Palo Alto Networks XDR-Engineer Exam Prep
Palo Alto Networks Certified XDR Engineer (Page 3 )

• MTTC: Time required to contain or limit the incident’s impact — best match.
• MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.
• MTTD: How long it takes to discover the incident.
• MTBF: Average time between failures, generally a reliability metric.

• Data Cloud combines data from multiple systems.
• It resolves and organizes that data into a unified customer view.
• That unified view enables downstream actions such as personalized campaigns, segmentation, analytics, and activation.

• A = core platform value
• D = a resulting business use case or benefit

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

spl 
error AND host=WWW3 
status=404 OR status=500 
NOT source=access.log

• Quotation marks are used for exact phrases or values containing spaces.
• Parentheses group parts of a Boolean expression, but they are not required for every Boolean search.

• VPC: A logically isolated virtual network within a cloud provider; it describes network design, not the user-access model.
• NFV: Runs network services as software instead of on dedicated hardware.
• SaaS: Delivers software over the internet. Although the application may be delivered as SaaS, the question emphasizes its availability to multiple user groups, which points to multitenancy.

• Due diligence: Investigating and evaluating a third party before entering into or continuing a business relationship.
• Attestation: An independent party provides assurance about an organization’s claims or controls. A SOC 2 examination is an example of an attestation engagement, but the analyst requesting and reviewing the report is performing due diligence.
• Internal audit: Reviews the organization’s own internal controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Design Studio > Emails ? create an email-template folder
• Design Studio > Landing Pages ? create a landing-page-template folder
• Add the relevant assets to each folder
• Right-click the folder and choose Share Folder
• Select the destination workspaces

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• Outer packet: 10.5.1.1 > 52.165.16.154
• IPv4 protocol field: 41, which indicates IPv6 encapsulation
• Inner packet: IPv6 traffic between 2001:... addresses

• MAC address spoofing: Changes Layer 2 addressing; it does not explain the IPv6-in-IPv4 structure.
• Steganography: Hides data inside files or media, not visibly in a tunneled protocol.
• Broken encryption: No evidence of encryption being cracked.
• On-path sniffing: Involves intercepting traffic, not sending data to an external host.

• JDBC
• SnowSQL
• Snowflake Web Interface (UI)
• ODBC
• Python connector

• Deterrent control: The signs warning people they may be filmed discourage unauthorized or malicious behavior. They may prevent incidents by influencing behavior, but their primary purpose is to deter.
• Detective control: The CCTV system monitors and records activity so security personnel can identify suspicious or unauthorized actions.

• Preventive: Blocks or prevents an incident, such as a lock or access-control system.
• Corrective: Fixes or restores systems after an incident.
• Directive: Tells people what they must do, typically through policies or procedures.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• miami.weyland.com requires a custom domain, which is not available in the Free tier.
• Two instances require a tier that supports scaling out. Standard supports multiple instances.
• SSL support is available in Standard.
• 12 GB of storage exceeds the storage limit of the Basic tier in the older Azure pricing model used by this question.
• Standard provides sufficient storage and features while being cheaper than higher tiers—though higher tiers are not listed here.

• Free/Shared: insufficient features for custom domains, SSL, and multiple instances.
• Basic: supports some production features, but its storage capacity is insufficient for the required 12 GB.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• Injection
• Broken access control
• Authentication failures
• Security misconfiguration
• Cross-site scripting

• STIX: A standardized language and format for exchanging threat intelligence.
• OVAL: Used to describe and assess system vulnerabilities and configuration issues.
• Threat intelligence feed: Provides current indicators and intelligence about threats, but not necessarily a structured overview of common application exploitation methods.
• CVE: A catalog of individually identified, publicly disclosed vulnerabilities.

• Reporting relationships
• Organizational structures
• Leadership styles
• Team maturity
• Individual and group behavior
• Communication and motivation

• Acquire Project Team: Focuses on obtaining the people needed for the project.
• Develop Project Team: Focuses on improving team skills, relationships, and performance.
• Manage Project Team: Focuses on tracking performance, resolving issues, and managing changes within the team.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: A sophisticated attack sponsored by a government.
• Shadow IT: Unapproved technology or access methods used by employees.

• Due diligence: Researching and evaluating a third party before entering or continuing a business relationship.
• Internal audit: Evaluates controls within the organization itself.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A formal statement or report—such as a SOC 2 report—provided by an independent party about an organization’s controls.

• B — Notify affected business units: Notification should follow an initial determination of scope and impact; otherwise, the organization may communicate incomplete or inaccurate requirements.
• C — Assess noncompliance risk: Risk assessment requires understanding the regulation’s requirements first.
• D — Inform senior management: Management should be informed, but with a clear summary of the regulation’s impact, risks, and recommended actions.

• Third-party attestation: Provides independent validation, but is typically periodic and performed by an external party.
• Penetration testing: Simulates attacks to identify exploitable vulnerabilities; it does not primarily track compliance.
• Vulnerability scans: Identify technical weaknesses, but do not provide a detailed review of procedures or compliance activities.

• Documented and formally requested
• Analyzed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked and reversible if problems occur

• Risk management process: Identifies and evaluates risk, but does not directly authorize design changes.
• Product design process: Applies primarily while creating or developing the product.
• Design review process: May have identified the issues, but the next step for changing an already released design is controlled change management.

• CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.
• IPsec: Provides authentication, integrity, and encryption for IP communications.
• EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

• Create the field in the CRM on the relevant person records—typically Lead and Contact in Salesforce.
• Give the Marketo Sync User read/write access to the field.

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

• B: Developer Edition has limited user, storage, and data-volume capacity, making realistic community testing difficult.
• C: A Developer Edition org cannot contain sandboxes, so it cannot provide separate environments for development, integration, and UAT.
• E: A standalone Developer Edition org is not part of the production org’s deployment path, so change sets cannot be used to deploy from it directly to that production org. The team would need Metadata API, Salesforce CLI, or another deployment method.

• UPS battery-backed outlets: Connect only essential devices needed during an outage:

• Surge-protector-only outlets: Connect nonessential devices, especially the printer. Printing does not need to continue while you are saving work and shutting down.
• UPS power source: Plug the UPS directly into a wall outlet.
• Surge protector power source: Plug it directly into a wall outlet as well. Do not normally plug a surge protector into the UPS, because that creates a daisy chain and can overload the UPS.

• Training or coaching
• Mentoring
• Additional support or resources
• Targeted performance improvement plans

• A: Recognition may be appropriate, but awards do not address identified gaps.
• C: Rotating schedules does not necessarily improve the specific competencies that are missing.
• D: Assessment results should be handled sensitively, but keeping them entirely private prevents useful feedback and development discussions.

• IaaS: You deploy and manage virtual machines, including the operating system and installed software. Azure manages the physical datacenter, hosts, and networking infrastructure.
• PaaS: Azure manages the infrastructure and operating system, while you deploy and manage your application code. Examples include Azure App Service and Azure Functions.

• A user connects with their Google account.
• Google associates the user’s SSH key with that identity.
• IAM roles determine whether they can log in.
• Access can be tied to a specific employee for auditing.
• Removing the IAM role removes their login access.

• compute.osLogin: regular OS login access
• compute.osAdminLogin: OS login with administrative privileges, typically including sudo

text 
enable-oslogin=TRUE

• AB’s own PPE: $100m
• CD’s PPE in its individual accounts: $50m
• Fair value uplift at acquisition: $40m
• Remaining useful life: 10 years
• Extra depreciation each year: $40m ÷ 10 = $4m
• Four years’ extra depreciation to 31 December 20X4: 4 × $4m = $16m
• Remaining fair value uplift: $40m - $16m = $24m

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

• 10 minutes have elapsed, or
• 20 MB of accounting data has accumulated

• sn_si_admin is an SIR administrator role.
• The prefix helps prevent naming conflicts between applications.
• It does not refer to a “Secure Identity token” or an instance security check.

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Reduce the training data: Usually makes overfitting worse.
• Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.
• Increase training time: More training can worsen overfitting if the model is already memorizing the training data.

• Bronze: Raw ingested data
• Silver: Cleaned, validated, and transformed data
• Gold: Business-level data for analytics, dashboards, and reporting

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• A is correct: It establishes the revised dates and identifies the effect on the critical path.
• B is premature: Stakeholders should be informed after the impact has been assessed and the updated schedule is understood.
• C is not automatically appropriate: Fast-tracking may introduce additional risk and should be considered only after analyzing schedule options.
• D is premature: Adding resources may not resolve a dependency and could increase costs without addressing the actual constraint.

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• Disable high concurrency: Changes workspace-wide behavior and is not the targeted way to isolate these workloads.
• Modify the number of executors: Adjusts capacity and performance, but does not provide workload isolation.
• Set the default environment: Controls libraries and runtime configuration, not compute isolation.

• 25 — Traditional SMTP server-to-server mail delivery; often restricted and not the usual client submission port.
• 110 — POP3, used for retrieving email; normally unencrypted.
• 143 — IMAP, used for retrieving and synchronizing email; normally unencrypted.

• Storage usage of files stored in Microsoft Teams: SharePoint site usage report

• Number of active users per team: Microsoft Teams usage report

1. SharePoint site usage report
2. Microsoft Teams usage report

• Azure Resource Manager (ARM) templates define the virtual machines and related Azure resources declaratively. You can deploy the same template repeatedly, ensuring consistent VM sizes, networking, storage, extensions, and other infrastructure settings.

• PowerShell DSC extension applies and maintains the required Windows configuration inside each VM. DSC is state-based: if a setting changes or becomes incorrect, DSC can bring it back to the desired configuration.

• Azure Pipelines deployment groups organize deployment targets, but they do not primarily enforce ongoing VM configuration.
• Custom Script Extension runs setup scripts, but it is generally less maintainable and does not continuously enforce configuration like DSC.
• Pipeline stage templates reuse pipeline workflow definitions; they do not configure the VMs themselves.

text 
user<TAB>action<TAB>status

text 
user|action|status

• Colons: Although colons commonly appear in log data, they are not a supported delimiter choice in the FX workflow described by this exam question.
• Spaces: Spaces are not treated as a supported delimiter for this extraction method; ordinary text often contains variable spacing.

• A hypervisor allows multiple virtual machines to run on one physical server.
• Each VM can have its own operating system, so the customer can consolidate Windows, Linux, and Unix servers.
• A Type 2 hypervisor runs on a host operating system and can be deployed on local hardware, helping address data privacy and avoiding ongoing public-cloud charges.

• Containers share the host operating system’s kernel.
• They are well suited to consolidating applications, but they generally cannot independently run a mix of unrelated kernels such as Windows, Linux, and Unix on one host.