Free Palo Alto Networks XDR-Engineer Exam Dumps Questions & Answers

Based on the SBAC scenario image below, when the tenant is switched to permissive mode, which endpoint(s) data will be accessible?

• A.E2 only
• B.E1, E2, E3, and E4
• C.E1, E2, and E3
• D.E1 only

Which troubleshooting step should be performed first to determine why logs from a third-party firewall do not appear in Cortex XDR?

• A.Immediately reset the XDR data ingestion module and clear all stored logs, as reconfiguring the data ingestion pipeline will ensure proper log collection.
• B.Determine whether the firewall's log forwarding settings match the XDR ingestion requirements, ensuring the correctlog format and transport protocol.
• C.Modify the XDR correlation rules to manually import the missing logs, as logs that do not match predefined rules will not be ingested into the system.
• D.Disable all other data sources in XDR to isolate the third-party firewall logs, ensuring that no other logs interfere with the ingestion process.

What information can be used to create a dynamic endpoint group?

• A.IP address
• B.MAC address
• C.Logged-on user
• D.Installed software

Which statement describes the functionality of fixed filters and dashboard drilldowns in enhancing a dashboard's interactivity and data insights?

• A.Fixed filters limit the data visible in widgets, while dashboard drilldowns allow users to download data from the dashboard in various formats
• B.Fixed filters allow users to select predefined data values, while dashboard drilldowns enable users to alter the scope of the data displayed by selecting filter values from the dashboard header
• C.Fixed filters allow users to adjust the layout, while dashboard drilldowns provide links to external reports and/or dashboards
• D.Fixed filters let users select predefined or dynamic values to adjust the scope, while dashboard drilldowns provide interactive insights or trigger contextual changes, like linking to XQL searches

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

• A.Between 10 and 20 minutes
• B.Between 30 and 45 minutes
• C.Immediately
• D.5 minutes or less