Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA - Cortex XDR) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
If you want to prevent Cortex XSIAM from initiating Live Terminal remote sessions on an endpoint running the Cortex XDR agent, you can disable this capability during agent installation or later on through Cortex XSIAM Endpoint Administration.
D is also the most logical answer. A would mean the user could disable it which defeats the purpose
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.