Palo Alto Networks PAN-XDRE Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRE Online Questions & Answers

• Question 1:

  An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected. Which statement explains why the automation rules might not apply to certain alerts?

  A. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly
  B. They only apply to new alerts grouped into incidents by the system and only alerts that generateincidents trigger automation actions
  C. They can only be triggered by alerts with high severity; alerts with low or informational severity will not trigger the automation rules
  D. They can be applied to any alert, but they only work if the alert is manually grouped into an incident by the analyst
  A. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly

• Question 2:

  What are two possible actions that can be triggered by a dashboard drilldown? (Choose two.)

  A. Navigate to a different dashboard
  B. Initiate automated response actions
  C. Link to an XQL query
  D. Send alerts to console users
  A. Navigate to a different dashboard
  C. Link to an XQL query

• Question 3:

  How can a Malware profile be configured to prevent a specific executable from being uploaded to the cloud?

  A. Disable on-demand file examination for the executable
  B. Set PE and DLL examination for the executable to report action mode
  C. Add the executable to the allow list for executions
  D. Create an exclusion rule for the executable
  D. Create an exclusion rule for the executable

• Question 4:

  What happens when the XDR Collector is uninstalled from an endpoint by using the Cortex XDR console?

  A. The files are removed immediately, and the machine is deleted from the system without any retention period
  B. The machine status remains active until manually removed, and the configuration data is retained for up to seven days
  C. It is uninstalled during the next heartbeat communication, machine status changes to Uninstalled, and the configuration data is retained for 90 days
  D. The associated configuration data is removed from the Action Center immediately after uninstallation
  C. It is uninstalled during the next heartbeat communication, machine status changes to Uninstalled, and the configuration data is retained for 90 days

• Question 5:

  Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

  

  A. It will immediately execute
  B. It will not execute
  C. It will execute after one hour
  D. It will execute after the second attempt
  B. It will not execute

• Question 6:

  An analyst considers an alert with the category of lateral movement to be allowed and not needing to be checked in the future. Based on the image below, which action can an engineer take to address the requirement?

  

  A. Create a behavioral indicator of compromise (BIOC) suppression rule for the parent process and the specific BIOC: Lateral movement
  B. Create an alert exclusion rule by using the alert source and alert name
  C. Create a disable injection and prevention rule for the parent process indicated in the alert
  D. Create an exception rule for the parent process and the exact command indicated in the alert
  B. Create an alert exclusion rule by using the alert source and alert name

• Question 7:

  An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

  A. RULE
  B. INGEST
  C. FILTER
  D. CONST
  D. CONST

• Question 8:

  Which components may be included in a Cortex XDR content update?

  A. Device control profiles, agent versions, and kernel support
  B. Behavioral Threat Protection (BTP) rules and local analysis logic
  C. Antivirus definitions and agent versions
  D. Firewall rules and antivirus definitions
  B. Behavioral Threat Protection (BTP) rules and local analysis logic

• Question 9:

  Using the Cortex XDR console, how can additional network access be allowed from a set of IP addresses to an isolated endpoint?

  A. Add entries in Configuration section of Security Settings
  B. Add entries in the Allowed Domains section of Security Settings for the tenant
  C. Add entries in Exceptions Configuration section of Isolation Exceptions
  D. Add entries in Response Actions section of Agent Settings profile
  C. Add entries in Exceptions Configuration section of Isolation Exceptions

• Question 10:

  Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

  A. dataset = xdr_data | filter event_type = ENUM.DEVICE and action_process_image_name = "**" and action_process_image_command_line = "-e cmd*" and action_process_image_command_line != "*cmd.exe -a /c*"
  B. dataset = xdr_data | filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = "**" and action_process_image_command_line = "-e cmd*" and action_process_image_command_line != "*cmd.exe -a /c*"
  C. dataset = xdr_data | filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname" | filter lowercase(action_file_path) in ("/etc/*", "/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt") | fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path
  D. dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "**" and action_process_image_command_line = "-e cmd*" and action_process_image_command_line != "*cmd.exe -a /c*"
  D. dataset = xdr_data | filter event_type = ENUM.PROCESS and action_process_image_name = "**" and action_process_image_command_line = "-e cmd*" and action_process_image_command_line != "*cmd.exe -a /c*"