is excluded from scanning by the prevention policy.
C.The Cortex XDR agent's content update is outdated and does not recognize the file as malicious.
D.The file's hash is on the local allow list in the Cortex XDR agent configuration.
AnswerD

If a file's hash is explicitly allowed in the local agent configuration, the agent will not block it even if the prevention policy dictates blocking. Local allow lists override policy settings. This is a common cause for unexpected non-blocking behavior, especially if an administrator previously added an exception for that file. Checking the local allow list is a critical troubleshooting step.

Why this answer

A local allow list entry for the file's hash would cause the Cortex XDR agent to bypass prevention actions, even if the policy is set to block. This is a common oversight when troubleshooting unexpected non-blocking behavior. The administrator should inspect the agent's local allow list configuration and remove the entry if it is not intended.

Exam trap

The trap here is assuming that a policy set to block will always block, ignoring the possibility of local exceptions that override policy actions.

Practice this question →
19
MCQeasy

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

A.Dashboards > License Widget
B.Help > About Cortex XDR
C.Endpoints > Licensing Status
D.Settings > Configurations > Licenses
AnswerD

License utilisation totals and expiry dates are surfaced under Settings > Configurations > Licenses in the Cortex XDR management console, giving administrators the tenant-wide view of consumed seats and renewal timing without needing separate licensing portals.

Why this answer

License details and usage quotas are found under Settings > Configurations > Licenses.

Practice this question →
20
Multi-Selecthard

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Select 3 answers
A.Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.
B.Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.
C.Review the Broker VM system health metrics under Settings > Configurations > Broker VM in the console.
D.Inspect collector logs under /var/log/pan/ for potential event loops or memory leaks during high ingestion spikes.
E.Change the Broker VM disk partition table using fdisk.
AnswersB, C, D

Running 'top' or 'htop' over SSH exposes per-process resident memory and CPU consumption on the Broker VM, pinpointing which daemon or service is exhausting RAM rather than merely confirming the aggregate utilisation already reported, which is the diagnostic detail the investigation requires.

Why this answer

Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion.

Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Exam trap

XDR-Engineer often tests the misconception that kernel or disk modifications are appropriate for troubleshooting a closed appliance, when the correct approach is to use supported diagnostic tools and logs.

Practice this question →
21
MCQmedium

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

A.pan_broker_status --syslog
B.netstat -tulnp
C.traceroute -syslog
D.systemctl check-syslog
AnswerB

netstat -tulnp lists listening TCP and UDP sockets with numeric ports and owning processes, revealing whether the Broker VM's syslog listener is active. It also shows established connections, letting the administrator confirm connectivity status for the failing log source.

Why this answer

The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Practice this question →
22
MCQeasy

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

A.Go to Settings > Configurations > Broker VM.
B.Go to XQL Search using dataset = broker_vm_logs.
C.Go to Dashboards > Broker VM Performance.
D.Go to Endpoint Management > Broker VM.
AnswerA

Broker VM health, CPU and memory utilisation are surfaced under Settings > Configurations > Broker VM, where each deployed broker appliance is listed with its connection state and resource metrics. This satisfies the stem's requirement to monitor operational status directly in the Cortex XDR management console.

Why this answer

The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Practice this question →
23
MCQeasy

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

A.Settings > Content Updates > Status.
B.Incident Response > Endpoint Inventory.
C.Dashboards > Content Health.
D.Endpoints > All Endpoints view, under the Content Version column.
AnswerD

The All Endpoints view exposes a Content Version column, letting the administrator confirm the exact content release applied to a specific endpoint without opening its detail pane. This directly satisfies the requirement to verify the latest content version per endpoint, since the column reflects each agent's reported content build.

Why this answer

The Endpoints table displays the Content Version column for each managed endpoint.

Practice this question →
24
MCQeasy

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

A.BIOC Generator
B.Correlation Rules Builder
C.XQL Search
D.Query Builder for Syslog
AnswerC

XQL Search runs ad-hoc queries against Cortex XDR datasets, letting the administrator filter failed logon events across all endpoints for the last 24 hours. This satisfies the stem's constraint by providing flexible, immediate hunting rather than scheduled or dashboard-based reporting.

