Question 1

[Maintenance and Troubleshooting]

Log events from a previously deployed Windows XDR Collector agent are no longer being observed in the console after an OS upgrade. Which aspect of the log events is the probable cause of this behavior?

AThey are greater than 5MB

BThey are in Winlogbeat format

CThey are in Filebeat format

DThey are less than 1MB

Answer : A

Question 2

[Cortex XDR Agent Configuration]

A static endpoint group is created by adding 321 endpoints using the Upload From File feature. However, after group creation, the members count field shows 244 endpoints. What are two possible reasons why endpoints were not added to the group? (Choose two.)

AStatic groups have a limit of 250 endpoints when adding by file

BEndpoints added to the new group were previously added to an existing group

CEndpoints added to the group were in Disconnected or Connection Lost status when groupmembership was added

DThe IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant

Answer : C, D

Question 3

[Data Ingestion and Integration]

In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?

AValid SQL query targeting the desired data

BAccess to the database audit log

CDatabase schema exported in the correct format

DAccess to the database transaction log

Answer : A

Question 4

[Detection Engineering]

What will enable a custom prevention rule to block specific behavior?

AA correlation rule added to an Agent Blocking profile

BA custom behavioral indicator of compromise (BIOC) added to an Exploit profile

CA custom behavioral indicator of compromise (BIOC) added to a Restriction profile

DA correlation rule added to a Malware profile

Answer : C

Question 5

[Maintenance and Troubleshooting]

An insider compromise investigation has been requested to provide evidence of an unauthorized removable drive being mounted on a company laptop. Cortex XDR agent is installed with default prevention agent settings profile and default extension "Device Configuration" profile. Where can an engineer find the evidence?

ACheck Host Inventory -> Mounts

Bdataset = xdr_data | filter event_type = ENUM.MOUNT and event_sub_type = ENUM.MOUNT_DRIVE_MOUNT

CThe requested data requires additional configuration to be captured

Dpreset = device_control

Answer : A

Free Practice Questions for Palo Alto Networks XDR-Engineer Exam

Question 1

Question 2

Question 3

Question 4

Question 5