5.1 Manage Cortex XDR Software Component Updates (e.g., Content, Agents, Collectors, Broker VM) XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A large enterprise has a mixed environment with Cortex XDR agents on Windows 10, Windows Server 2019, and Linux. They need to update agents to a new version that requires a minimum OS version. The Windows 10 devices are on an older build that does not meet the minimum. What should the administrator do?

   • AUpdate all agents anyway, assuming the OS requirement is a recommendation.
   • BRoll back the agent version on all devices to maintain consistency.
   • CUpdate the Windows 10 devices to a supported OS build first, then proceed with the agent update.
   • DSkip the agent update on Windows 10 devices and only update Windows Server and Linux.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center uses Cortex XDR Collectors to ingest logs from multiple sources. They need to update a Collector to a new version, but they cannot afford any gap in data collection. What should they do to ensure continuity?

   • ADeploy a second Collector in parallel, then switch over after the update is verified.
   • BStop the Collector, update it, and then restart it.
   • CUpdate the Collector without stopping it, assuming the update process handles it automatically.
   • DUpdate the Collector during a maintenance window when data sources are also offline.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Collector update fails during installation. The Collector is now in an inconsistent state and is not forwarding logs. What should the administrator do first?

   • AUninstall the Collector and reinstall the latest version.
   • BRestart the Collector service and check if it resumes normal operation.
   • CIgnore the failure and wait for the next update cycle.
   • DReboot the host machine that runs the Collector.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   After deploying a content update to endpoints, what is the primary method to verify that the update was successfully applied?

   • AReboot all endpoints to force the update to take effect
   • BReview the Content Update Status in the Endpoint Security profile
   • CRun a manual scan on each endpoint to confirm detection capabilities
   • DCheck the endpoint's local event log for update entries
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Before applying a Cortex XDR agent update, what should an administrator check to ensure compatibility with existing components?

   • AThe number of endpoints in the environment
   • BThe network bandwidth available for downloading the update
   • CThe agent update's release notes for supported OS versions and integration requirements
   • DThe endpoint's CPU usage to ensure it can handle the update
   Reveal Solution Discussion Select an answer first