Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Palo Alto Networks
  5. XDR-Engineer

Palo Alto Networks XDR-Engineer Exam Questions
Palo Alto Networks Certified XDR Engineer (Page 4 )

Updated On: 15-Feb-2026
Page 2 of 11
PDF with 50 Questions

[Data Ingestion and Integration]
An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources.
Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

  1. RULE
  2. INGEST
  3. FILTER
  4. CONST

Answer(s): D



[Data Ingestion and Integration]
What will be the output of the function below?
L_TRIM("a* aapple", "a")

  1. ' aapple'
  2. " aapple"
  3. "pple"
  4. " aapple-"

Answer(s): A



[Data Ingestion and Integration]
How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

  1. Activate Windows Event Collector (WEC)
  2. Install the XDR Collector
  3. Enable HTTP collector integration
  4. Install the Cortex XDR agent

Answer(s): B



[Cortex XDR Agent Configuration]
How are dynamic endpoint groups created and managed in Cortex XDR?

  1. Endpoint groups require intervention to update the group with new endpoints when a new device is added to the network
  2. Each endpoint can belong to multiple groups simultaneously, allowing different security policies to be applied to the same device at the same time
  3. After an endpoint group is created, its assigned security policy cannot be changed without deleting and recreating the group
  4. Endpoint groups are defined based on fields such as OS type, OS version, and network segment

Answer(s): D



[Dashboards and Reporting]
An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:



The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configured the following XQL query to meet the requirement:

dataset = alerts
| fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id | filter alert_name =
| sort desc _time
How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?

  1. $y_axis.value
  2. $x_axis.value
  3. $x_axis.name
  4. $y_axis.name

Answer(s): B






Post your Comments and Discuss Palo Alto Networks XDR-Engineer exam dumps with other Community members:

Join the XDR-Engineer Discussion