TheXDR Collectoris a lightweight agent in Cortex XDR used to collect logs and events from endpoints or servers. When uninstalled via the Cortex XDR console, the uninstallation process is initiated remotely, but the actual removal occurs during the endpoint’s next communication with the Cortex XDR tenant, known as theheartbeat. The heartbeat interval is typically every few minutes, ensuring timely uninstallation. After uninstallation, the machine’s status in the console updates, and associated configuration data is retained for a specific period to support potential reinstallation or auditing.
Correct Answer Analysis (C):When the XDR Collector is uninstalled using the Cortex XDR console,it is uninstalled during the next heartbeat communication, themachine status changes to Uninstalled, and theconfiguration data is retained for 90 days. This retention period allows administrators to review historical data or reinstall the collector if needed, after which the data is permanently deleted.
Why not the other options?
A. The files are removed immediately, and the machine is deleted from the system without any retention period: Uninstallation is not immediate; it occurs at the next heartbeat. Additionally, Cortex XDR retains configuration data for a period, not deleting it immediately.
B. The machine status remains active until manually removed, and the configuration data is retained for up to seven days: The machine status updates to Uninstalled automatically, not requiring manual removal, and the retention period is 90 days, not seven days.
D. The associated configuration data is removed from the Action Center immediately after uninstallation: Configuration data is retained for 90 days, not removed immediately, and the Action Center is not the primary location for this data.
Exact Extract or Reference:
TheCortex XDR Documentation Portalexplains XDR Collector uninstallation: “Whenuninstalled via the console, the XDR Collector is removed at the next heartbeat, the machine status changes to Uninstalled, and configuration data is retained for 90 days” (paraphrased from the XDR Collector Management section). TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers collector management, stating that “uninstallation occurs at the next heartbeat, with a 90-day retention period for configuration data” (paraphrased from course materials). ThePalo Alto Networks Certified XDR Engineer datasheetincludes “post-deployment management and configuration” as a key exam topic, encompassing XDR Collector uninstallation.
[References:, Palo Alto Networks Cortex XDR Documentation Portal:https://docs-cortex.paloaltonetworks.com/, EDU-260: Cortex XDR Prevention and Deployment Course Objectives, Palo Alto Networks Certified XDR Engineer Datasheet:https://www.paloaltonetworks.com/services/education/certification#xdr-engineer, ]
