When isolating Cortex XDR agent components to troubleshoot for compatibility, which command is used to turn off a component on a Windows machine?

Question

Options

• A"C:\Program Files\Palo Alto Networks\Traps\xdr.exe" stop
• B"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime stop
• C"C:\Program Files\Palo Alto Networks\Traps\xdr.exe" -s stop
• D"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" occp

• A
  2% (1)
• B
  92% (48)
• C
  4% (2)
• D
  2% (1)

Explanation

cytool.exe with the runtime stop subcommand is the correct tool for disabling individual Cortex XDR agent components on Windows - cytool is Palo Alto's dedicated command-line utility designed specifically for agent management, diagnostics, and component-level control, making runtime stop the proper syntax for toggling components off during compatibility troubleshooting.

Option A and C are wrong because xdr.exe is the agent executable itself, not a management utility - it doesn't accept stop or -s stop as valid troubleshooting arguments. Option D is wrong because occp is not a valid cytool subcommand; it appears to be a fabricated option to test whether you know the real syntax.

Memory tip: Think "CYtool TOOLs the runtime" - cytool is your cybersecurity tool, and runtime stop literally stops a component at runtime. If you remember that cytool = control/management and runtime = live component state, the correct syntax locks in naturally.

No community discussion yet for this question.