XDR-Engineer問題集、Palo Alto Networks実際の試験問題

質問 1

An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected. Which statement explains why the automation rules might not apply to certain alerts?

A. They can be applied to any alert, but they only work if the alert is manually grouped into an incident by the analyst

B. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly

C. They only apply to new alerts grouped into incidents by the system and only alerts that generateincidents trigger automation actions

D. They can only be triggered by alerts with high severity; alerts with low or informational severity will not trigger the automation rules

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 2

An analyst considers an alert with the category of lateral movement to be allowed and not needing to be checked in the future. Based on the image below, which action can an engineer take to address the requirement?

A. Create a disable injection and prevention rule for the parent process indicated in the alert

B. Create an exception rule for the parent process and the exact command indicated in the alert

C. Create a behavioral indicator of compromise (BIOC) suppression rule for the parent process and the specific BIOC: Lateral movement

D. Create an alert exclusion rule by using the alert source and alert name

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 3

During deployment of Cortex XDR for Linux Agents, the security engineering team is asked to implement memory monitoring for agent health monitoring. Which agent service should be monitored to fulfill this request?

A. clad

B. pmd

C. pyxd

D. dypdng

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 4

In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?

A. Database schema exported in the correct format

B. Access to the database transaction log

C. Valid SQL query targeting the desired data

D. Access to the database audit log

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 5

During the deployment of a Broker VM in a high availability (HA) environment, after configuring the Broker VM FQDN, an XDR engineer must ensure agent installer availability and efficient content caching to maintain performance consistency across failovers. Which additionalconfiguration steps should the engineer take?

A. Use shared SSL certificates and keys for all Broker VMs and configure a single IP address for failover

B. Enable synchronized session persistence across Broker VMs and use a self-signed certificate and key

C. Deploy a load balancer and configure SSL termination at the load balancer

D. Upload the signed SSL server certificate and key and deploy a load balancer

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 6

Based on the image of a validated false positive alert below, which action is recommended for resolution?

A. Disable an action to the CGO Process DWWIN.EXE

B. Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module

C. Create an alert exclusion for OUTLOOK.EXE

D. Create an exception for OUTLOOK.EXE for ROP Mitigation Module

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 7

How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

A. Install the Cortex XDR agent

B. Activate Windows Event Collector (WEC)

C. Enable HTTP collector integration

D. Install the XDR Collector

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 8

An organization experiences recurring malware alerts from the same endpoint despite repeated remediation efforts. What should investigators examine first?

A. Network Throughput Statistics

B. Agent Version History

C. Persistence Mechanisms

D. Endpoint Screen Resolution

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 9

Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file. What can be inferred about the affected users' inability to print?

A. They may be on different device extensions profiles set to block different print jobs

B. They may have a host firewall profile set to block activity to all network-attached printers

C. They may have different disk encryption profiles that are not allowing print jobs on encrypted files

D. They may be attached to the default extensions policy and profile

正解: A

解説: (PassTest メンバーにのみ表示されます)

Palo Alto Networks XDR Engineer - XDR-Engineer 模擬練習