Exam PCDRA topic 1 question 91 discussion

If you want to prevent Cortex XSIAM from initiating Live Terminal remote sessions on an endpoint running the Cortex XDR agent, you can disable this capability during agent installation or later on through Cortex XSIAM Endpoint Administration.

D is also the most logical answer. A would mean the user could disable it which defeats the purpose

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.