[2026] Palo Alto Networks XDR Engineer - XDR-Engineer 무료 시험 문제

문제1

What should be configured in Cortex XDR to integrate asset data from Microsoft Azure for better visibility and incident investigation?

A. Cloud Identity Engine

B. Azure Network Watcher

C. Cloud Inventory

D. Microsoft 365

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제2

A signed application from a trusted vendor unexpectedly begins spawning command shells and downloading remote payloads. Which detection method is most effective?

A. Signature Reputation Only

B. Behavioral Analytics

C. Asset Tag Validation

D. Endpoint Enumeration

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제3

A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center. Which available column should be checked to determine how many compute units will be used when the query is run?

A. Query Status

B. Simulated Compute Units

C. Compute Unit Usage

D. Compute Unit Quota

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제4

How are dynamic endpoint groups created and managed in Cortex XDR?

A. Endpoint groups require intervention to update the group with new endpoints when a new device is added to the network

B. After an endpoint group is created, its assigned security policy cannot be changed without deleting and recreating the group

C. Each endpoint can belong to multiple groups simultaneously, allowing different security policies to be applied to the same device at the same time

D. Endpoint groups are defined based on fields such as OS type, OS version, and network segment

정답: D

설명: (Fast2test 회원만 볼 수 있음)

문제5

When onboarding a Palo Alto Networks NGFW to Cortex XDR, what must be done to confirm that logs are being ingested successfully after a device is selected and verified?

A. Conduct an XQL query for NGFW log data

B. Retrieve device certificate from NGFW dashboard

C. Confirm that the selected device has a valid certificate

D. Wait for an incident that involves the NGFW to populate

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제6

After deploying Cortex XDR agents to a large group of endpoints, some of the endpoints have a partially protected status. In which two places can insights into what is contributing to this status be located? (Choose two.)

A. All Endpoints page

B. Management Audit Logs

C. XQL query of the endpoints dataset

D. Asset Inventory

정답: A,C

설명: (Fast2test 회원만 볼 수 있음)

문제7

Log events from a previously deployed Windows XDR Collector agent are no longer being observed in the console after an OS upgrade. Which aspect of the log events is the probable cause of this behavior?

A. They are greater than 5MB

B. They are less than 1MB

C. They are in Filebeat format

D. They are in Winlogbeat format

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제8

An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected. Which statement explains why the automation rules might not apply to certain alerts?

A. They can only be triggered by alerts with high severity; alerts with low or informational severity will not trigger the automation rules

B. They only apply to new alerts grouped into incidents by the system and only alerts that generateincidents trigger automation actions

C. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly

D. They can be applied to any alert, but they only work if the alert is manually grouped into an incident by the analyst

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제9

Multiple remote desktop users complain of in-house applications no longer working. The team uses macOS with Cortex XDR agents version 8.7.0, and the applications were previously allowed by disable prevention rules attached to the Exceptions Profile "Engineer-Mac." Based on the images below, what is a reason for this behavior?

A. Endpoint IP address changed from 192.168.0.0 range to 192.168.100.0 range

B. The Cloud Identity Engine is disconnected or removed

C. Installation type changed from VDI to Kubernetes

D. XDR agent version was downgraded from 8.7.0 to 8.4.0

정답: B

설명: (Fast2test 회원만 볼 수 있음)

Palo Alto Networks XDR Engineer - XDR-Engineer무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트