Palo Alto Networks XDR-Engineer : Palo Alto Networks XDR Engineer

시험 문제는 시시각각 바뀌고, 학습 자료도 그에 맞춰 달라져야 합니다. ITDumpsKR은 XDR-Engineer 연습문제 83문항을 2026년 최신 경향에 맞춰 수시로 업데이트하고 있습니다. 구매 후 365일 동안은 업데이트를 무료로 받아보실 수 있습니다.

Palo Alto Networks XDR-Engineer 시험 개요:

Palo Alto Networks XDR-Engineer 시험 요강 주제:

Palo Alto Networks XDR-Engineer 응시 전 알아두어야 할 질문들

최신 Security Operations XDR-Engineer 무료샘플문제

문제 #1

Which two Cortex XDR features can be configured to mitigate a potential spike in bandwidth consumption during a Cortex XDR agent upgrade? (Choose two.)

A. Amount of parallel upgrades in the Agent Configurations page
B. Critical environment versions
C. Network location configuration in the agent settings
D. Local agent settings with caching enabled on Broker VM

문제 #2

A Cortex XDR engineer needs to identify endpoints that contacted uncommon external domains before executing unsigned binaries within the same investigation period. Which method is most effective?

A. Asset Inventory Search
B. Endpoint Group Filtering
C. Incident Comment Review
D. XQL Correlation Hunting

문제 #3

During a recent internal purple team exercise, the following recommendation is given to the detection engineering team: Detect and prevent command line invocation of Python on Windows endpoints by non-technical business units. Which rule type should be implemented?

A. Analytics Behavioral Indicator of Compromise (ABIOC)
B. Correlation
C. Indicator of Compromise (IOC)
D. Behavioral Indicator of Compromise (BIOC)

문제 #4

An XDR engineer is creating a correlation rule to monitor login activity on specific systems. When the activity is identified, an alert is created. The alerts are being generated properly but are missing the username when viewed. How can the username information be included in the alerts?

A. Select "Initial Access" in the MITRE ATT&CK mapping to include the username
B. Update the query in the correlation rule to include the username field
C. Add a mapping for the username field in the alert fields mapping
D. Add a drill-down query to the alert which pulls the username field

문제 #5

A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)
[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]

A. Modify the behavioral indicator of compromise (BIOC) logic
B. Apply an alert exclusion to the XDR behavioral indicator of compromise (BIOC) alert
C. Apply an alert exception
D. Apply an alert exclusion to the XDR agent alert

질문과 대답: