SecOps ProDemo

By Palo Alto Networks · Question Mode

QuestionQ27

Cortex XDR

For a Windows endpoint, what is necessary to remove the Cortex XDR agent when the endpoint is no longer online and cannot be managed directly through the management console?

  • A A Cortex XDR administrator must provide the end user with an offline removal tool created in the management console.
  • B When running the uninstaller, the administrator must enter an uninstall password from the management console.
  • C An administrator must use Cytool to disable security protection on the endpoint with an uninstall password.
  • D An administrator must disable the agent by opening the agent console from the system tray and entering a password.
Explanation

For an offline Windows endpoint, the Cortex XDR agent’s security protection must be disabled locally with Cytool protect disable before removal. This operation requires the uninstall password; an offline endpoint cannot receive an Agent Settings profile from the management console. Palo Alto Networks documents Cytool as the local method to disable protection before a manual Windows-agent uninstall.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!