Before initiating a malware scan action on a Linux workstation, an engineer notices that the Cortex XDR agent's operational status on the workstation…

The "Partially Protected" operational status for a Cortex XDR agent on a Linux endpoint indicates that the agent is running but one or more of its core protection capabilities are malfunctioning or disabled. A primary cause for this is the failure of the agent's required kernel modules to load, which often occurs after an operating system kernel update to a version not yet supported by the installed agent. Another common reason is that the agent version itself is outdated. The Cortex XSIAM management console may flag older agents as partially protected because they lack the latest security features, bug fixes, or compatibility required for full protection as defined by current policies.

A. The Linux endpoint is currently running 4.0 kernel version.

This option states a condition but is not the direct explanation for the status. The problem is the incompatibility with the kernel, not the version number itself.

D. The agent was manually disabled on the endpoint by the user or an administrator.

If the agent were manually disabled, its operational status would report as "Disabled," not "Partially Protected."

1. Palo Alto Networks Cortex XDR Agent Administrator's Guide: In the section "View Endpoint Details," the "Partially protected" status is described. For Linux, it explicitly states: "On Linux endpoints, this status can indicate that the kernel modules for the agent are not loaded." This directly supports option B.

2. Palo Alto Networks Cortex XDR Agent Administrator's Guide: The section "Troubleshoot the Cortex XDR Agent for Linux" details how to verify the agent's health. It notes that running cytool status can reveal if kernel modules are unloaded, which is a common reason for a partially protected state. This reinforces the reasoning for option B.

3. Palo Alto Networks Cortex XDR Agent Release Notes (General Principle): Release notes for Cortex XDR agents consistently detail supported and unsupported versions. Management consoles like XSIAM are designed to identify endpoints running outdated or unsupported agent versions that cannot receive the latest content or policy enforcements, thereby rendering them not fully protected. This principle supports option C as a valid reason for the status.