Why this answer

XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Practice this question →
25
MCQmedium

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

A.Click the alert in the Incident view, select Add Exception, and define criteria such as file hash or digital signature.
B.Downgrade the agent content version to a legacy release.
C.Delete the default BIOC profile and create an entirely new tenant policy.
D.Restart the Cortex XDR Agent service on each developer workstation.
AnswerA

Adding an exception directly from the alert lets you define precise matching criteria, such as file hash or digital signature, so the BIOC rule ignores only those known-good developer binaries. This satisfies the tuning requirement without authoring custom XQL exclusion queries.

Why this answer

Adding an exception directly from the alert in the Incident view allows the administrator to define precise criteria (e.g., file hash, digital signature) to exclude legitimate activity from triggering the BIOC. This is the most efficient method because it leverages the built-in exception mechanism without writing custom XQL queries. It also ensures the exception is scoped to the specific behavior, reducing false positives while maintaining security coverage.

Exam trap

XDR-Engineer often tests the tendency to choose overly broad or destructive solutions (like disabling the BIOC or downgrading) instead of the targeted exception mechanism that is built into the alert workflow.

How to eliminate wrong answers

Option B is wrong because downgrading the agent content version is a drastic measure that could introduce other issues and does not specifically address the false positive; it also affects all endpoints, not just the developers. Option C is wrong because deleting the default BIOC profile and creating a new tenant policy is overly broad and would disable many other detections, not just the one causing false positives. Option D is wrong because restarting the agent service does not change the detection logic and will not prevent the false positives from recurring.

Practice this question →
26
MCQhard

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

A.TCP port 389 and 636
B.TCP port 22 and 8080
C.TCP port 443
D.UDP port 514
AnswerC

TCP 443 outbound satisfies the firewall constraint because Cortex XDR agents transmit telemetry to the management console over TLS-encrypted HTTPS, which uses TCP 443. Permitting this port allows agent registration, heartbeat, and event uploads through restricted egress rules without exposing additional ports.

Why this answer

Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Practice this question →
27
Multi-Selectmedium

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Select 2 answers
A.Check that the Broker VM has direct SSH access to the endpoint.
B.Verify that UDP port 514 is listening locally on the endpoint.
C.Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.
D.Verify that outbound TCP port 443 traffic to the Cortex XDR tenant URL is not blocked by a firewall or security gateway.
E.Verify that inbound TCP port 22 is open on the endpoint for remote management.
AnswersC, D

Agent-to-console traffic traverses the local network path, so an incorrect or unauthenticated proxy silently drops outbound requests. Verifying proxy settings and profile credentials restores the agent's connection to the Cortex XDR cloud management console, satisfying the stem's communication-failure constraint.

Why this answer

Option C is correct because Cortex XDR agents often sit behind corporate proxies, so the administrator must confirm the endpoint's local proxy settings and ensure the agent profile contains valid proxy credentials (username/password or certificate) if the proxy requires authentication; otherwise the agent cannot reach the cloud. Option D is correct because the agent communicates with the Cortex XDR management console over outbound TCP 443 to the tenant-specific URL (e.g., <tenant>.xdr.<region>.paloaltonetworks.com), so any firewall, security gateway, or SSL-inspection device blocking that traffic will break communication. Option A is wrong because the Broker VM does not require SSH access to endpoints; it is used for local agent communication and log collection, not remote shell management.

Option B is wrong because UDP 514 is syslog, not a Cortex XDR agent communication channel, and the agent does not listen on it for cloud connectivity. Option E is wrong because inbound TCP 22 (SSH) is not needed for the agent to reach the cloud console and is unrelated to agent-cloud communication.

Exam trap

The trap is assuming the agent needs inbound ports or broker-initiated SSH; Cortex XDR agents are strictly outbound on TCP 443, and proxy misconfiguration is the most commonly overlooked cause of communication failure.

Practice this question →
28
MCQhard

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

A.The Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred.
B.The Correlation Rule requires the 'action_process_image_name' field to be normalized, but the data source does not populate this field.
C.The Correlation Rule's schedule is set to run every hour, but the query results are only retained for 30 minutes, causing the rule to miss the data.
D.The Correlation Rule uses a field that is not indexed, causing the rule to fail silently while manual queries use a different indexing mechanism.
AnswerA

Correlation Rules can be scoped to specific endpoint groups. If the rule is scoped to a group that does not contain the endpoints generating the activity, it will not trigger incidents even if the query returns results globally. The administrator should verify the rule's scope and ensure it includes all relevant endpoints. This is a common oversight when rules are created without adjusting the default scope.

