Palo Alto XDR-Engineer Certification Exam Sample Questions and Answers
Before you write the Palo Alto XDR-Engineer certification exam, you may have certain doubts in your mind regarding the pattern of the test, the types of questions asked in it, the difficulty level of the questions and time required to complete the questions. These Palo Alto Networks Certified XDR Engineer sample questions and demo exam help you in removing these doubts and prepare you to take the test.
The best approach to pass your Palo Alto XDR-Engineer exam is to challenge and improve your knowledge. To test your learning and identify improvement areas with actual exam format, we suggest you practice with Premium Palo Alto XDR-Engineer Certification Practice Exam. The practice test is one of the most important elements of your Palo Alto Networks XDR Engineer exam study strategy to discover your strengths and weaknesses, to improve your time management skills and to get an idea of the score you can expect.
Palo Alto XDR-Engineer Sample Questions:
01. After a weekend change at a university, alerts in the tenant display raw account strings instead of resolved user names, and rules scoped on directory groups stop matching anyone. Endpoint telemetry and prevention behaviour are unaffected.
Which component is the MOST likely cause?
a) The Cloud Identity Engine integration that supplies directory user and group data
b) The XDR agents on the affected endpoints which report the account context with each event
c) The correlation rules that join identity events and endpoint events over time across the estate
d) The Broker VM applet that relays agent communication to the tenant through the proxy
02. Six weeks after a noisy tuning exercise, a media company's responders establish that an intrusion ran for a month without a single alert. The rules that should have matched were enabled throughout, the source data for the period is present and correctly parsed, and no rule logic changed before or during the intrusion.
Which two steps should the engineer take next?
(Choose two.)
a) Compare the suppressions in force over the period against the activity that went unalerted
b) Narrow any suppression that reaches wider than the benign case it was created to cover
c) Remove every suppression in the tenant at once and then reinstate them one case at a time
d) Extend the retention window so the alerts for the period are generated a second time
e) Rewrite the affected rules as correlation content because the current logic has clearly failed
03. A port authority ingests syslog from cranes, gate controllers and network equipment through a single Broker VM. During a two-hour maintenance window on that appliance no syslog was received, and none of the sending devices buffer or resend what they emit. The team is redesigning the ingestion path before the next window.
Which change addresses the exposure that outage revealed?
a) Install XDR Collectors on the gate controllers so they forward their syslog independently
b) Add compute units so the tenant absorbs the burst of syslog that follows a broker outage
c) Extend data retention so the gap left by the maintenance window can be filled in afterwards
d) Cluster a second Broker VM alongside the first so ingestion survives the loss of one appliance
04. During a Cortex XDR pilot an engineering team authored several detections whose conditions depend on the user belonging to a sensitive directory group. The detections saved without error and have produced nothing in three weeks. Endpoint telemetry from the pilot hosts is arriving and other detections on those same hosts fire as expected. The directory integration was scheduled for after the pilot.
What BEST explains the silence?
a) The group conditions cannot evaluate while the directory objects are absent from the tenant
b) The agents on the pilot hosts are not collecting the user attributes that the conditions read
c) The conditions were saved with logic errors and the tenant accepted them without warning
d) An exception scoped to the pilot hosts is suppressing these alerts before they surface
05. A freight operator onboarded its perimeter firewalls months ago and built correlation content on that source. After a weekend maintenance window the correlation alerts stopped appearing although the tenant still shows the same daily record volume from those firewalls. Nobody has touched the correlation logic.
Which step should the engineer take FIRST?
a) Rewrite the correlation logic so that it matches the way those firewall records now appear in a raw search
b) Inspect recent records from that source to see whether the fields the correlation logic references are still populated
c) Extend the retention applied to that source so the missing alert window can be reconstructed later
d) Review the exceptions applied to that source in case one of them is suppressing these alerts
06. A media company sees ingested volume from a single syslog source roughly triple overnight and then hold at the new level. Alert numbers for that source are unchanged and no change was made to the tenant.
