Palo Alto Networks XDR Engineer v1.0
Question 1
An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected.
Which statement explains why the automation rules might not apply to certain alerts?
- A. They only apply to new alerts grouped into incidents by the system and only alerts that generate incidents trigger automation actions.
- B. They can only be triggered by alerts with high severity; alerts with low or informational severity will not trigger the automation rules.
- C. They can be applied to any alert, but they only work if the alert is manually grouped into an incident by the analyst.
- D. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly.
Answer : A
Question 2
A mobile device management (MDM) system is configured per documentation, and after Cortex XDR agent deployment, many users show their operational status as “Partially Protected.”
What is a potential cause for this behavior?
- A. The Safari Safeguard module has not been enabled for all websites.
- B. The Network and EDR Security Module is not set to auto-detect malicious URL filtering.
- C. Affected users are still using the Default Malware Prevention Module on Policy.
- D. URL filtering is currently disabled on the Malware Prevention Module.
Answer : A
Question 3
What happens when two or more values are specified for a disable prevention rule in Cortex XDR to allow file execution?
- A. The exception is applied if the file satisfies all of the specified target properties.
- B. The rule is ignored if multiple values are specified for the target properties.
- C. The rule automatically applies to all files regardless of their properties.
- D. The rule applies if the file satisfies any of the specified target properties.
Answer : A
Question 4
When using Kerberos as the authentication method for Pathfinder, which two settings must be validated on the DNS server?
- A. Reverse DNS records
- B. Reverse DNS zone
- C. DNS forwarders
- D. AD DS-integrated zones
Answer : AB
Question 5
Multiple remote desktop users complain of in-house applications no longer working. The team uses macOS with Cortex XDR agents version 8.7.0, and the applications were previously allowed by disable prevention rules attached to the Exceptions Profile “Engineer-Mac.”
Based on the images below, what is a reason for this behavior?
- A. The Cloud Identity Engine is disconnected or removed.
- B. XDR agent version was downgraded from 8.7.0 to 8.4.0
- C. Endpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range.
- D. Installation type changed from VDI to Kubernetes.
Answer : A
Question 6
A Cortex XDR agent needs to be uninstalled from two Windows machines that are no longer connected to the Cortex XDR tenant.
The uninstall password for the machines is not known.
Which set of actions should be taken to resolve this issue?
- A. Run the cytool.exe protect disable command on each machine then uninstall the agent.
- B. Boot the machines in safe mode then uninstall the agent.
- C. Stop the Cortex XDR services and delete the Cortex XDR folders and registry hives.
- D. Copy the original agent MSI installer to each machine then run Msiexec.exe with /x option.
Answer : D
Question 7
When configuring a new custom parsing rule in Cortex XDR, which section of the rule is mandatory?
- A. INGEST
- B. COLLECT
- C. CONST
- D. OUTPUT
Answer : A
Question 8
An engineer needs to restrict user access to endpoints. An endpoint group named “Site2” is created and contains the relevant endpoints with the Cortex XDR agent installed. Endpoints may be members of multiple endpoint groups, but the users will require access to any endpoint in Site2 regardless of other group membership for those endpoints.
How should Scope-Based Access Control (SBAC) be configured?
- A. In restrictive mode with a custom role for the users including Site2
- B. In permissive mode with the user scope adjusted to include Site2
- C. In permissive mode with a custom role for the users including Site2
- D. In restrictive mode with the user scope to adjusted to include Site2
Answer : B
Question 9
A correlation rule is created to detect potential insider threats by correlating user login events from one dataset with file access events from another dataset. The rule must retain all user login events, even if there are no matching file access events, to ensure no login activity is missed.
Which type of join is required to maintain all records from dataset x, even if there are no matching events from dataset y?
- A. Right
- B. Left
- C. Outer
- D. Inner
Answer : B
Question 10
What will enable a custom prevention rule to block specific behavior?
- A. A correlation rule added to Malware profile
- B. A custom behavioral indicator of compromise (BIOC) added to an Exploit profile
- C. A custom behavioral indicator of compromise (BIOC) added to a Restriction profile
- D. A correlation rule added to an Agent Blocking profile
Answer : C
Question 11
What is a limitation of using static endpoint groups in Cortex XDR?
- A. Group membership updates are based on real-time threat detection.
- B. The selection criteria is limited to 10 and only the *wildcard can be used.
- C. Group membership is limited to endpoint tags, partial hostnames and domains, and network information.
- D. The endpoint must match an existing XDR agent, with a limit of 250 endpoints.
Answer : B
Question 12
An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:
The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configures the following XQL query to meet the requirement:
How will the engineer complete the third line of the query (| filter alert_name =) to allow dynamic filtering on a selected alert name?
- A. $x_axis.value
- B. $y_axis.value
- C. $x_axis.name
- D. $y_axis.name
Answer : A
Question 13
Which configuration profile option with an available built-in template can be applied to both Windows and Linux systems by using XDR Collector?
- A. HTTP Collector template
- B. Winlogbeat
- C. Filebeat
- D. XDR Collector settings
Answer : C
Question 14
A malware profile is configured with all the default settings for a specific endpoint group. For the same group, a restrictions profile has also been configured with the defaults, except with the restriction as shown in the image below. A user opens a command prompt and runs a mimikatz executable from C:\temp.
What is the first alert produced on the XDR Console for that endpoint?
-
A.
-
B.
-
C.
-
D.
Answer : C
Question 15
An XDR Collector is deployed onto the endpoint to collect logs for ingestion from a custom application running on a Linux endpoint, but the endpoint is not protected.
How can protection be added to the endpoint?
- A. Add the endpoint to an endpoint group.
- B. Enable Cortex XDR Pro capabilities on the XDR Collector.
- C. Assign a malware prevention policy to the endpoint.
- D. Install a Cortex XDR agent onto the endpoint.
Answer : D