Why this answer

The most likely cause is that the Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred. Even if the query returns results when run manually across all data, the rule only evaluates data from endpoints within its scope. The administrator should review the rule's scope settings and expand it to include the relevant endpoints.

Other options are less likely because they contradict the fact that the manual query returns results.

Exam trap

The trap here is assuming that because a manual query returns results, the Correlation Rule will automatically trigger, ignoring the rule's scope limitations.

Practice this question →
29
MCQhard

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

A.Restart the Cortex XDR management console service
B.Disable the agent's kernel-level protection and rely on user-mode monitoring
C.Rebuild the agent's kernel module against the new kernel version
D.Reinstall the Cortex XDR agent using the original installation package
AnswerC

Cortex XDR agents on Linux rely on a kernel module for deep visibility and protection. After a kernel upgrade, the existing module may not load because it was built for the previous kernel. Rebuilding the module against the new kernel headers restores compatibility. This directly addresses the incompatibility that caused the agents to stop reporting while processes still run.

Why this answer

On Linux, the Cortex XDR agent depends on a kernel module that must match the running kernel. A kernel upgrade can render the existing module unloadable, causing agents to stop reporting even though their processes run. Rebuilding the module against the new kernel headers restores the agent's kernel-level functionality and connectivity.

Exam trap

The trap here is assuming that running agent processes mean the agent is fully operational, when the kernel module may have failed to load after a kernel upgrade.

Practice this question →
30
MCQmedium

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

A.The Broker VM Log Collector service
B.The Broker VM Syslog Collector service
C.The Cortex XDR agent content update scheduler
D.The Cortex XDR management console database replication status
AnswerA

The Log Collector service is the Broker VM component responsible for receiving endpoint logs and forwarding them to Cortex XDR. If it is stopped or misconfigured, the Broker VM can still appear online in the console while telemetry silently stops flowing. Checking this service directly addresses the symptom of missing endpoint logs.

Why this answer

When a Broker VM is online but endpoint logs stop arriving, the first component to verify is the Log Collector service, which is responsible for receiving and forwarding endpoint telemetry. Other broker services handle different data types or unrelated functions, so they would not explain the absence of Cortex XDR agent logs.

Exam trap

The trap here is assuming that an online Broker VM status guarantees that all broker services, including the Log Collector, are healthy and forwarding data.

Practice this question →
31
MCQhard

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

A.syslog-test --handshake
B.telnet <siem_ip> 443 --secure
C.openssl s_client -connect <siem_ip>:<port>
D.ping -tls <siem_ip>
AnswerC

openssl s_client performs a TLS handshake against the specified host and port, confirming both network reachability and certificate negotiation with the SIEM listener. This isolates whether forwarding failures stem from connectivity, firewall rules or TLS mismatches.

Why this answer

The `openssl s_client -connect <siem_ip>:<port>` command is the correct tool because it initiates a full TLS handshake with the remote SIEM listener, verifying both network reachability (TCP connection) and TLS negotiation success. This directly addresses the administrator's need to confirm that the Broker VM can establish a secure channel to the SIEM over HTTPS Syslog. Unlike basic connectivity tests, it validates certificate exchange, protocol version, and cipher suite compatibility, which are critical for HTTPS-based syslog forwarding.

Exam trap

XDR-Engineer often tests the misconception that basic network tools like telnet or ping can verify TLS handshakes, when in fact only a dedicated TLS client like openssl s_client can validate certificate and cipher negotiation.

How to eliminate wrong answers

Option A is wrong because `syslog-test --handshake` is not a valid command on the Broker VM; Cortex XDR does not provide such a utility. Option B is wrong because `telnet <siem_ip> 443 --secure` is invalid syntax—telnet does not support a `--secure` flag and cannot perform TLS handshakes, only plaintext TCP connections. Option D is wrong because `ping -tls <siem_ip>` is nonsensical; ping uses ICMP and has no TLS capabilities, so it cannot test TLS handshake or even TCP port reachability.

Practice this question →
32
MCQhard

A Cortex XDR administrator is troubleshooting a Broker VM that is experiencing high CPU usage and is not processing logs from endpoints as expected. The administrator checks the Broker VM's system resources and finds that CPU usage is consistently above 90%. Which of the following is the MOST likely cause?

