XDR-Engineer Exam Training Practice Tests (Palo Alto Networks XDR Engineer)]

Question 1

An organization experiences recurring malware alerts from the same endpoint despite repeated remediation efforts. What should investigators examine first?

A. Network Throughput Statistics B. Persistence Mechanisms C. Agent Version History D. Endpoint Screen Resolution

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

A. 5 minutes or less B. Immediately C. Between 10 and 20 minutes D. Between 30 and 45 minutes

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

During a recent internal purple team exercise, the following recommendation is given to the detection engineering team: Detect and prevent command line invocation of Python on Windows endpoints by non-technical business units. Which rule type should be implemented?

A. Analytics Behavioral Indicator of Compromise (ABIOC) B. Behavioral Indicator of Compromise (BIOC) C. Indicator of Compromise (IOC) D. Correlation

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)
[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]

A. Apply an alert exclusion to the XDR behavioral indicator of compromise (BIOC) alert B. Apply an alert exclusion to the XDR agent alert C. Modify the behavioral indicator of compromise (BIOC) logic D. Apply an alert exception

Correct Answer: C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

A. dataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname"| filter lowercase(action_file_path) in ("/etc/*",
"/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt")| fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path B. dataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and
action_process_image_command_line != "*cmd.exe -a /c*" C. dataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and
action_process_image_command_line != "*cmd.exe -a /c*" D. dataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = "**"and action_process_image_command_line = "-e cmd*"and action_process_image_command_line != "*cmd.exe -a /c*"

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

Using the Cortex XDR console, how can additional network access be allowed from a set of IP addresses to an isolated endpoint?

A. Add entries in the Allowed Domains section of Security Settings for the tenant B. Add entries in Configuration section of Security Settings C. Add entries in Response Actions section of Agent Settings profile D. Add entries in Exceptions Configuration section of Isolation Exceptions

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

A Cortex XDR engineer discovers multiple alerts generated across several endpoints. The alerts appear unrelated individually but collectively indicate coordinated malicious activity. What explains this grouping?

A. Dynamic Incident Correlation B. Broker VM Aggregation C. Endpoint naming convention D. Asset Inventory Analysis

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

A mobile device management (MDM) system is configured per documentation, and after Cortex XDR agent deployment, many users show their operational status as "Partially Protected." What is a potential cause for this behavior?

A. The Network and EDR Security Module is not set to auto-detect malicious URL filtering. B. URL filtering is currently disabled on the Malware Prevention Module. C. Affected users are still using the Default Malware Prevention Module on Policy. D. The Safari Safeguard module has not been enabled for all websites.

Correct Answer: D

Question 9

How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

A. Install the XDR Collector B. Install the Cortex XDR agent C. Enable HTTP collector integration D. Activate Windows Event Collector (WEC)

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Palo Alto Networks XDR Engineer - XDR-Engineer Exam Practice Test