Palo Alto Networks XDR Engineer - XDR-Engineer Exam Practice Test

Question 1

When using Kerberos as the authentication method for Pathfinder, which two settings must be validated on the DNS server? (Choose two.)

A. Reverse DNS zone

B. DNS forwarders

C. Reverse DNS records

D. AD DS-integrated zones

Correct Answer: A,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

An incident is generated from a local analysis malware alert involving install_dependencies.exe.
The hash of the same file now shows a benign verdict from WildFire when viewing the artifacts associated with the incident. Which configuration can be enabled in the Malware profile for this outcome without any additional manual effort from an administrator?

A. "Enrich Local Analysis verdicts with WildFire"

B. "Upload unknown files to WildFire"

C. "WildFire Dynamic Re-scan"

D. "Upload malicious verdicts to WildFire for additional analysis"

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

A threat hunter suspects lateral movement activity involving compromised credentials. Which telemetry combination provides the strongest evidence during investigation?

A. Asset Inventory and Disk Usage

B. Process and Authentication Events

C. Endpoint Naming and Tags

D. Patch Levels and Software Inventory

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected. What may be the cause of this behavior?

A. The XDR Collector is dropping the logs

B. The parsing rule corrupted the database

C. The Broker VM is offline

D. The filter stage is dropping the logs

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Which step is required to configure a proxy for an XDR Collector?

A. Connect the XDR Collector to the Pathfinder

B. Restart the XDR Collector after configuring the proxy settings

C. Configure the proxy settings on the Cortex XDR tenant

D. Edit the YAML configuration file with the new proxy information

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Based on the image of a validated false positive alert below, which action is recommended for resolution?

A. Create an alert exclusion for OUTLOOK.EXE

B. Create an exception for OUTLOOK.EXE for ROP Mitigation Module

C. Disable an action to the CGO Process DWWIN.EXE

D. Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

When isolating Cortex XDR agent components to troubleshoot for compatibility, which command is used to turn off a component on a Windows machine?

A. C:\Program Files\Palo Alto Networks\Traps\xdr.exe stop <component>

B. C:\Program Files\Palo Alto Networks\Traps\xdr.exe runtime stop <component>

C. C:\Program Files\Palo Alto Networks\Traps\cytool.exe stop <component>

D. C:\Program Files\Palo Alto Networks\Traps\cytool.exe runtime stop <component>

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

A threat hunter wants to prioritize investigations according to attacker objectives, techniques, and operational tactics. Which framework provides the best alignment?

A. CVSS Environmental Metrics

B. CIS Asset Inventory

C. MITRE ATT&CK Mapping

D. PCI DSS Controls

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?

A. Database schema exported in the correct format

B. Access to the database audit log

C. Access to the database transaction log

D. Valid SQL query targeting the desired data

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Palo Alto Networks XDR Engineer - XDR-Engineer Exam Practice Test

Latest Update

Useful Links

Contact Us