5.1 Manage Cortex XDR Software Component Updates (e.g., Content, Agents, Collectors, Broker VM) XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   If a Cortex XDR component update causes issues, what is the general rollback procedure?

   • AUninstall the component and leave it uninstalled until a fix is available
   • BApply the update again to overwrite any corrupted files
   • CContact support and wait for a patch without taking any action
   • DReinstall the previous version from a backup or use the rollback option in the console
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the first step in updating a Cortex XDR Collector?

   • AStop the Collector service to prevent data loss
   • BUninstall the existing Collector to avoid conflicts
   • CDownload the new Collector package from the Cortex XDR console
   • DReboot the Collector host to prepare for the update
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An administrator is rolling out a new agent version to 10,000 endpoints. After updating 1,000 endpoints, they notice a spike in CPU usage on those endpoints. The administrator needs to continue the rollout but wants to avoid further issues. What should they do?

   • AContinue the rollout to all remaining endpoints to finish quickly.
   • BExclude the affected endpoints from future updates.
   • CPause the rollout, investigate the CPU spike, and then decide whether to continue or roll back.
   • DRoll back all endpoints to the previous version immediately.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a Broker VM that is critical for traffic analysis. They need to update the Broker VM software, but they also have a strict requirement that traffic analysis must not be interrupted. What is the best approach?

   • AUpdate the Broker VM during a maintenance window and accept a brief interruption.
   • BDeploy a second Broker VM in parallel, update the original, and then switch back.
   • CUpdate the Broker VM without stopping it, assuming the update is seamless.
   • DSkip the update until a future maintenance window.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A content update fails to deploy to a subset of agents. The agents are online, and the update policy is correctly configured. The administrator notices that these agents are running an older version that is not compatible with the content update. What is the best course of action?

   • AForce the content update to deploy anyway.
   • BExclude the incompatible agents from the update policy.
   • CUpdate the agents to a compatible version first, then deploy the content update.
   • DRoll back the content update to a previous version.
   Reveal Solution Discussion Select an answer first