Free Palo Alto Networks XDR-Engineer Exam Questions

Become Palo Alto Networks Certified with updated XDR-Engineer exam questions and correct answers

Page: 1 / 10

Total 50 Questions | Updated On: Jul 18, 2025

Add To Cart

Question 1

An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email. The playbook should only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)

A : Alert severity is High

B : Alert source is Cortex XDR Analytics

C : Alert category is Malware

D : Alert status is New

Answer: A,C

Question 2

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

A : It will immediately execute

B : It will not execute

C : It will execute after one hour

D : It will execute after the second attempt

Answer: B

Question 3

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

A : It will immediately execute

B : It will not execute

C : It will execute after one hour

D : It will execute after the second attempt

Answer: B

Question 4

Which method will drop undesired logs and reduce the amount of data being ingested?

A : [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

B : [INGEST:vendor="vendor", product="product", target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

C : [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

D : [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

Answer: C

Question 5