XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ6

VerifiedMaintenance and Troubleshooting

Before starting a malware scan on a Linux workstation, an engineer observes that the Cortex XDR agent's operational status is reported as "partially protected." No configuration changes have been made from the Cortex XSIAM server.

What are two possible explanations for this operational status?

Choose two
Explanation

For Linux, Cortex XDR reports a partially protected state when protection exceptions include an incompatible kernel version or a kernel module that is not loaded. An unsupported Linux 4.0 kernel can prevent the required kernel-module-based protections from operating, and kernel modules can fail to load when the kernel version is unsupported. A disabled agent is reported as unprotected rather than partially protected.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!