Palo Alto Networks XDR-Engineer Exam Questions Instant Access

Question 1

[Cortex XDR Agent Configuration]

Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file. What can be inferred about the affected users' inability to print?

AThey may be attached to the default extensions policy and profile

BThey may have a host firewall profile set to block activity to all network-attached printers

CThey may have different disk encryption profiles that are not allowing print jobs on encrypted files

DThey may be on different device extensions profiles set to block different print jobs

Answer : B

Question 2

[Detection Engineering]

A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)

[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]

AApply an alert exception

BApply an alert exclusion to the XDR behavioral indicator of compromise (BIOC) alert

CApply an alert exclusion to the XDR agent alert

DModify the behavioral indicator of compromise (BIOC) logic

Answer : A, B

Question 3

[Data Ingestion and Integration]

In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?

AValid SQL query targeting the desired data

BAccess to the database audit log

CDatabase schema exported in the correct format

DAccess to the database transaction log

Answer : A

Question 4

[Dashboards and Reporting]

Which statement describes the functionality of fixed filters and dashboard drilldowns in enhancing a dashboard's interactivity and data insights?

AFixed filters allow users to select predefined data values, while dashboard drilldowns enable users to alter the scope of the data displayed by selecting filter values from the dashboard header

BFixed filters limit the data visible in widgets, while dashboard drilldowns allow users to download data from the dashboard in various formats

CFixed filters let users select predefined or dynamic values to adjust the scope, while dashboard drilldowns provide interactive insights or trigger contextual changes, like linking to XQL searches

DFixed filters allow users to adjust the layout, while dashboard drilldowns provide links to external reports and/or dashboards

Answer : C

Question 5

[Planning and Installation]

The most recent Cortex XDR agents are being installed at a newly acquired company. A list with endpoint types (i.e., OS, hardware, software) is provided to the engineer. What should be cross-referenced for the Linux systems listed regarding the OS types and OS versions supported?

AContent Compatibility Matrix

BKernel Module Version Support

CEnd-of-Life Summary

DAgent Installer Certificate

Answer : B

Question 6

[Detection Engineering]

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

ABetween 30 and 45 minutes

BImmediately

C5 minutes or less

DBetween 10 and 20 minutes

Answer : C

Question 7

[Data Ingestion and Integration]

Which step is required to configure a proxy for an XDR Collector?

AEdit the YAML configuration file with the new proxy information

BRestart the XDR Collector after configuring the proxy settings

CConnect the XDR Collector to the Pathfinder

DConfigure the proxy settings on the Cortex XDR tenant

Answer : A

Palo Alto Networks Certified XDR Engineer XDR-Engineer Exam Questions