Free Palo Alto Networks XDR-Engineer Exam Dumps Questions & Answers

Which configuration profile option with an available built-in template can be applied to both Windows and Linux systems by using XDR Collector?

• A.  HTTP Collector template
• B.  Winlogbeat
• C.  Filebeat
• D.  XDR Collector settings

In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?

• A.  Valid SQL query targeting the desired data
• B.  Access to the database transaction log
• C.  Database schema exported in the correct format
• D.  Access to the database audit log

An XDR engineer is creating a correlation rule to monitor login activity on specific systems. When the activity is identified, an alert is created. The alerts are being generated properly but are missing the username when viewed. How can the username information be included in the alerts?

• A.  Add a mapping for the username field in the alert fields mapping
• B.  Update the query in the correlation rule to include the username field
• C.  Select "Initial Access" in the MITRE ATT&CK mapping to include the username
• D.  Add a drill-down query to the alert which pulls the username field

A Cortex XDR engineer needs to identify endpoints that contacted uncommon external domains before executing unsigned binaries within the same investigation period. Which method is most effective?

• A.  Endpoint Group Filtering
• B.  XQL Correlation Hunting
• C.  Asset Inventory Search
• D.  Incident Comment Review

During a recent internal purple team exercise, the following recommendation is given to the detection engineering team: Detect and prevent command line invocation of Python on Windows endpoints by non-technical business units. Which rule type should be implemented?

• A.  Correlation
• B.  Indicator of Compromise (IOC)
• C.  Analytics Behavioral Indicator of Compromise (ABIOC)
• D.  Behavioral Indicator of Compromise (BIOC)