Maintenance And Troubleshooting practice questions

TOKEN=<token_value>

Why wrong: TOKEN is not the correct property name for the installer.

REGISTER_ID=<token_value>

Why wrong: REGISTER_ID is a fictional property name.

XDR_KEY=<token_value>

Why wrong: XDR_KEY is not recognized by the Cortex XDR Windows installer.

cortex_cli.sh

Why wrong: cortex_cli.sh does not exist as an endpoint control utility.

traps_control.exe

Why wrong: traps_control.exe is a legacy Traps command-line utility replaced by cytool in modern Cortex XDR releases.

xdr_agent_mgr.exe

Why wrong: xdr_agent_mgr.exe is a fictional utility name not used by Palo Alto Networks.

Go to XQL Search using dataset = broker_vm_logs.

Why wrong: XQL is for querying logs, but the management UI provides direct hardware/service health status under Settings.

Go to Dashboards > Broker VM Performance.

Why wrong: While widgets can be created, the dedicated management pane for Broker VMs is under Settings > Configurations.

Go to Endpoint Management > Broker VM.

Why wrong: Broker VMs manage log collection and are not listed under endpoint management.

TCP port 389 and 636

Why wrong: Ports 389 and 636 are used for LDAP and LDAPS directory services.

TCP port 22 and 8080

Why wrong: SSH (port 22) and HTTP (port 8080) are not standard agent reporting ports.

UDP port 514

Why wrong: UDP port 514 is standard for syslog, not Cortex XDR agent telemetry.

Go to Incident Response > Investigations.

Why wrong: Investigation views are used for analyzing security incidents and alerts, not endpoint administrative health.

Go to Dashboards > Agent Health widget.

Why wrong: While Dashboards provide aggregate metrics, they do not provide the detailed sync timestamp view per endpoint needed for troubleshooting.

Go to Settings > Configurations > Agent Management.

Why wrong: This area is used to configure installation packages and default profiles, not to check individual endpoint sync statuses.

Disable behavioral threat protection globally.

Why wrong: Disabling a module globally lowers overall security posture and is not best practice for a single application exception.

Create a correlation rule to suppress alerts from that path.

Why wrong: Correlation rules suppress alerts, but they do not stop local agent prevention modules from blocking an executable.

Modify the Broker VM ingestion filter.

Why wrong: Broker VM filters handle network log collection, not endpoint prevention enforcement.

CortexDebug.etl

Why wrong: CortexDebug.etl is used for deep packet or performance profiling traces, not the standard install logs.

TrapsConfig.xml

Why wrong: TrapsConfig.xml stores agent configuration settings, not execution or installation logs.

AgentService.dmp

Why wrong: AgentService.dmp is generated only if the agent service crashes unexpectedly.

pan_broker_status --syslog

Why wrong: pan_broker_status is not a valid standard Broker VM CLI troubleshooting command.

traceroute -syslog

Why wrong: traceroute is used to map the network path to a destination, not for checking local listening ports.

systemctl check-syslog

Why wrong: systemctl check-syslog is not a valid systemctl argument for checking service ports.

Downgrade the agent content version to a legacy release.

Why wrong: Downgrading content versions leaves endpoints vulnerable to known exploits and is not a valid tuning method.

Delete the default BIOC profile and create an entirely new tenant policy.

Why wrong: Deleting default profiles is unnecessary and disrupts security policies for all other endpoints.

Restart the Cortex XDR Agent service on each developer workstation.

Why wrong: Restarting services does not change alert generation rules or tune BIOC sensitivity.

pan_status --all

Why wrong: pan_status is not a native Broker VM shell command.

broker-vm status-collector

Why wrong: broker-vm is not a valid CLI binary on the Broker VM.

service broker status

Why wrong: 'service broker status' is not the correct syntax for Broker VM service verification.

cytool diag package

Why wrong: cytool diag package does not exist.

cytool support export

Why wrong: cytool support export is an incorrect syntax.

cytool dump-all

Why wrong: cytool dump-all is not a valid command argument.

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Why wrong: Traps.properties is not the mechanism for configuring proxy routing in Cortex XDR agents.

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Why wrong: Manual registry editing does not scale and is prone to errors; profiles should be managed centrally.

Configure the proxy settings on the Broker VM only.

Why wrong: Broker VM proxies do not configure endpoint agent internet traversal.

Settings > Content Updates > Status.

Why wrong: Settings shows tenant-wide content release versions, not per-endpoint deployment status.

Incident Response > Endpoint Inventory.

Why wrong: Endpoint Inventory is not a standard navigation path in Cortex XDR.

Dashboards > Content Health.

Why wrong: Dashboards provide summary graphs, not individual endpoint inventory details.

BIOC Generator

Why wrong: BIOC Generator is used to create behavioral rules, not to execute ad-hoc searches.

Correlation Rules Builder

Why wrong: Correlation rules automate incident generation over time, not ad-hoc investigations.

Query Builder for Syslog

Why wrong: Syslog Query Builder is not a Cortex XDR console tool.

Dashboards > Executive Summary.

Why wrong: Executive dashboards show high-level charts, not real-time API connector latency or error logs.

Incident Response > Queue Manager.

Why wrong: Incident Response has no Queue Manager view.

Endpoint Management > Collector Health.

Why wrong: Endpoint management applies to agents, not cloud data collectors.

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Why wrong: Manual compilation is neither required nor supported for Broker VM upgrades.

Re-deploy a new Broker VM virtual appliance and delete the old one.

Why wrong: Re-deploying is unnecessary as built-in console upgrade features handle the update seamlessly.

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.

Why wrong: Standard OS package managers are not used to upgrade proprietary Broker VM application images.

Delete and recreate the endpoint agent installation token.

Why wrong: Deleting tokens does not lift isolation on an active agent.

Reboot the endpoint twice in safe mode.

Why wrong: Rebooting does not remove network isolation rules enforced by the agent policy.

Run 'cytool set isolation disable' locally via command line.

Why wrong: Isolation is enforced by the cloud policy and requires console authorization to lift, though emergency local token options exist, the standard procedure is via the console.

The Broker VM must be configured as a script relay server.

Why wrong: Broker VMs do not relay remote action scripts to endpoints; communication is direct between cloud and agent.

The endpoint must have WinRM enabled on TCP port 5985.

Why wrong: Cortex XDR remote actions run locally via the agent framework without requiring WinRM configuration.

The user must be logged into an active GUI session.

Why wrong: Remote actions can run on endpoints even when no user is logged in (e.g., system context).

/var/log/messages

Why wrong: /var/log/messages records kernel and general system events, not application-specific broker parsing errors.

/var/log/secure

Why wrong: /var/log/secure tracks authentication and SSH access attempts.

/opt/panw/broker/cortex.log

Why wrong: This path is fictional; Broker VM logs follow structured paths under /var/log/pan/.

Disable the Anti-Malware module.

Why wrong: Disabling modules stops protection but does not remove the endpoint record or free the license.

Move the endpoint to an unmanaged folder.

Why wrong: Moving endpoints between folders does not release the assigned license.

Run 'cytool license release' via remote action.

Why wrong: Licenses are managed by the cloud console inventory, not released via local cytool commands.