Palo Alto Networks XDR Engineer - XDR-Engineer FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

A threat hunter wants to prioritize investigations according to attacker objectives, techniques, and operational tactics. Which framework provides the best alignment?

A. CIS Asset Inventory B. MITRE ATT&CK Mapping C. CVSS Environmental Metrics D. PCI DSS Controls

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

Which statement describes the functionality of fixed filters and dashboard drilldowns in enhancing a dashboard's interactivity and data insights?

A. Fixed filters allow users to select predefined data values, while dashboard drilldowns enable users to alter the scope of the data displayed by selecting filter values from the dashboard header B. Fixed filters let users select predefined or dynamic values to adjust the scope, while dashboard drilldowns provide interactive insights or trigger contextual changes, like linking to XQL searches C. Fixed filters limit the data visible in widgets, while dashboard drilldowns allow users to download data from the dashboard in various formats D. Fixed filters allow users to adjust the layout, while dashboard drilldowns provide links to external reports and/or dashboards

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

How can a Malware profile be configured to prevent a specific executable from being uploaded to the cloud?

A. Add the executable to the allow list for executions B. Create an exclusion rule for the executable C. Disable on-demand file examination for the executable D. Set PE and DLL examination for the executable to report action mode

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 4

What happens when two or more values are specified for a disable prevention rule in Cortex XDR to allow file execution?

A. The rule is ignored if multiple values are specified for the target properties. B. The exception is applied if the file satisfies all of the specified target properties. C. The rule applies if the file satisfies any of the specified target properties. D. The rule automatically applies to all files regardless of their properties.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

A. dataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname"| filter lowercase(action_file_path) in ("/etc/*",
"/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt")| fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path B. dataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and
action_process_image_command_line != "*cmd.exe -a /c*" C. dataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = "**"and action_process_image_command_line = "-e cmd*"and action_process_image_command_line != "*cmd.exe -a /c*" D. dataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and
action_process_image_command_line != "*cmd.exe -a /c*"

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

A. Immediately B. Between 30 and 45 minutes C. Between 10 and 20 minutes D. 5 minutes or less

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Which configuration profile option with an available built-in template can be applied to both Windows and Linux systems by using XDR Collector?

A. Filebeat B. HTTP Collector template C. XDR Collector settings D. Winlogbeat

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:

The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configured the following XQL query to meet the requirement:
dataset = alerts
| fields alert_name, description, alert_source, severity,
original_tags, alert_id, incident_id
| filter alert_name =
| sort desc _time
How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?

A. $y_axis.value B. $x_axis.value C. $y_axis.name D. $x_axis.name

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

An attacker uses a malicious Microsoft Word document to launch PowerShell, download malware, and establish persistence. Which Cortex XDR feature best visualizes this sequence?

A. Live Terminal B. Endpoint Administration C. Device Control Policy D. Causality Chain Analysis

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).