Question 25

Question

What does the Protected state indicate for a Cortex XDR agent?

Accepted Answer

The agent is enforcing prevention and extension policies

Nathan I. · Answer

I don’t think it’s A. Option B is right since 'Protected' means the agent is fully enforcing prevention and extension policies, not just installed or sending logs. At least that's what the XDR docs and lab sims show. Anybody disagree?

AveryV · Answer

A is wrong, it's actually D. If the agent is just sending audit logs but not actually enforcing policies, I think it still might show as Protected in certain audit-only deployments. Seen some odd edge cases in practice labs where policy enforcement was off but logs still went up.

DirectNeteng223 · Answer

Probably B. In exam reports, 'Protected' is when the agent is active and actually enforcing security policies. Not super sure but that's what I've seen come up.

Mason T. · Answer

Pretty sure it's B. Protected means the agent is active and actually applying prevention policies on the endpoint.

LiamK · Answer

D tbh

Palo Alto Networks XDR-Analyst Real Exam Questions [October 2026 Update] Quiz

What does the Protected state indicate for a Cortex XDR agent?

Premium Access Includes