When an agent is in a Disabled state, what happens to policy enforcement?

When a Cortex XDR agent is in a "Disabled" state, its security enforcement capabilities are completely turned off. This means that no prevention policies, including those for malware, exploits, and restrictions, are enforced on the endpoint. This state is typically used for troubleshooting compatibility issues with other software. While the agent stops all protection and data collection, it maintains communication with the Cortex XDR console for management purposes, such as re-enabling it.

A. Prevention and extension policies are fully applied: This is incorrect. The purpose of the disabled state is to stop policy enforcement.
B. Only malware prevention policies are active: This is incorrect. All prevention capabilities, not just a subset, are disabled.
D. Extension profiles remain active: This is incorrect. Extensions like Device Control and Host Firewall are part of the prevention policy and are also disabled.

1. Palo Alto Networks, "Cortex XDR Agent Administrator's Guide," Section: Endpoints -> Endpoint Administration -> Disable the Cortex XDR Agent. The documentation explicitly states, "When you disable the Cortex XDR agent, the agent stops all protection and data collection capabilities but continues to communicate with Cortex XDR." This directly confirms that no prevention policies are enforced.

2. Palo Alto Networks, "Cortex XDR Administrator's Guide," Section: Action Center. The description for the "Disable Agent" action confirms that it temporarily disables the agent's security functions on the endpoint.