Palo Alto Networks XDR-Engineer Exam Questions Instant Access

Question 1

[Post-Deployment Management and Configuration]

Which components may be included in a Cortex XDR content update?

ADevice control profiles, agent versions, and kernel support

BBehavioral Threat Protection (BTP) rules and local analysis logic

CAntivirus definitions and agent versions

DFirewall rules and antivirus definitions

Answer : B

Question 2

[Planning and Installation]

During deployment of Cortex XDR for Linux Agents, the security engineering team is asked to implement memory monitoring for agent health monitoring. Which agent service should be monitored to fulfill this request?

Adypdng

Bclad

Cpyxd

Dpmd

Answer : D

Question 3

[Playbook Creation and Automation]

An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email. The playbook should only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)

AAlert severity is High

BAlert source is Cortex XDR Analytics

CAlert category is Malware

DAlert status is New

Answer : A, C

Question 4

[Data Ingestion and Integration]

Which configuration profile option with an available built-in template can be applied to both Windows and Linux systems by using XDR Collector?

AFilebeat

BHTTP Collector template

CXDR Collector settings

DWinlogbeat

Answer : A

Question 5

[Data Ingestion and Integration]

What should be configured in Cortex XDR to integrate asset data from Microsoft Azure for better visibility and incident investigation?

AAzure Network Watcher

BCloud Identity Engine

CCloud Inventory

DMicrosoft 365

Answer : C

Question 6

[Detection Engineering]

Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

Adataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name = '**'and action_process_image_command_line = '-e cmd*'and action_process_image_command_line != '*cmd.exe -a /c*'

Bdataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = '**'and action_process_image_command_line = '-e cmd*'and action_process_image_command_line != '*cmd.exe -a /c*'

Cdataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = 'hostname'| filter lowercase(action_file_path) in ('/etc/*', '/usr/local/share/*', '/usr/share/*') and action_file_extension in ('conf', 'txt')| fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path

Ddataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name = '**'and action_process_image_command_line = '-e cmd*'and action_process_image_command_line != '*cmd.exe -a /c*'

Answer : D

Question 7

[Dashboards and Reporting]

An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:

The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configured the following XQL query to meet the requirement:

dataset = alerts

| fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id

| filter alert_name =

| sort desc _time

How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?

A$y_axis.value

B$x_axis.value

C$x_axis.name

D$y_axis.name

Answer : B

Palo Alto Networks Certified XDR Engineer XDR-Engineer Exam Questions