XDR-Engineer試験無料問題集（83題）「Palo Alto Networks XDR Engineer 認定」

出題：1

An insider compromise investigation has been requested to provide evidence of an unauthorized removable drive being mounted on a company laptop. Cortex XDR agent is installed with default prevention agent settings profile and default extension "Device Configuration" profile. Where can an engineer find the evidence?

A. The requested data requires additional configuration to be captured

B. Check Host Inventory -> Mounts

C. dataset = xdr_data | filter event_type = ENUM.MOUNT and event_sub_type = ENUM.MOUNT_DRIVE_MOUNT

D. preset = device_control

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

What information can be used to create a dynamic endpoint group?

A. IP address

B. Logged-on user

C. MAC address

D. Installed software

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

A signed application from a trusted vendor unexpectedly begins spawning command shells and downloading remote payloads. Which detection method is most effective?

A. Behavioral Analytics

B. Signature Reputation Only

C. Endpoint Enumeration

D. Asset Tag Validation

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

When using Kerberos as the authentication method for Pathfinder, which two settings must be validated on the DNS server? (Choose two.)

A. Reverse DNS records

B. DNS forwarders

C. AD DS-integrated zones

D. Reverse DNS zone

正解：A,D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly regulated environment? (Choose two.)

A. Create an agent settings profile where the agent upgrade scope is maintenance releases only

B. Enable critical environment versions

C. Create an agent settings profile, enable content auto-update, and include a delay of four days

D. Enable minor content version updates

正解：A,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Based on the image of a validated false positive alert below, which action is recommended for resolution?

A. Disable an action to the CGO Process DWWIN.EXE

B. Create an exception for the CGO DWWIN.EXE for ROP Mitigation Module

C. Create an alert exclusion for OUTLOOK.EXE

D. Create an exception for OUTLOOK.EXE for ROP Mitigation Module

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?

A. Install the XDR Collector

B. Activate Windows Event Collector (WEC)

C. Enable HTTP collector integration

D. Install the Cortex XDR agent

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

A Cortex XDR engineer discovers multiple alerts generated across several endpoints. The alerts appear unrelated individually but collectively indicate coordinated malicious activity. What explains this grouping?

A. Broker VM Aggregation

B. Dynamic Incident Correlation

C. Asset Inventory Analysis

D. Endpoint naming convention

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected. What may be the cause of this behavior?

A. The filter stage is dropping the logs

B. The parsing rule corrupted the database

C. The XDR Collector is dropping the logs

D. The Broker VM is offline

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

XDR-Engineer試験無料問題集「Palo Alto Networks XDR Engineer 認定」