Free Palo Alto Networks XDR-Engineer Exam Dumps Questions & Answers

After deploying Cortex XDR agents to a large group of endpoints, some of the endpoints have a partially protected status. In which two places can insights into what is contributing to this status be located? (Choose two.)

• A.  All Endpoints page
• B.  Asset Inventory
• C.  Management Audit Logs
• D.  XQL query of the endpoints dataset

Which two Cortex XDR features can be configured to mitigate a potential spike in bandwidth consumption during a Cortex XDR agent upgrade? (Choose two.)

• A.  Network location configuration in the agent settings
• B.  Amount of parallel upgrades in the Agent Configurations page
• C.  Local agent settings with caching enabled on Broker VM
• D.  Critical environment versions

What happens when two or more values are specified for a disable prevention rule in Cortex XDR to allow file execution?

• A.  The rule is ignored if multiple values are specified for the target properties.
• B.  The rule automatically applies to all files regardless of their properties.
• C.  The exception is applied if the file satisfies all of the specified target properties.
• D.  The rule applies if the file satisfies any of the specified target properties.

A Cortex XDR agent needs to be uninstalled from two Windows machines that are no longer connected to the Cortex XDR tenant.
The uninstall password for the machines is not known.
Which set of actions should be taken to resolve this issue?

• A.  Boot the machines in safe mode then uninstall the agent.
• B.  Copy the original agent MSI installer to each machine then run Msiexec.exe with /x option.
• C.  Run the cytool.exe protect disable command on each machine then uninstall the agent.
• D.  Stop the Cortex XDR services and delete the Cortex XDR folders and registry hives.

Which troubleshooting step should be performed first to determine why logs from a third-party firewall do not appear in Cortex XDR?

• A.  Disable all other data sources in XDR to isolate the third-party firewall logs, ensuring that no other logs interfere with the ingestion process.
• B.  Immediately reset the XDR data ingestion module and clear all stored logs, as reconfiguring the data ingestion pipeline will ensure proper log collection.
• C.  Determine whether the firewall's log forwarding settings match the XDR ingestion requirements, ensuring the correctlog format and transport protocol.
• D.  Modify the XDR correlation rules to manually import the missing logs, as logs that do not match predefined rules will not be ingested into the system.