Palo Alto Networks XDR-Engineer - Palo Alto Networks XDR Engineer Exam
Page: 1 / 12
Total 59 questions
Question #1 (Topic: Exam A)
How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?
A. Install the XDR Collector.
B. Enable HTTP collector integration.
C. Activate Windows Event Collector (WEC).
D. Install the Cortex XDR agent.
Answer: C
Question #2 (Topic: Exam A)
A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center.
Which available column should be checked to determine how many compute units will be used when the query is run?
Which available column should be checked to determine how many compute units will be used when the query is run?
A. Compute Unit Quota
B. Query Status
C. Compute Unit Usage
D. Simulated Compute Units
Answer: D
Question #3 (Topic: Exam A)
Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file.
What can be inferred about the affected users’ inability to print?
What can be inferred about the affected users’ inability to print?
A. They may have a host firewall profile set to block activity to all network-attached printers.
B. They may be on different device extensions profiles set to block different print jobs.
C. They may be attached to the default extensions policy and profile.
D. They may have different disk encryption profiles that are not allowing print jobs on encrypted files.
Answer: B
Question #4 (Topic: Exam A)
The most recent Cortex XDR agents are being installed at a newly acquired company. A list with endpoint types (i.e., OS, hardware, software) is provided to the engineer.
What should be cross-referenced for the Linux systems listed regarding the OS types and OS versions supported?
What should be cross-referenced for the Linux systems listed regarding the OS types and OS versions supported?
A. Kernel Module Version Support
B. Content Compatibility matrix
C. End-of-life summary
D. Agent Installer Certificate
Answer: A
Question #5 (Topic: Exam A)
Based on the SBAC scenario image below, when the tenant is switched to permissive mode, which endpoint(s) data will be accessible?
A. E1 only
B. E2 only
C. E1, E2, and E3
D. E1, E2, E3, and E4
Answer: C
