Free Palo Alto Networks XDR-Analyst Exam Questions

Become Palo Alto Networks Certified with updated XDR-Analyst exam questions and correct answers

Page: 1 / 19

Total 92 Questions | Updated On: Apr 02, 2026

Add To Cart

Question 1

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

A : causality_chain

B : endpoint_name

C : threat_event

D : event_type

Answer: D

Question 2

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

A : in the macOS Malware Protection Profile to indicate allowed signers

B : in the Linux Malware Protection Profile to indicate allowed Java libraries

C : SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

D : in the Windows Malware Protection Profile to indicate allowed executables

Answer: D

Question 3

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was aprevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about amassive ongoing supply chain attack. Using Cortex XDR you recognize that your server wascompromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure thatthe same protection is extended to all your servers?

A : Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

B : Enable DLL Protection on all servers but there might be some false positives.

C : Create IOCs of the malicious files you have found to prevent their execution.

D : Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Answer: A

Question 4

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

A : Agent Proxy

B : Agent Installer and Content Caching

C : Syslog Collector

D : CSV Collector

Answer: B

Question 5