Palo Alto Networks XDR Engineer - XDR-Engineer 시험문제 [2026]

문제1
The most recent Cortex XDR agents are being installed at a newly acquired company. A list with endpoint types (i.e., OS, hardware, software) is provided to the engineer. What should be cross- referenced for the Linux systems listed regarding the OS types and OS versions supported?

A. Content Compatibility Matrix

B. Kernel Module Version Support

C. Agent Installer Certificate

D. End-of-Life Summary

정답: B

설명: (KoreaDumps 회원만 볼 수 있음)

문제2
Which configuration profile option with an available built-in template can be applied to both Windows and Linux systems by using XDR Collector?

A. Filebeat

B. XDR Collector settings

C. HTTP Collector template

D. Winlogbeat

정답: A

설명: (KoreaDumps 회원만 볼 수 있음)

문제3
Based on the image of a validated false positive alert below, which action is recommended for resolution?

A. Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module

B. Create an exception for OUTLOOK.EXE for ROP Mitigation Module

C. Disable an action to the CGO Process DWWIN.EXE

D. Create an alert exclusion for OUTLOOK.EXE

정답: B

설명: (KoreaDumps 회원만 볼 수 있음)

문제4
Which method will drop undesired logs and reduce the amount of data being ingested?

A. [COLLECT:vendor="vendor", product="product", target_dataset="", no_hit=drop] * drop _raw_log contains "undesired logs";

B. [INGEST:vendor="vendor", product="product",
target_dataset="vendor_product_raw",no_hit=drop] * filter _raw_log not contains "undesired logs";

C. [COLLECT:vendor="vendor", product="product", target_brokers="", no_hit=drop] * drop _raw_log contains "undesired logs";

D. [INGEST:vendor="vendor", product="product", target_brokers="vendor_product_raw", no_hit=keep] * filter _raw_log not contains "undesired logs";

정답: B

설명: (KoreaDumps 회원만 볼 수 있음)

문제5
An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

A. CONST

B. RULE

C. FILTER

D. INGEST

정답: B

설명: (KoreaDumps 회원만 볼 수 있음)

문제6
A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center. Which available column should be checked to determine how many compute units will be used when the query is run?

A. Compute Unit Quota

B. Compute Unit Usage

C. Query Status

D. Simulated Compute Units

정답: D

설명: (KoreaDumps 회원만 볼 수 있음)

문제7
Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

A. dataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and action_process_image_command_line != "*cmd.exe -a /c*"

B. dataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name =
"**"and action_process_image_command_line = "-e cmd*"and
action_process_image_command_line != "*cmd.exe -a /c*"

C. dataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = "**"and action_process_image_command_line = "-e cmd*"and action_process_image_command_line != "*cmd.exe -a /c*"

D. dataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname"| filter lowercase(action_file_path) in ("/etc/*",
"/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt")| fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path

정답: A

설명: (KoreaDumps 회원만 볼 수 있음)

최신Palo Alto Networks XDR Engineer - XDR-Engineer무료샘플문제

KoreaDumps의 제품으로 GO GO GO !

자격증의 중요성:

KoreaDumps 제품의 가치:

무료샘플 받아보기:

완벽한 서비스 제공: