XDR-Analyst: Palo Alto Networks Certified XDR Analyst Practice Exam

What the XDR-Analyst exam covers

• Alerting and Detection Processes171 questions
• Incident Handling and Response255 questions
• Data Analysis209 questions
• Endpoint Security Management112 questions

Free XDR-Analyst sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 747.

1. Question 1Alerting and Detection Processes

   When an analyst resolves a single alert as a false positive, what is the actual scope of that action?

   • AThe action automatically creates an exclusion policy so that identical alert patterns are never generated again.
   • BThe action permanently disables the correlation rule that generated the alert for every asset in the tenant.
   • CThe action closes only that one alert instance without stopping the rule from generating similar alerts.Correct
   • DThe action removes the correlation rule's XQL query from being evaluated on any future scheduled runs.
   ✓ Correct answer: C

   Resolving an alert is a per-alert action; it records a verdict on that instance but leaves the correlation rule and its query untouched. To actually stop similar alerts from recurring, an analyst must separately tune the rule or create an exclusion policy.

   Why the other options are wrong

   • ANo exclusion policy is created automatically; exclusions must be configured as a separate, deliberate step.
   • BResolving one alert has no effect on whether the correlation rule that produced it keeps running.
   • DThe rule's query keeps executing on its normal schedule after an individual alert is resolved.
2. Question 2Alerting and Detection Processes

   A scheduled task is created outside the normal patch window, running an unsigned binary from a temp folder. This pattern is most consistent with which tactic?

   • AInitial Access, exploiting a public facing app
   • BCollection, gathering files together for later use
   • CDiscovery, scanning the network for available shares
   • DPersistence, keeping a foothold on the hostCorrect
   ✓ Correct answer: D

   Scheduled Task Creation is a well-documented Persistence technique, since it allows malicious code to survive reboots and continue executing without further attacker interaction. The out-of-window timing and use of an unsigned binary from a temp directory both increase suspicion relative to normal, authorized patch deployment. Discovery, Collection, and Initial Access describe different attacker goals unrelated to maintaining long-term access.

   Why the other options are wrong

   • AInitial Access covers the first entry point into an environment, not post-compromise persistence.
   • BCollection covers gathering data of interest, not establishing continued access.
   • CDiscovery covers information gathering about the environment, not creating a foothold via a task.
3. Question 3Alerting and Detection Processes

   Besides the raw severity score, which factor most influences how urgently an alert should be triaged?

   • AThe criticality of the affected business assetCorrect
   • BThe alphabetical order of the affected hostname
   • CThe time zone in which the analyst is working
   • DThe number of browser tabs open on the endpoint
   ✓ Correct answer: A

   An identical alert on a business-critical system, such as a domain controller or financial database, warrants faster action than the same alert on a low-value asset because the potential impact of compromise differs greatly. Hostname naming order, analyst time zone, and incidental details like open browser tabs have no bearing on true business risk or urgency.

   Why the other options are wrong

   • BHostname alphabetization is an arbitrary sorting detail with no relation to actual risk.
   • CAnalyst time zone affects scheduling logistics, not the inherent urgency of the alert.
   • DOpen browser tabs are incidental and unrelated to the criticality of the underlying asset.
4. Question 4Incident Handling and Response

   What is the practical benefit of Cortex XDR assigning a common identifier to all events within one causality chain?

   • AIt permanently blocks the identifier from ever being reused by any future logged process
   • BIt lets analysts pivot between related events without correlating them by handCorrect
   • CIt removes the need for the endpoint agent to separately log each process ID number
   • DIt automatically applies AES encryption to every event tagged with that identifier
   ✓ Correct answer: B

   Instead of piecing together which events belong together from timestamps and process names, the analyst can rely on the shared chain identifier to instantly see everything connected to a given process lineage. This speeds up investigation and reduces the chance of missing related activity.

   Why the other options are wrong

   • AIdentifier reuse rules are not the purpose of linking events within a chain.
   • CProcess IDs are still recorded independently alongside the chain identifier.
   • DEncryption of individual events is unrelated to chain identification.
5. Question 5Incident Handling and Response

   An analyst needs to collect a copy of a suspicious executable from an endpoint to submit it for external sandbox analysis. Which capability directly supports this need?

   • AA script that only lists which services are running
   • BFile retrieval, which uploads a copy for the analystCorrect
   • CEndpoint isolation, which cuts off network traffic
   • DThe Live Terminal task manager, which lists processes
   ✓ Correct answer: B

   This action lets the analyst request that a designated file be uploaded from the endpoint, after which it can be downloaded and forwarded to sandboxing or other external analysis tools without disturbing the endpoint further.