A.The Broker VM's disk is full, causing excessive CPU usage.
B.The Broker VM is running an outdated version of the Broker VM software.
C.The Broker VM is configured to collect logs from too many endpoints or data sources.
D.The Broker VM is under-provisioned and needs more CPU resources.
AnswerC

If the Broker VM is handling more endpoints or data sources than its capacity, CPU usage can spike. The Broker VM has sizing guidelines based on the number of endpoints. Exceeding those guidelines leads to performance degradation. Checking the configuration and comparing to recommended limits is a key troubleshooting step.

Why this answer

High CPU on a Broker VM often results from processing a volume of logs that exceeds its capacity. The Broker VM has documented sizing limits; exceeding them causes resource exhaustion. Checking the number of configured endpoints and data sources against the recommended limits is the most direct troubleshooting step.

Exam trap

The trap here is assuming that adding more CPU resources will solve the issue, when the root cause may be an overloaded configuration that exceeds the Broker VM's intended capacity.

Practice this question →
33
MCQhard

A Cortex XDR administrator is troubleshooting why a specific endpoint is not receiving updated policy settings from the Cortex XDR management console. The administrator confirms that the endpoint is online and the agent is running. The agent version is up to date. Which of the following should the administrator check FIRST to resolve this issue?

A.Verify that the endpoint is assigned to the correct policy in the Cortex XDR management console.
B.Check the endpoint's firewall to ensure it allows inbound connections from the Cortex XDR server.
C.Reinstall the Cortex XDR agent on the endpoint.
D.Restart the Cortex XDR agent service on the endpoint.
AnswerA

If the endpoint is not assigned to the correct policy, it will not receive the intended settings. Policy assignment is based on endpoint groups and rules. Checking the assignment is a logical first step because it is a common cause of policy not applying. The administrator should ensure the endpoint is in the right group and that the policy is applied to that group.

Why this answer

Policy assignment is a fundamental step in ensuring endpoints receive the correct settings. If an endpoint is not in the appropriate group or the policy is not applied to that group, it will not receive updates. Checking assignment is quick and non-disruptive, making it the best first step.

Exam trap

The trap here is jumping to restarting services or reinstalling the agent without first verifying that the endpoint is assigned to the correct policy group.

Practice this question →
34
Multi-Selectmedium

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Select 2 answers
A.Broker VM database corruption.
B.Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.
C.Lack of available disk space in the /boot partition of the endpoint.
D.Proxy authentication failures preventing the agent from downloading content packages.
E.Failure of the local endpoint DNS server to resolve Active Directory domain controllers.
AnswersB, D

Content updates are pulled from Content Delivery Network distribution domains over outbound HTTPS. If firewall rules block that traffic, endpoints in the secured segment cannot reach the CDN, so updates fail to download and apply.

Why this answer

Option B is correct because Cortex XDR agents retrieve content updates from Palo Alto Networks Content CDN distribution domains over outbound HTTPS (TCP 443), so firewall rules blocking that traffic will prevent updates from being applied to endpoints in the secured segment. Option D is correct because in environments where endpoints reach the internet through a proxy, the agent must authenticate to the proxy to download content packages; proxy authentication failures therefore directly cause content update failures. Option A is not correct because Broker VM database corruption affects Broker VM functions such as local agent communication and content caching, not the fundamental CDN download path described here.

Option C is not correct because insufficient space in the /boot partition does not block Cortex XDR content downloads; content is stored in the agent's content directories, not /boot. Option E is not correct because resolving Active Directory domain controllers is unrelated to downloading Cortex XDR content updates from the Content CDN.

Exam trap

The trap is chasing internal infrastructure causes (Broker VM, AD DNS, /boot disk) when content update failures are almost always egress-path problems — blocked HTTPS to CDN domains or proxy authentication — which the exam expects you to recognize as the two network-layer culprits.

Practice this question →
35
Multi-Selecthard

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Select 3 answers
A.Reinstall the Cortex XDR Agent on all high-priority servers.
B.Modify the Broker VM packet buffer size.
C.Create exceptions for known benign alerts to prevent them from inflating incident priority scores.
D.Modify individual BIOC or Analytics alert severities to reflect their true operational impact.
E.Configure Incident Scoring rules to adjust how individual alert weights contribute to overall incident severity.
AnswersC, D, E

Exceptions suppress known benign alerts so they no longer contribute weight to incident scoring, preventing false positives from inflating severity. This satisfies the misalignment constraint by removing noise that skews the aggregate score away from genuine organisational priority.

Why this answer

Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Practice this question →
36
MCQhard

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

A.Review the endpoint's local agent logs for script execution events.
B.Verify that the Behavioral Threat protection module is enabled in the agent policy.
C.Ensure the script's hash is not in the allow list.
D.Check the Cortex XDR management console for agent connectivity issues.
AnswerB

The Behavioral Threat protection module is responsible for detecting malicious script behavior. If it is disabled in the agent policy, no alerts will be generated. Checking the policy is the first step to ensure the module is active. This is a common misconfiguration that leads to missed detections.

Why this answer

Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Exam trap

The trap here is focusing on connectivity or allow lists, when the most common reason for missing behavioral alerts is that the module is disabled in the policy.

Practice this question →
37
MCQmedium

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

A.The Broker VM must be configured as a script relay server.
B.The endpoint must have WinRM enabled on TCP port 5985.
C.The endpoint must allow PowerShell script execution and the Cortex XDR agent service must be running with administrative privileges.
D.The user must be logged into an active GUI session.
AnswerC

PowerShell remediation scripts need an execution policy permitting script runs, and the agent service must hold administrative rights to launch processes in the endpoint's security context. Without both, Remote Actions returns failure regardless of network connectivity.

Why this answer

For a PowerShell remediation script to run successfully via Cortex XDR Remote Actions on a Windows endpoint, the endpoint must allow PowerShell script execution (e.g., ExecutionPolicy not restricted) and the Cortex XDR agent service must be running with administrative privileges. The agent service executes scripts in the context of the SYSTEM account, which requires admin rights.

Exam trap

The trap is assuming that WinRM or an active user session is needed for remote script execution. Cortex XDR uses its own agent channel, and scripts run as SYSTEM, so those conditions are irrelevant.

How to eliminate wrong answers

Option A is wrong because the Broker VM is not required as a script relay server for Remote Actions; the agent communicates directly with the Cortex XDR management console (or via Broker VM for certain features, but not as a script relay). Option B is wrong because WinRM is not required for Cortex XDR script execution; the agent uses its own communication channel. Option D is wrong because the script runs as a service, not in a user GUI session, so an active GUI session is not required.

Practice this question →
38
MCQmedium

A Cortex XDR administrator notices that the Cortex XDR agent on a Windows endpoint is not reporting any new events to the Cortex XDR management console for the past 24 hours, although the endpoint is online and other agents are reporting normally. The administrator verifies that the agent service is running. Which of the following is the MOST likely cause?

A.The agent is in a 'Disconnected' state due to a certificate mismatch with the Cortex XDR server.
B.The agent has exceeded its license limit and stopped reporting.
C.The agent's local database is corrupted and needs to be reset.
D.The agent's communication with the Cortex XDR server is blocked by a firewall or proxy.
AnswerD

If communication is blocked, the agent cannot send events to the server, resulting in no new events in the console. The agent service may still run, and the endpoint remains online, but the data never reaches the management console. This is a common troubleshooting step: verify network connectivity and proxy settings.

Why this answer

When an agent service is running but no events appear in the console, the most likely cause is a communication breakdown between the agent and the Cortex XDR server. This could be due to firewall rules, proxy misconfigurations, or network issues. Checking connectivity and proxy settings is a standard troubleshooting step.

Exam trap

The trap here is assuming that a running agent service guarantees successful communication with the Cortex XDR server, overlooking network or proxy blocks.

Practice this question →
39
MCQmedium

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

A.Delete and recreate the endpoint agent installation token.
B.Select the endpoint in Endpoints > All Endpoints and click Unisolate.
C.Reboot the endpoint twice in safe mode.
D.Run 'cytool set isolation disable' locally via command line.
AnswerB

Unisolate reverses the network containment applied to the endpoint, restoring its normal network communication after remediation. Selecting the endpoint under Endpoints > All Endpoints and clicking Unisolate removes the isolation policy, re-enabling connectivity without reimaging or re-enrolling the agent.

