Exam XDR-Engineer Topic 3 Question 18 Discussion

Cortex XDR agents on Windows include multiple components (e.g., for exploit protection, malware scanning, or behavioral analysis) that can be individually enabled or disabled for troubleshooting purposes, such as isolating compatibility issues. Thecytool.exeutility, located in the Cortex XDR installation directory (typically C:\Program Files\Palo Alto Networks\Traps\), is used to manage agent components and settings. The runtime stop command specifically disables a component without uninstalling the agent.
* Correct Answer Analysis (B):The command"C:\Program Files\Palo Alto Networks\Traps\cytool.
exe" runtime stopis used to turn off a specific Cortex XDR agent component on a Windows machine.
For example, cytool.exe runtime stop protection would disable the protection component, allowing troubleshooting for compatibility issues while keeping other components active.
* Why not the other options?
* A. "C:\Program Files\Palo Alto Networks\Traps\xdr.exe" stop: The xdr.exe binary is not used for managing components; it is part of the agent's corefunctionality. The correct utility is cytool.exe.
* C. "C:\Program Files\Palo Alto Networks\Traps\xdr.exe" -s stop: Similarly, xdr.exe is not the correct tool, and -s stop is not a valid command syntax for component management.
* D. "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" occp: The occp command is not a valid cytool.exe option. The correct command for stopping a component is runtime stop.
Exact Extract or Reference:
TheCortex XDR Documentation Portalexplains component management: "To disable a Cortex XDR agent component on Windows, use the command cytool.exe runtime stop <component> from the installation directory" (paraphrased from the Troubleshooting section). TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers agent troubleshooting, stating that "cytool.exe runtime stop is used to turn off specific components for compatibility testing" (paraphrased from course materials). ThePalo Alto Networks Certified XDR Engineer datasheetincludes "maintenance and troubleshooting" as a key exam topic, encompassing agent component management.
References:
Palo Alto Networks Cortex XDR Documentation Portal:https://docs-cortex.paloaltonetworks.com/ EDU-260: Cortex XDR Prevention and Deployment Course Objectives Palo Alto Networks Certified XDR Engineer Datasheet:https://www.paloaltonetworks.com/services/education
/certification#xdr-engineer