Palo Alto Networks XDR-Engineer Exam Questions Instant Access

Question 1

[Detection Engineering]

During a recent internal purple team exercise, the following recommendation is given to the detection engineering team: Detect and prevent command line invocation of Python on Windows endpoints by non-technical business units. Which rule type should be implemented?

AAnalytics Behavioral Indicator of Compromise (ABIOC)

BBehavioral Indicator of Compromise (BIOC)

CCorrelation

DIndicator of Compromise (IOC)

Answer : B

Question 2

[Maintenance and Troubleshooting]

A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center. Which available column should be checked to determine how many compute units will be used when the query is run?

AQuery Status

BCompute Unit Usage

CSimulated Compute Units

DCompute Unit Quota

Answer : B

Question 3

[Maintenance and Troubleshooting]

When isolating Cortex XDR agent components to troubleshoot for compatibility, which command is used to turn off a component on a Windows machine?

A'C:\Program Files\Palo Alto Networks\Traps\xdr.exe' stop

B'C:\Program Files\Palo Alto Networks\Traps\cytool.exe' runtime stop

C'C:\Program Files\Palo Alto Networks\Traps\xdr.exe' -s stop

D'C:\Program Files\Palo Alto Networks\Traps\cytool.exe' occp

Answer : B

Question 4

[Dashboards and Reporting]

An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:

The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configured the following XQL query to meet the requirement:

dataset = alerts

| fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id

| filter alert_name =

| sort desc _time

How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?

A$y_axis.value

B$x_axis.value

C$x_axis.name

D$y_axis.name

Answer : B

Question 5

[Cortex XDR Agent Configuration]

A static endpoint group is created by adding 321 endpoints using the Upload From File feature. However, after group creation, the members count field shows 244 endpoints. What are two possible reasons why endpoints were not added to the group? (Choose two.)

AStatic groups have a limit of 250 endpoints when adding by file

BEndpoints added to the new group were previously added to an existing group

CEndpoints added to the group were in Disconnected or Connection Lost status when groupmembership was added

DThe IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant

Answer : C, D

Question 6

[Cortex XDR Agent Configuration]

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

AIt will immediately execute

BIt will not execute

CIt will execute after one hour

DIt will execute after the second attempt

Answer : B

Question 7

[Cortex XDR Agent Configuration]

Multiple remote desktop users complain of in-house applications no longer working. The team uses macOS with Cortex XDR agents version 8.7.0, and the applications were previously allowed by disable prevention rules attached to the Exceptions Profile "Engineer-Mac." Based on the images below, what is a reason for this behavior?

AEndpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range

BThe Cloud Identity Engine is disconnected or removed

CXDR agent version was downgraded from 8.7.0 to 8.4.0

DInstallation type changed from VDI to Kubernetes

Answer : A

Palo Alto Networks Certified XDR Engineer XDR-Engineer Exam Questions