XDR-Engineer : BUNDLE PACK LEARNING TOOLS INCLUDED

Level: Specialist
Format: Certification
Platform: Security Operations

This certification validates experienced security operations engineers on their knowledge and skills in installation, deployment configuration, post-deployment management and configuration, data source onboarding and integration configuration, playbook creation, and detection engineering using Cortex XDR in security operations environments.

This certification is designed for security operations engineers, security engineers, XDR and SOC engineers, detection engineers, security architects, security operations support engineers, and individuals responsible for deployment, configuration, data onboarding, playbook creation, and troubleshooting in security operations environments.

Palo Alto Networks – Cortex XDR Engineer Certification
* Certification Name: Palo Alto Networks Certified XDR Engineer
* Target Audience: Security operations engineers experienced with Cortex XDR

* Exam Objectives:
* Installation and deployment configuration
* Post-deployment management
* Data source onboarding and integration
* Playbook creation
* Detection engineering
* Exam Format: Computer-based assessment with multiple-choice, matching, and ordering questions
* Duration: 90 minutes, including onboarding and NDA time

* Preparation Resources:
* Review topics and subtopics in the datasheet
* Complete courses in the digital learning path as needed

Sample Question and Answers

QUESTION 1
[Data Ingestion and Integration]
An administrator wants to employ reusable rules within custom parsing rules to apply consistent log
field extraction across multiple data sources. Which section of the parsing rule should the
administrator use to define those reusable rules in Cortex XDR?

A. RULE
B. INGEST
C. FILTER
D. CONST

Answer: D

QUESTION 2
[Data Ingestion and Integration]
What will be the output of the function below?
L_TRIM("a* aapple", "a")

A. ' aapple'
B. " aapple"
C. "pple"
D. " aapple-"

Answer: A

QUESTION 3
[Data Ingestion and Integration]
How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

A. Activate Windows Event Collector (WEC)
B. Install the XDR Collector
C. Enable HTTP collector integration
D. Install the Cortex XDR agent

Answer: B

QUESTION 4
[Cortex XDR Agent Configuration]
How are dynamic endpoint groups created and managed in Cortex XDR?

A. Endpoint groups require intervention to update the group with new endpoints when a new device is added to the network
B. Each endpoint can belong to multiple groups simultaneously, allowing different security policies to be applied to the same device at the same time
C. After an endpoint group is created, its assigned security policy cannot be changed without deleting and recreating the group
D. Endpoint groups are defined based on fields such as OS type, OS version, and network segment

Answer: D

QUESTION 5
[Dashboards and Reporting]
An engineer is building a dashboard to visualize the number of alerts from various sources.
One of the widgets from the dashboard is shown in the image below:
The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of
the alert names and view those alerts with additional relevant details. The engineer has configured
the following XQL query to meet the requirement:
dataset = alerts
| fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id
| filter alert_name =
| sort desc _time
How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?

A. $y_axis.value
B. $x_axis.value
C. $x_axis.name
D. $y_axis.name

Answer: B