What happens when the XDR Collector is uninstalled from an endpoint by using the Cortex XDR console?

Question

Options

• AThe files are removed immediately, and the machine is deleted from the system without any
• BThe machine status remains active until manually removed, and the configuration data is retained
• CIt is uninstalled during the next heartbeat communication, machine status changes to Uninstalled,
• DThe associated configuration data is removed from the Action Center immediately after

• A
  5% (1)
• C
  95% (18)

Explanation

Option C is correct because Cortex XDR uses a heartbeat-based communication model - the uninstall command is queued and only executed when the endpoint next checks in with the console. After that check-in, the agent is removed and the machine's status updates to Uninstalled, while the configuration data is preserved for audit and historical reference.

Why the distractors are wrong:

• A is wrong because neither the files nor the machine record are removed immediately - the process is deferred to the next heartbeat, and the machine entry persists in the console.
• B is wrong in implying the status stays Active; it does not remain active after uninstallation - it transitions specifically to Uninstalled, not a generic "active" state.
• D is wrong because configuration data is not removed from the Action Center immediately after uninstallation; data is retained, not purged on removal.

Memory tip: Think "heartbeat = handshake." Just like a door can only be locked when someone is home to hear the knock, the XDR Collector can only be uninstalled when it's online to receive the command. The console keeps the record (status + config) so admins always have a paper trail.

No community discussion yet for this question.