What is the purpose of using rolling tokens to manage Cortex XDR agents?

Rolling tokens, referred to as "temporary agent passwords" in Cortex XDR documentation, are generated on-demand from the management console to provide time-limited authorization for administrative actions on an endpoint. Their primary purpose is to enable secure management tasks, such as using the Cytool command-line utility to disable protection or uninstall the agent, without relying on a static, long-lived password. This enhances security by preventing the misuse of a persistent credential and ensuring that administrative access is granted only for a specific, temporary period.

A: Encryption key rotation for tenant communication is a core platform function managed by the backend, not by agent-level administrative tokens.

C: Agents authenticate for content updates using their established secure communication channel with the Cortex XDR tenant, not temporary administrative tokens.

D: While a rolling token can be used to disable an agent, this is just one of many possible administrative actions; it is not the token's sole or primary purpose.

1. Palo Alto Networks. (2024). Cortex XDR Administrator’s Guide. Section: "Agent Administration". In the subsection "Generate a Temporary Agent Password", the documentation states, "To perform administrative actions on an endpoint, such as uninstalling the agent or stopping agent services, you must provide a password. To avoid using the uninstall password, which is static, you can generate a temporary password that is valid for a limited time."

2. Palo Alto Networks. (2024). Cortex XDR Administrator’s Guide. Section: "Use Cytool to Perform Actions on the Agent". This section details various administrative commands (e.g., cytool protect disable, cytool runtime stop) that require a password, for which the temporary password (rolling token) is the recommended secure option.