Why this answer

In Cortex XDR, isolation is a containment action that restricts network connectivity except to the management console. To restore connectivity after remediation, the administrator selects the endpoint in Endpoints > All Endpoints and clicks Unisolate. This action releases the isolation policy and restores normal network access.

Exam trap

XDR-Engineer often tests the confusion between isolation and other endpoint management actions, leading candidates to choose local commands or token operations instead of the console-based Unisolate action.

How to eliminate wrong answers

Option A is wrong because deleting and recreating the agent installation token affects agent enrollment, not isolation status. Option C is wrong because rebooting in safe mode does not remove the isolation policy; isolation is enforced by the agent and persists across reboots. Option D is wrong because 'cytool set isolation disable' is not a valid command; isolation is managed from the console, and local commands cannot override it without proper authorization.

Practice this question →
40
Multi-Selecthard

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Select 2 answers
A.Verify that the BIOC rule's condition syntax and field names match the actual event schema
B.Restart the Cortex XDR management console to force rule recompilation
C.Check that the endpoint agent has the required content version and policy to evaluate the BIOC rule
D.Change the rule's severity to Critical to ensure it generates an incident
E.Disable all other BIOC rules to isolate the non-triggering rule
AnswersA, C

BIOC rules rely on precise field names and syntax. If a field is misspelled or uses an incorrect data type, the rule will not match even when the behavior occurs. Validating the condition against the event schema ensures the logic aligns with the data Cortex XDR actually collects, making this a necessary diagnostic step.

Why this answer

When a BIOC rule does not trigger, the most common causes are incorrect condition syntax or field names and a mismatch between the rule and the agent's content or policy. Verifying the rule's logic against the event schema and confirming that the agent has the correct content and policy assignment are the two essential diagnostic steps.

Exam trap

The trap here is assuming that enabling a BIOC rule is sufficient for it to fire, without verifying that the rule syntax is valid and that the agent actually receives and evaluates it.

Practice this question →
41
MCQhard

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

A.macos-agent-check --status
B.systemextensionsctl list
C.kextstat | grep paloalto
D.cytool mac status
AnswerB

systemextensionsctl list enumerates installed system extensions and their approval state on macOS, revealing whether the Endpoint Security extension is awaiting user approval. This directly verifies approval status, which is the usual cause of the Cortex XDR kernel extension failing to load.

Why this answer

On macOS, system extensions (including Endpoint Security extensions) are managed by the systemextensionsctl command. Running 'systemextensionsctl list' displays all installed system extensions and their approval status, which is critical for diagnosing why a kernel extension might fail to start. This command is the correct local diagnostic tool for verifying system extension approval.

Exam trap

The trap is assuming that kernel extension commands like kextstat still apply, but macOS now uses system extensions, and the correct command is systemextensionsctl.

How to eliminate wrong answers

Option A is wrong because 'macos-agent-check --status' is not a standard macOS command; it may be a custom script but not the official diagnostic for system extensions. Option C is wrong because 'kextstat | grep paloalto' checks for loaded kernel extensions (kexts), but modern macOS uses system extensions instead of kexts for Endpoint Security, and kextstat may not show them; also, the Palo Alto agent uses a system extension, not a kext. Option D is wrong because 'cytool mac status' is not a valid command for checking system extension approval; cytool is a Cortex XDR tool but does not provide this specific status.

Practice this question →
42
MCQmedium

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

A.Disable the Broker VM's Syslog Collector to stop all log ingestion
B.Increase the Broker VM's disk size immediately
C.Delete the Broker VM and redeploy it with a larger disk
D.Review and adjust the Broker VM's log retention and rotation settings
AnswerD

High disk usage on a Broker VM is often caused by logs accumulating without proper rotation or retention limits. Reviewing and adjusting these settings can free space and prevent recurrence. This directly addresses the cause of disk pressure while preserving the ability to forward logs to the management console.

Why this answer

Excessive disk usage on a Broker VM is typically caused by log files that are not rotated or retained according to policy. Adjusting log retention and rotation settings reduces disk pressure and restores stable log forwarding. Increasing disk size or redeploying the VM treats the symptom rather than the cause and may be disruptive.

Exam trap

The trap here is jumping to add storage or redeploy the Broker VM instead of first checking log retention and rotation, which are common causes of disk exhaustion.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Troubleshooting questions.

Start 20-question session