XDR-Engineer: Palo Alto Networks Certified XDR Engineer Practice Exam

What the XDR-Engineer exam covers

• Planning and Installation107 questions
• Cortex XDR Agent Configuration167 questions
• Ingestion and Automation169 questions
• Detection and Reporting165 questions
• Maintenance and Troubleshooting153 questions

Free XDR-Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 761.

1. Question 1Planning and Installation

   At a high level, which operating system families does the Cortex XDR agent support for endpoint protection?

   • AOnly mobile operating systems
   • BOnly Windows Server editions
   • COnly mainframe operating systems
   • DWindows, macOS, and LinuxCorrect
   ✓ Correct answer: D

   Cortex XDR is designed to protect a broad range of endpoints across common desktop and server operating systems, including Windows, macOS, and Linux distributions. Specific supported versions should be verified against current documentation, but these three families represent the general platform coverage.

   Why the other options are wrong

   • AMobile operating systems are not the primary focus of the traditional endpoint agent.
   • BSupport extends well beyond Windows Server to include desktops and other operating systems.
   • CMainframe operating systems are not part of the supported endpoint platform list.
2. Question 2Planning and InstallationSelect all that apply

   Which two statements about Broker VM high availability clustering are correct? (Choose two.)

   • AEvery broker in a cluster must run a completely different applet
   • BMultiple Broker VMs can be grouped to add redundancy for an appletCorrect
   • CIf the active node for an applet fails, another member can take overCorrect
   • DA cluster can only include brokers registered to different Cortex XDR tenants
   • EClustering removes the requirement to register any broker VM at all
   ✓ Correct answer: B, C

   Grouping several Broker VMs into a cluster is meant to provide high availability, so that if the node currently serving an applet becomes unavailable, another member of the cluster can continue providing that service. This avoids a single broker being a point of failure for that function.

   Why the other options are wrong

   • ACluster members can be configured with overlapping applet roles to support failover, rather than each being forced to run something completely different.
   • DA cluster is formed from brokers within the same tenant's deployment, not across different tenants.
   • ERegistration is still required for each broker VM even when it participates in a cluster.
3. Question 3Cortex XDR Agent ConfigurationSelect all that apply

   (Choose three.) Which access levels can typically be assigned to a removable storage device class in a Device Control rule?

   • AAllow read only access to the connected deviceCorrect
   • BAutomatically encrypt data written to the device
   • CBlock the device from connecting at allCorrect
   • DGrant full read and write access to the deviceCorrect
   • EQuarantine the device's driver upon connection
   ✓ Correct answer: A, C, D

   These access levels let administrators tailor how a device class behaves, from allowing unrestricted use, to permitting only reading data off the device, to blocking the class entirely.

   Why the other options are wrong

   • BAutomatic encryption of a device is not an access level offered by Device Control rules.
   • EQuarantining a device driver is not a documented Device Control access level for storage classes.
4. Question 4Cortex XDR Agent Configuration

   An approved administrative tool is blocked because it launches a child process that matches a restrictions rule. Which exception addresses this without broadly weakening protection?

   • AAn alert exclusion for the resulting alert only
   • BA global disable of restrictions for all endpoints
   • CA restrictions exception scoped to that exact patternCorrect
   • DA support exception opened before trying anything else
   ✓ Correct answer: C

   Because the conflict is specific to one tool's expected child-process behavior, a narrowly scoped restrictions exception permits that exact pattern while the restrictions module continues to protect against other unexpected child processes. A global disable removes that protection everywhere, and an alert exclusion would not stop the block from occurring at all.

   Why the other options are wrong

   • AAn alert exclusion only hides the alert; it does not stop the restriction from blocking the child process.
   • BDisabling the restrictions module for all endpoints removes protection well beyond the one affected tool.
   • DA support exception is reserved for conflicts that a standard restrictions exception cannot resolve.
5. Question 5Ingestion and Automation

   Which feature lets an engineer drop unwanted records from a noisy source before that data is stored and counted against the daily ingestion allotment?

   • AAutomation playbooks
   • BBIOC detection rules
   • CCorrelation rules
   • DIngestion filtersCorrect
   ✓ Correct answer: D

   Configured under data collection settings, these filters evaluate incoming records against defined criteria and drop matches prior to storage, reducing both noise and license consumption.

   Why the other options are wrong

   • AAutomation playbooks respond to alerts and incidents, not raw ingestion volume.
   • BBIOC rules detect behavior patterns after data exists in the datasets.
   • CCorrelation rules generate alerts from already-stored data, not raw ingestion.
6. Question 6Ingestion and Automation

   Why is severity normalization important when mapping third-party alert fields into Cortex XDR's alert schema?

