Free Palo Alto Networks XDR-Engineer Exam Questions
Try our Free Demo Practice Tests for Comprehensive XDR-Engineer Exam Preparation
-
Palo Alto Networks XDR-Engineer Exam Questions
-
Provided By: Palo Alto Networks
- Exam: Palo Alto Networks XDR Engineer
- Certification: Security Operations
-
Total Questions: 50
-
Updated On: Jul 03, 2026
-
Rated: 4.9 |
-
Online Users: 100
-
Question 1
-
Which action is being taken with the query below?dataset = xdr_data| fields agent_hostname, _time, _product| comp latest as latest_time by agent_hostname, _product| join type=inner (dataset = endpoints| fields endpoint_name, endpoint_status, endpoint_type) as lookup lookup.endpoint_name = agent_hostname| filter endpoint_status = ENUM.CONNECTED| fields agent_hostname, endpoint_status, latest_time, _product
Answer: A
-
Which action is being taken with the query below?dataset = xdr_data| fields agent_hostname, _time, _product| comp latest as latest_time by agent_hostname, _product| join type=inner (dataset = endpoints| fields endpoint_name, endpoint_status, endpoint_type) as lookup lookup.endpoint_name = agent_hostname| filter endpoint_status = ENUM.CONNECTED| fields agent_hostname, endpoint_status, latest_time, _product
-
Question 2
-
Which method will drop undesired logs and reduce the amount of data being ingested?
Answer: C
-
Which method will drop undesired logs and reduce the amount of data being ingested?
-
Question 3
-
Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly
regulated environment? (Choose two.)
Answer: B,C
-
Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly
regulated environment? (Choose two.)
-
Question 4
-
Which method will drop undesired logs and reduce the amount of data being ingested?
Answer: C
-
Which method will drop undesired logs and reduce the amount of data being ingested?
-
Question 5
-
An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by
automatically isolating the affected endpoint and notifying the security team via email. The playbook should
only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two
conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)
Answer: A,C
-
An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by
automatically isolating the affected endpoint and notifying the security team via email. The playbook should
only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two
conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)