Free Practice Palo Alto Networks XDR-Engineer Exam Questions 2025

Stay ahead with 100% Free Palo Alto Networks XDR Engineer XDR-Engineer Dumps Practice Questions

Page: 1 / 10

Total 50 Questions | Updated On: Jun 04, 2025

Add To Cart

Question 1

Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly regulated environment? (Choose two.)

A : Enable critical environment versions

B : Create an agent settings profile where the agent upgrade scope is maintenance releases only

C : Create an agent settings profile, enable content auto-update, and include a delay of four days

D : Enable minor content version updates

Answer: B,C

Question 2

Which method will drop undesired logs and reduce the amount of data being ingested?

A : [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

B : [INGEST:vendor="vendor", product="product", target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

C : [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

D : [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

Answer: C

Question 3

Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly regulated environment? (Choose two.)

A : Enable critical environment versions

B : Create an agent settings profile where the agent upgrade scope is maintenance releases only

C : Create an agent settings profile, enable content auto-update, and include a delay of four days

D : Enable minor content version updates

Answer: B,C

Question 4

Which method will drop undesired logs and reduce the amount of data being ingested?

A : [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

B : [INGEST:vendor="vendor", product="product", target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

C : [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

D : [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

Answer: C

Question 5

An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email. The playbook should only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)

A : Alert severity is High

B : Alert source is Cortex XDR Analytics

C : Alert category is Malware

D : Alert status is New

Answer: A,C

Page: 1 / 10

Total 50 Questions | Updated On: Jun 04, 2025

Add To Cart