2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free Palo Alto Networks XDR Engineer Practice Questions

8 free Palo Alto Networks XDR Engineer practice questions from the CertStash pack of 59, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 8 free here, all 59 in the pack, and each step includes the one before it.

Get all 59 questions (US$39) · Download the first 10 as a PDF

Question 1

How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

  1. Install the XDR Collector.
  2. Enable HTTP collector integration.
  3. Activate Windows Event Collector (WEC).
  4. Install the Cortex XDR agent.
Show answer and explanation

Correct answer: C. Activate Windows Event Collector (WEC).

The Windows Event Collector applet on the Broker VM receives Windows events that servers forward to it, so nothing has to be installed on the DHCP server itself. The server is set to forward its DHCP events, the events are added to the collector's collection configuration, and Cortex XDR starts ingesting them. That brings the additional DHCP events in with minimal configuration.

Why the other options are wrong

  • A. The XDR Collector is a separate installation on the server with its own collection profile, which is more setup than forwarding events to the collector.
  • B. An HTTP collector receives logs that a source pushes over HTTP, which a Windows DHCP server does not do.
  • D. The Cortex XDR agent provides endpoint protection and telemetry and is not the method for collecting the DHCP server's events.

Question 2

A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center.

Which available column should be checked to determine how many compute units will be used when the query is run?

  1. Compute Unit Quota
  2. Query Status
  3. Compute Unit Usage
  4. Simulated Compute Units
Show answer and explanation

Correct answer: D. Simulated Compute Units

Queries run interactively against hot storage while testing do not draw from the compute unit quota, but the Query Center records what they would have cost in the Simulated Compute Units column. That figure shows how many compute units the same query will consume once it runs through the API, where compute units are charged. Checking it before scheduling the weekly API run tells the engineer the expected cost of each execution.

Why the other options are wrong

  • A. The quota is the total allowance for the tenant, not the cost of a particular query.
  • B. Query Status shows whether the query is running, completed or failed, not its compute cost.
  • C. Compute Unit Usage reports units already consumed by API and cold storage queries, so it shows nothing for a query that has only been tested.

Question 3

Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file.

What can be inferred about the affected users’ inability to print?

  1. They may have a host firewall profile set to block activity to all network-attached printers.
  2. They may be on different device extensions profiles set to block different print jobs.
  3. They may be attached to the default extensions policy and profile.
  4. They may have different disk encryption profiles that are not allowing print jobs on encrypted files.
Show answer and explanation

Correct answer: B. They may be on different device extensions profiles set to block different print jobs.

Cortex XDR controls printing through device extensions settings, which can block specific types of print jobs such as network printer jobs, local printer jobs and printing to file. Because the affected users show different patterns, with some able to print only at home and others only to file, they are most likely covered by different device extensions profiles, each blocking a different set of print job types.

Why the other options are wrong

  • A. Host firewall rules govern network connections and would not explain users who can print only to file.
  • C. A single shared default profile would give every affected user the same printing behavior, not the different patterns reported.
  • D. Disk encryption profiles manage drive encryption and do not control print jobs.

Question 4

The most recent Cortex XDR agents are being installed at a newly acquired company. A list with endpoint types (i.e., OS, hardware, software) is provided to the engineer.

What should be cross-referenced for the Linux systems listed regarding the OS types and OS versions supported?

  1. Kernel Module Version Support
  2. Content Compatibility matrix
  3. End-of-life summary
  4. Agent Installer Certificate
Show answer and explanation

Correct answer: A. Kernel Module Version Support

The Cortex XDR agent for Linux depends on a kernel module that must support the specific distribution and kernel version on each host. Palo Alto Networks publishes kernel module version support information listing which Linux distributions, versions and kernels each agent release supports. Cross-referencing the Linux systems against that list confirms which hosts can run the agent with full protection before the rollout.

Why the other options are wrong

  • B. Content compatibility concerns which content updates work with which agent versions, not which Linux distributions and kernels are supported.
  • C. The end-of-life summary lists when agent releases stop being supported, not which Linux operating systems they run on.
  • D. The installer certificate concerns trusting the installation package and says nothing about supported operating systems.

Question 5

An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources.

Which section of the parsing rule should the administrator use to define these reusable rules in Cortex XDR?