   Why the other options are wrong

   • AA script that lists running services reports on service state, not a mechanism for exporting file contents.
   • CIsolation restricts network communication for the endpoint but does not obtain a copy of any file.
   • DThe task manager shows running processes and their details, not a way to export a file's contents.
6. Question 6Incident Handling and Response

   Why is it important for an analyst to review the entire causality chain rather than only the process that fired the alert?

   • AReviewing only the alerting process always seems faster with no real downside
   • BThe full chain can reveal how the attack began and what it later affectedCorrect
   • CCortex XDR hides the full causality chain from analysts until a case is escalated
   • DThe alerting process is fully deleted from the console once the chain is reviewed
   ✓ Correct answer: B

   Looking only at the process that triggered the alert can miss the earlier stages of an attack as well as any related activity that occurred afterward. The complete chain gives a fuller picture needed for accurate root cause and impact analysis.

   Why the other options are wrong

   • ASkipping the broader chain risks missing context, which is a real investigative downside.
   • CThe causality chain is available for review without requiring case escalation.
   • DThe alerting process remains visible in the console after being reviewed.
7. Question 7Data Analysis

   Which best describes management audit logs in Cortex XDR?

   • ARecords of registry key and value modifications made on managed endpoints
   • BRecords of network connections that were initiated by managed endpoints
   • CRecords of administrative actions performed within the Cortex XDR consoleCorrect
   • DRecords of process creation events observed on managed endpoint systems
   ✓ Correct answer: C

   Management audit logs track actions such as policy changes, user logins, and configuration updates made by administrators in the Cortex XDR console, providing accountability for console-level activity separate from endpoint telemetry.

   Why the other options are wrong

   • ARegistry modifications on endpoints are part of endpoint telemetry, not console administrative actions.
   • BNetwork connections from endpoints are recorded in xdr_data, not management audit logs.
   • DProcess creation events on endpoints belong to xdr_data telemetry, not console audit logs.
8. Question 8Data Analysis

   Why might an analyst use arrayexpand() on a field like dns_query_answers that contains multiple IP addresses per event?

   • ATo convert the IP addresses into a human-readable domain name
   • BTo remove the multi-value field entirely from the query results
   • CTo combine the IP addresses into a single hashed value for indexing
   • DTo evaluate or filter on each individual IP address as its own rowCorrect
   ✓ Correct answer: D

   Fields like dns_query_answers can hold several IP addresses per event; applying arrayexpand() separates them into individual rows so filters, joins, or aggregations can operate on each address on its own.

   Why the other options are wrong

   • AResolving IPs to domain names would require a different lookup mechanism, not arrayexpand().
   • Barrayexpand() expands the field's values into rows rather than removing the field.
   • CHashing values for indexing is not a function of arrayexpand().
9. Question 9Data Analysis

   An analyst wants to group login events by the hour of day they occurred, regardless of the date. Which XQL function is most appropriate for this task?

   • Aregextract()
   • Bextract_time()Correct
   • Ctimestamp_diff()
   • Darrayexpand()
   ✓ Correct answer: B

   extract_time() is designed to pull out a specific time component, such as the hour, from a timestamp field so events can be bucketed by that component alone.

   Why the other options are wrong

   • Aregextract() extracts substrings from text using a regex pattern, not time components.
   • Ctimestamp_diff() measures the difference between two timestamps, it does not extract a single component.
   • Darrayexpand() expands array fields into rows and is unrelated to extracting time components.
10. Question 10Endpoint Security ManagementSelect all that apply

    (Choose two.) Which actions help reclaim Cortex XDR endpoint licenses that are being held by decommissioned machines?

    • AChange the affected endpoints' operational status to Protected manually
    • BDelete the stale endpoint records from Endpoint AdministrationCorrect
    • CManually edit the content version field listed for those endpoints
    • DInitiate a full disk scan on each of the decommissioned machines directly
    • EFilter endpoints by Last Seen to find machines that are no longer checking inCorrect
    ✓ Correct answer: B, E

    Filtering the endpoint list by Last Seen identifies machines that have stopped checking in, and deleting those stale records releases their held licenses back to the pool. Operational status is not manually relabeled, running a scan does not free a license, and editing the content version field is not a supported way to reclaim a seat.

    Why the other options are wrong

    • AOperational status reflects agent behavior and cannot simply be relabeled to reclaim a license
    • CEditing a content version field is not a supported way to free a license
    • DRunning a scan does not release a license from an inactive endpoint

Related Palo Alto resources

• XDR-Analyst study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• CyberSec-Practitioner practice examRelated
• NGFW-Engineer practice examRelated
• XDR-Engineer practice examRelated

XDR-Analyst practice exam FAQ