Palo Alto Networks XDR-Engineer Exam - Topic 4 Question 1 Discussion

Actual exam question for Palo Alto Networks's XDR-Engineer exam

Question #: 1
Topic #: 4

[Cortex XDR Agent Configuration]

Multiple remote desktop users complain of in-house applications no longer working. The team uses macOS with Cortex XDR agents version 8.7.0, and the applications were previously allowed by disable prevention rules attached to the Exceptions Profile "Engineer-Mac." Based on the images below, what is a reason for this behavior?

AEndpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range

BThe Cloud Identity Engine is disconnected or removed

CXDR agent version was downgraded from 8.7.0 to 8.4.0

DInstallation type changed from VDI to Kubernetes

Show Suggested Answer

Suggested Answer: A

by Roslyn at Jun 12, 2025, 08:43 PM

Limited Time Offer

25%

Off

Get Premium XDR-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Louis

2 months ago

Downgrading the XDR agent might also cause problems.

upvoted 0 times

...

Martha

2 months ago

Not sure about that, seems a bit off to me.

upvoted 0 times

...

Nilsa

2 months ago

Definitely agree, that makes sense!

upvoted 0 times

...

Beckie

3 months ago

Wait, could it really be the Cloud Identity Engine?

upvoted 0 times

...

Macy

3 months ago

I think the IP address change could be the issue.

upvoted 0 times

...

Marcelle

3 months ago

Changing the installation type sounds familiar, but I can't remember if that would directly affect the applications. It feels like it could be a factor.

upvoted 0 times

...

Rozella

3 months ago

I vaguely recall a practice question about downgrading the XDR agent version. Could that really impact the exceptions profile?

upvoted 0 times

...

Reta

4 months ago

I think we discussed the Cloud Identity Engine in class. If it's disconnected, it might cause problems with user authentication, right?

upvoted 0 times

...

Marti

4 months ago

I remember something about how changes in IP address could affect application access, but I'm not sure if that's the main issue here.

upvoted 0 times

...

Patrick

4 months ago

The Kubernetes installation type is an interesting possibility. I'll need to understand how that might impact the in-house applications and their interaction with the Cortex XDR agent.

upvoted 0 times

...

Glenna

4 months ago

Based on the version information, I'm wondering if there was an agent downgrade that caused the compatibility issues. I'll look into the release notes to see if that could be the explanation.

upvoted 0 times

...

Kiley

4 months ago

I'm a bit confused by the mention of the Cloud Identity Engine. I'll need to research that component and how it might be related to the application problems.

upvoted 0 times

...

Flo

5 months ago

Hmm, the IP address change seems like the most obvious culprit here. I'll double-check the network configuration details to see if that's the case.

upvoted 0 times

...

Claudia

5 months ago

This looks like a tricky one. I'll need to carefully review the information provided and the possible answers to determine the most likely reason for the application issues.

upvoted 0 times

...

Harrison

7 months ago

I'm going to go with the IP address change. It's the most straightforward explanation, and the 'Engineer-Mac' Exceptions Profile should have protected the apps from any other changes.

upvoted 0 times

Wei

6 months ago

B) The Cloud Identity Engine is disconnected or removed

upvoted 0 times

...

Wei

6 months ago

A) Endpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range

upvoted 0 times

...

Anglea

7 months ago

Installation type changing from VDI to Kubernetes? That's a bit of a stretch, don't you think? I bet the IT team is just having a 'Kubernetes day' and trying to blame it on that.

upvoted 0 times

...

Jaime

7 months ago

Downgrading the XDR agent version from 8.7.0 to 8.4.0 would be my guess. Those version changes can sometimes break compatibility with certain apps.

upvoted 0 times

...

Barbra

7 months ago

Hmm, the Cloud Identity Engine being disconnected or removed could definitely cause this problem. I wonder if the IT team forgot to update the configuration after making that change.

upvoted 0 times

...

Georgene

8 months ago

The endpoint IP address change from 192.168.0.0 to 192.168.100.0 range seems like the most likely reason. The applications were previously allowed by the Exceptions Profile, so that shouldn't be the issue.

upvoted 0 times