  1. RULE
  2. INGEST
  3. FILTER
  4. CONST
Show answer and explanation

Correct answer: A. RULE

Parsing rules are organized into sections, and the RULE section defines named, reusable rules containing XQL-style stages. Those named rules can then be called from INGEST sections, so the same field extraction logic is applied consistently to several data sources without being rewritten each time. This makes RULE the section for shared extraction logic.

Why the other options are wrong

  • B. The INGEST section defines how data for a specific vendor and product is parsed into a dataset, and it calls reusable rules rather than defining them.
  • C. FILTER is a stage used inside a rule to keep or discard events, not a section for defining reusable rules.
  • D. The CONST section defines constant values that rules can reference, not reusable rule logic.

Question 6

Which method will drop undesired logs and reduce the amount of data being ingested?

  1. [INGEST:vendor= “vendor”, product= “product”, target_dataset= “vendor_product_raw”, no_hit=drop] filter _raw_log not contains “undesired logs”;
  2. [COLLECT:vendor= “vendor”, product= “product”, target_dataset=*, no_hit=drop] drop _raw_log contains “undesired logs”;
  3. [INGEST:vendor= “vendor”, product= “product”, target_brokers= “vendor_product_raw”, no_hit=keep] filter _raw_log not contains “undesired logs”;
  4. [COLLECT:vendor= “vendor”, product= “product”, target_brokers=*, no_hit=drop] drop _raw_log contains “undesired logs”;
Show answer and explanation

Correct answer: D. [COLLECT:vendor= “vendor”, product= “product”, target_brokers=*, no_hit=drop] drop _raw_log contains “undesired logs”;

Collection rules, written in a COLLECT section, run on the Broker VM before data is sent to Cortex XDR, so events they discard are never ingested. A COLLECT section targets brokers with target_brokers, and target_brokers=* applies the rule to data from all Broker VM applets. The drop stage discards events matching its condition, here any raw log containing the undesired text, while all other events continue to the tenant. This removes the unwanted logs before ingestion and reduces the volume of data ingested.

Why the other options are wrong

  • A. An INGEST section runs after the data has already reached the tenant, so it does not reduce the amount of data ingested.
  • B. A COLLECT section selects brokers with target_brokers, not with target_dataset.
  • C. An INGEST section works on data that has already arrived, and target_brokers is not an INGEST parameter.

Question 7

A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected.

What may be the cause of this behavior?

  1. The XDR Collector is dropping the logs.
  2. The filter stage is dropping the logs.
  3. The Broker VM is offline.
  4. The parsing rule corrupted the database.
Show answer and explanation

Correct answer: B. The filter stage is dropping the logs.

The rest of the data source arrives normally, which shows that collection and transport are working. Only the logs the new parsing rule is meant to handle are missing, which points to the rule itself. A filter stage keeps only events that match its condition and discards the rest, so a condition that does not match the intended logs drops exactly those events. Correcting the filter condition lets the logs through to be parsed.

Why the other options are wrong

  • A. The other logs from the same source arrive through the same collection path, so the collector is not dropping them.
  • C. An offline Broker VM would stop all logs from the source, not only the ones the rule handles.
  • D. Parsing rules transform incoming events and do not corrupt the underlying database.

Question 8

What should be configured in Cortex XDR to integrate asset data from Microsoft Azure for better visibility and incident investigation?

  1. Cloud Inventory
  2. Cloud Identity Engine
  3. Microsoft 365
  4. Azure Network Watcher
Show answer and explanation

Correct answer: A. Cloud Inventory

Cloud Inventory is the Cortex XDR data source that connects to cloud provider accounts, including Microsoft Azure, and collects data about the cloud assets running there. Once configured, those assets appear in Cortex XDR with their details, giving analysts visibility into cloud resources and context when investigating incidents that involve them.

Why the other options are wrong

  • B. The Cloud Identity Engine provides user and group identity data from directories, not inventory of Azure assets.
  • C. The Microsoft 365 integration collects audit and email data from Microsoft 365 services, not Azure asset data.
  • D. Azure Network Watcher is an Azure monitoring service, not a Cortex XDR configuration for collecting asset data.

That was 8 of 59.

The full Palo Alto Networks XDR Engineer pack has all 59 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 29 free as one PDF by email. Get the Half Pack →