2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Palo Alto Networks XDR Engineer Exam Practice Questions, practice question pack
PALO ALTO NETWORKS · XDR Engineer

Palo Alto Networks XDR Engineer Exam Practice Questions

99% pass rateUpdated 1 Nov 202659 questions2 PDFs by email

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Your PDF is prepared and emailed to you after checkout, usually within a few hours.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 59 questions in this pack

Question 1

How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

  1. Install the XDR Collector.
  2. Enable HTTP collector integration.
  3. Activate Windows Event Collector (WEC).
  4. Install the Cortex XDR agent.
Show answer and explanation

Correct answer: C. Activate Windows Event Collector (WEC).

The Windows Event Collector applet on the Broker VM receives Windows events that servers forward to it, so nothing has to be installed on the DHCP server itself. The server is set to forward its DHCP events, the events are added to the collector's collection configuration, and Cortex XDR starts ingesting them. That brings the additional DHCP events in with minimal configuration.

Why the other options are wrong

  • A. The XDR Collector is a separate installation on the server with its own collection profile, which is more setup than forwarding events to the collector.
  • B. An HTTP collector receives logs that a source pushes over HTTP, which a Windows DHCP server does not do.
  • D. The Cortex XDR agent provides endpoint protection and telemetry and is not the method for collecting the DHCP server's events.

Question 2

A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center.

Which available column should be checked to determine how many compute units will be used when the query is run?

  1. Compute Unit Quota
  2. Query Status
  3. Compute Unit Usage
  4. Simulated Compute Units
Show answer and explanation

Correct answer: D. Simulated Compute Units

Queries run interactively against hot storage while testing do not draw from the compute unit quota, but the Query Center records what they would have cost in the Simulated Compute Units column. That figure shows how many compute units the same query will consume once it runs through the API, where compute units are charged. Checking it before scheduling the weekly API run tells the engineer the expected cost of each execution.

Why the other options are wrong

  • A. The quota is the total allowance for the tenant, not the cost of a particular query.
  • B. Query Status shows whether the query is running, completed or failed, not its compute cost.
  • C. Compute Unit Usage reports units already consumed by API and cold storage queries, so it shows nothing for a query that has only been tested.

Question 3

Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file.

What can be inferred about the affected users’ inability to print?

  1. They may have a host firewall profile set to block activity to all network-attached printers.
  2. They may be on different device extensions profiles set to block different print jobs.
  3. They may be attached to the default extensions policy and profile.
  4. They may have different disk encryption profiles that are not allowing print jobs on encrypted files.
Show answer and explanation

Correct answer: B. They may be on different device extensions profiles set to block different print jobs.

Cortex XDR controls printing through device extensions settings, which can block specific types of print jobs such as network printer jobs, local printer jobs and printing to file. Because the affected users show different patterns, with some able to print only at home and others only to file, they are most likely covered by different device extensions profiles, each blocking a different set of print job types.

Why the other options are wrong

  • A. Host firewall rules govern network connections and would not explain users who can print only to file.
  • C. A single shared default profile would give every affected user the same printing behavior, not the different patterns reported.
  • D. Disk encryption profiles manage drive encryption and do not control print jobs.

See all 8 free questions Get the full pack, US$39

How much of the Palo Alto Networks XDR Engineer bank is free?

59 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 29the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 59100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the Palo Alto Networks XDR Engineer pack

  • 59 questions mapped to the XDR Engineer exam objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Delivered by email shortly after checkout
  • Free monthly updates
  • Pass or your money back

Check Palo Alto Networks for the current exam price. This pack is US$39, paid once, and refunded if you fail.

What makes the XDR Engineer hard

XDR Engineer is the build side of Cortex XDR. The Analyst exam asks what an alert means. This one asks how the agent, the tenant and the data sources were set up so the alert fires at all.

Palo Alto Networks lists installation and deployment configuration, post deployment management, data source onboarding and integration configuration, playbook creation and detection engineering. Expect questions on agent profiles and policies, Broker VM, log ingestion and parsing, and why a detection rule did or did not trigger.

About the exam

The Palo Alto Networks Certified XDR Engineer is a Specialist level certification in the Security Operations track. It validates installing and configuring Cortex XDR, post deployment management, onboarding data sources and configuring integrations, creating playbooks and detection engineering. It is aimed at security operations, XDR, SOC and detection engineers. Palo Alto Networks recommends its digital learning path and the Cortex XDR: Security Operations and Integration course.

Exam skill areas

  • Installation and deployment configuration
  • Post deployment management and configuration
  • Data source onboarding and integration configuration
  • Playbook creation
  • Detection engineering

Read next: Palo Alto Certifications in 2026: Which One for Which Job?

Questions before you buy

How quickly do I receive it?

Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products