6.2 Demonstrate Knowledge of Troubleshooting Cortex Cloud Workload Components (e.g., Agents / Connectors, Connectivity Issues) CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator is troubleshooting a Cortex Cloud Workload agent on a Linux VM that shows 'Disconnected' in the console. The agent was working previously. The administrator runs `curl -v https://api.cortex.paloaltonetworks.com` from the VM and receives a response. However, the agent still cannot connect. What should the administrator check next?

   • ACheck the agent's configuration file for the correct data plane endpoint, which may be different from the API endpoint.
   • BRestart the agent service to force it to re-register with the Cortex Cloud Workload service.
   • CVerify that the agent's registration token is still valid and has not expired.
   • DVerify that the VM's clock is synchronized with an NTP server, as time skew can cause TLS handshake failures.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A DevOps engineer is installing the Cortex Cloud Workload agent on a Kubernetes node. The installation script completes successfully, but the agent does not appear in the console. The engineer checks the agent logs and sees 'Failed to register with the Cortex Cloud Workload service. HTTP 403 Forbidden'. What is the most likely cause of this error?

   • AThe agent is running in a container that does not have the necessary kernel modules loaded.
   • BThe agent's configuration file specifies the wrong data plane endpoint.
   • CThe Kubernetes node does not have outbound internet access.
   • DThe agent's registration token is invalid or has been revoked.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key source of diagnostic data for troubleshooting a Cortex Cloud Workload agent issue?

   • ACloud provider billing reports
   • BAgent logs
   • CNetwork firewall logs
   • DCloud provider API logs
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is troubleshooting the AWS connector for Cortex Cloud Workload. The connector status shows 'Error' and the error message states 'AccessDenied'. The team has verified that the IAM role used by the connector has the required permissions. What should the team check next?

   • ACheck that the IAM role has the 'sts:AssumeRole' permission.
   • BVerify that the IAM role's trust policy allows the connector's service principal to assume the role.
   • CVerify that the AWS region is supported by Cortex Cloud Workload.
   • DCheck that the connector is using the correct AWS account ID.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security administrator is investigating a Cortex Cloud Workload agent that is showing 'Unhealthy' in the console. The agent is connected, but the console shows that the agent has not sent telemetry data in the last 30 minutes. The administrator checks the agent logs and finds repeated 'Error 0x80072EFD' messages. What is the most likely cause of this issue?

   • AThe agent does not have sufficient permissions to access the Windows event log.
   • BThe agent's registration token has expired, and it needs to be re-registered.
   • CThe agent's data plane endpoint is unreachable due to a network connectivity issue.
   • DThe agent's configuration file specifies an incorrect API endpoint.
   Reveal Solution Discussion Select an answer first