Which two explanations should be investigated first?
(Choose two.)
a) The detection rules for that source were tuned so more events are written into the dataset
b) The source's log format changed so each record now carries more data than it previously did
c) The tenant's retention tier was raised so more data is stored and counted against that source
d) Compute unit consumption grew which in turn increases the volume ingested from that source
e) The device was reconfigured to emit additional event types or a more verbose logging level
07. During an investigation a bank's team finds no host log records at all for two application servers, over every time range they query. Both servers are online and show a healthy protected agent, and other servers in the same rack return records normally.
What is the MOST likely explanation?
a) Those servers were never onboarded for log collection so no records exist for them
b) The agents on those servers are healthy but their prevention profile suppresses log forwarding
c) The parsing rules for those servers dropped their records into an unmapped dataset instead
d) The retention period for that source expired so the older records are no longer queryable
08. A consultancy issues laptops that spend weeks at client sites with no tunnel back to the corporate network. Before the rollout is approved the endpoint team is asked what protection those laptops really have while they are away.
Which two statements about the laptops while they are disconnected are accurate?
(Choose two.)
a) The Collector installed on the laptop enforces the prevention profile in the agent's place while it is offline
b) Detections that depend on tenant-side analysis of the host telemetry keep firing while it is away
c) The agent goes on enforcing the prevention profile it last received and still blocks malicious execution
d) A verdict on an unknown executable is reached on the host itself rather than deferred until reconnection
e) Prevention pauses on the host until it reconnects and re-establishes its session with the tenant
09. A hospitality group is installing the Cortex XDR agent across several thousand point-of-sale and back-office hosts over six weeks. An earlier endpoint product caused checkout outages when a new blocking rule misfired and the board has asked the team to avoid a repeat.
Which rollout approach BEST fits that constraint?
a) Roll out with prevention in report mode everywhere and keep it there so the checkout hosts never block
b) Roll out to the pilot ring only and leave the rest of the estate without an agent until next quarter
c) Roll out to every host at once with prevention set to block and tune from the alerts that arrive after go-live
d) Roll out ring by ring with prevention in report mode and promote to block after a clean pilot
10. A university is onboarding two new sources. Its campus switches and firewalls emit syslog from inside the network and cannot run any software agent. Its domain controllers hold Windows Event Logs that the detection team wants in the tenant.
Which two actions correctly assign a deployment component to each source?
(Choose two.)
a) Install the Cortex XDR agent on the switches so it forwards their syslog to the tenant
b) Enable a syslog-receiving applet on a Broker VM to take the traffic from the switches
c) Deploy an XDR Collector on the domain controllers to gather their Windows Event Logs
d) Point the switches at an XDR Collector on a jump host so it receives their syslog
e) Use the Cloud Identity Engine to bring the domain controller event logs into the tenant
Solutions:
|
Question: 01 Answer: a |
Question: 02 Answer: a, b |
Question: 03 Answer: d |
Question: 04 Answer: a |
Question: 05 Answer: b |
|
Question: 06 Answer: b, e |
Question: 07 Answer: a |
Question: 08 Answer: c, d |
Question: 09 Answer: d |
Question: 10 Answer: b, c |
Note: If you find any error in these Palo Alto Networks XDR Engineer sample questions, you can update us by write an email on feedback@nwexam.com.
- XDR-Engineer |
- XDR-Engineer Questions |
- XDR-Engineer Quiz |
- Palo Alto XDR-Engineer Certification |
- XDR-Engineer Mock Exam |
- XDR-Engineer Question Bank |
- Palo Alto XDR-Engineer Question Bank |
- XDR-Engineer Exam Questions |
- Palo Alto XDR-Engineer Questions |
- Palo Alto Networks XDR Engineer |
- XDR-Engineer Sample Questions |
- Palo Alto XDR-Engineer Practice Test Free |
- XDR-Engineer Certification Questions and Answers |
- XDR-Engineer Certification Sample Questions