   • AIt permanently hides all alerts rated below critical severity from view
   • BIt ensures alerts from different sources are compared on one scaleCorrect
   • CIt converts all severity values into currency amounts used for billing
   • DIt automatically closes out any alert rated below medium severity
   ✓ Correct answer: B

   Third-party products often use their own severity scales or terminology, so mapping those values to Cortex XDR's standard levels allows analysts to triage alerts uniformly regardless of origin. Without normalization, a 'high' from one vendor might mean something different than a 'high' from another.

   Why the other options are wrong

   • ANormalization does not hide lower-severity alerts from view.
   • CSeverity has nothing to do with billing calculations.
   • DNormalization does not auto-close alerts based on severity.
7. Question 7Detection and ReportingSelect all that apply

   Which of the following methods allow a detection engineering team to operationalize IOCs at scale rather than entering them one at a time? (Choose two.)

   • AWriting a correlation rule across multiple data sources
   • BEntering indicators manually through the New Indicator dialog
   • CImporting indicators through a bulk CSV file uploadCorrect
   • DCreating an alert exclusion rule for repeated noisy alerts
   • ESyncing indicators via a threat intelligence feed integrationCorrect
   ✓ Correct answer: C, E

   Bulk CSV import allows loading many indicators from a single file, and feed integrations continuously sync indicators from an external source, both scaling far beyond entering one indicator at a time. Manual entry, exclusions, and correlation rules serve different purposes and do not provide scaled IOC ingestion.

   Why the other options are wrong

   • ACorrelation rules define multi-source detection logic and are not a mechanism for importing IOCs.
   • BManual entry through the dialog is inherently a one-at-a-time process and does not scale efficiently.
   • DAlert exclusions suppress unwanted alerts rather than adding new indicators to the platform.
8. Question 8Detection and Reporting

   Why might a detection engineering team choose to lower the reliability rating assigned to indicators from a particular threat feed?

   • AThe feed attaches a fixed expiration date to every indicator it publishes
   • BThe feed only supplies domain indicators rather than file hash indicators
   • CThe feed refreshes its complete indicator list several times each day
   • DThe feed has a documented history of generating frequent false positivesCorrect
   ✓ Correct answer: D

   Reliability ratings reflect how much trust to place in a source, so if a particular feed repeatedly supplies indicators that turn out to be inaccurate or overly broad, lowering its reliability score helps analysts appropriately deprioritize or scrutinize its alerts. This is independent of the indicator type or how frequently the feed updates.

   Why the other options are wrong

   • AIncluding expiration dates is a good practice and would not be a reason to distrust a feed.
   • BThe type of indicator a feed provides does not by itself indicate poor reliability.
   • CUpdate frequency alone does not indicate whether the indicators are accurate.
9. Question 9Maintenance and Troubleshooting

   What can happen to license entitlement if decommissioned endpoints are not properly removed?

   • AStale records can keep counting against the entitlementCorrect
   • BThe license count is unaffected once a device is powered off
   • CThe tenant automatically reclaims the seat after one hour
   • DThe endpoint is billed at double the normal per-seat rate
   ✓ Correct answer: A

   If a device is retired without uninstalling the agent or removing its record from the console, it can remain counted as a licensed endpoint. Regular cleanup of stale endpoint records is part of good license hygiene.

   Why the other options are wrong

   • BA powered-off but still-registered device can keep counting.
   • CThere is no automatic one-hour seat reclamation; cleanup is manual.
   • DStale endpoints are not billed at a doubled rate; they occupy a normal seat.
10. Question 10Maintenance and Troubleshooting

    An endpoint cannot resolve the hostnames used by the Cortex XDR cloud, although the network link itself is otherwise functional. What is the expected result?

    • AThe agent will automatically switch into a completely offline, detection-only operating mode
    • BThe agent will check in normally forever using a locally cached list of numeric addresses
    • CThe agent will fail to check in because it cannot resolve the cloud service hostnameCorrect
    • DThe agent will automatically uninstall itself following the failed resolution attempt
    ✓ Correct answer: C

    Like most cloud-connected software, the agent relies on DNS to translate the cloud service hostnames into reachable addresses; if resolution fails, the agent cannot establish a connection regardless of whether the underlying network path is healthy. Verifying DNS resolution is a standard step in isolating connectivity problems.

    Why the other options are wrong

    • AThere is no automatic offline-only detection mode triggered by DNS failure.
    • BThe agent does not rely on an indefinite cached address list to bypass DNS.
    • DA DNS failure does not trigger automatic self-uninstallation.

Related Palo Alto resources

• XDR-Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• CyberSec-Practitioner practice examRelated
• NGFW-Engineer practice examRelated
• NetSec-Pro practice examRelated

XDR-Engineer practice exam FAQ