For a Cortex XDR agent to successfully use a Broker VM for content updates, two key configurations are required. First, the agent must be instructed where to look for the updates. This is configured within an Agent Settings profile in the Cortex XDR management console, where the Broker VM's address is specified as a download source. Second, for the connection to be secure and reliable, the Broker VM must be identified by a Fully Qualified Domain Name (FQDN). This is critical for proper TLS certificate validation, as Palo Alto Networks recommends using the FQDN in the certificate's Common Name (CN) to prevent security errors that would block a successful connection.

A. The Device Configuration profile is used for managing device control settings (e.g., USB access), not for configuring content update download sources.

D. The XDR agent does not use a machine certificate for authentication to the Broker VM for content downloads. The connection is secured by the agent validating the Broker VM's server-side TLS certificate.

1. Palo Alto Networks, Cortex XDR Administrator's Guide. In the section "Set Up a Broker VM as a Download Source," the guide explicitly states, "In an Agent Settings profile, configure the Cortex XDR agent to use the Broker VM as a download source." This directly supports answer B.

2. Palo Alto Networks, Broker VM Administrator's Guide. The section "Configure the Broker VM" details the certificate configuration. It states, "To avoid certificate errors, Palo Alto Networks recommends that you use the FQDN of the Broker VM as the Common Name (CN) for the certificate." A successful connection requires valid certificate trust, making the FQDN a practical requirement, thus supporting answer C.