XDR-ENGINEER: Palo Alto Networks Certified XDR EngineerDemo

By Palo Alto Networks · Browse Mode
About the Exam

XDR Engineer is a Specialist-level Palo Alto Networks certification for security operations professionals working with Cortex XDR. It is aimed at security operations engineers, security engineers, XDR and SOC engineers, detection engineers, security architects, and support engineers responsible for deployment, configuration, onboarding, playbook creation, and troubleshooting. Passing demonstrates knowledge and skills in installation, deployment configuration, post-deployment management, data source onboarding and integration, playbook creation, and detection engineering in Cortex XDR environments.

Exam Topics

  • Planning and Installation14%
  • Cortex XDR Agent Configuration22%
  • Ingestion and Automation22%
  • Detection and Reporting22%
  • Maintenance and Troubleshooting20%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated June 23, 2026 at 7:27 AM

Topic filter
Retired questions
Question sort

QuestionQ1

Ingestion and Automation

How can a customer ingest extra events from a Windows DHCP server into Cortex XDR with minimal configuration?

  • A Install the XDR Collector.
  • B Enable HTTP collector integration.
  • C Activate Windows Event Collector (WEC).
  • D Install the Cortex XDR agent.
Explanation

Cortex XDR supports Windows DHCP log ingestion through an XDR Collector that uses Elasticsearch Filebeat and the Windows DHCP data source. Cortex XDR provides DHCP configuration templates for Windows collector profiles, making this the appropriate low-configuration ingestion method.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Cortex XDR Agent Configuration

The latest Cortex XDR agents are being deployed at a newly acquired company. An endpoint-type list (that is, OS, hardware, and software) has been provided to the engineer.

For the listed Linux systems, what should be cross-referenced regarding supported OS types and OS versions?

  • A Kernel Module Version Support
  • B Content Compatibility matrix
  • C End-of-life summary
  • D Agent Installer Certificate
Explanation

Cortex XDR Linux support is determined by the supported kernel versions associated with each Linux distribution and release. Palo Alto Networks maintains these OS and kernel mappings in the Latest Kernel Module Version Support documentation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Ingestion and Automation

A query is created to run weekly through an API. After it has been tested and is ready, it is reviewed in the Query Center.

Which available column should be checked to identify how many compute units will be used when the query runs?

  • A Compute Unit Quota
  • B Query Status
  • C Compute Unit Usage
  • D Simulated Compute Units
Explanation

For XQL queries, the Compute Unit Usage field indicates the number of query units used to execute API and Cold Storage queries, making it the relevant per-query consumption measure.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Maintenance and Troubleshooting

Some employees can print documents while working from home, but cannot print to network-attached printers; others can print only to a file.

What can be inferred about why the affected users cannot print?

  • A They may have a host firewall profile set to block activity to all network-attached printers.
  • B They may be on different device extensions profiles set to block different print jobs.
  • C They may be attached to the default extensions policy and profile.
  • D They may have different disk encryption profiles that are not allowing print jobs on encrypted files.
Explanation

A host firewall profile can block the network traffic required to communicate with network-attached printers without affecting print-to-file operations, which do not require connectivity to a network printer.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Detection and Reporting

Which two actions can be triggered by a dashboard drilldown?

Choose two
  • A Initiate automated response actions.
  • B Navigate to a different dashboard.
  • C Send alerts to console users.
  • D Link to an XQL query.
Explanation

Dashboard drilldowns can open a target dashboard or open XQL Search to run an XQL query using the clicked value. They do not initiate automated response actions or send alerts to console users.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

That's the end of the preview

It's free

100% of the questions are free for all users.
No strings attached.

Sign up freeLog in
Topics covered
Planning and InstallationCortex XDR Agent ConfigurationIngestion and AutomationDetection and ReportingMaintenance and Troubleshooting
Know a question that should be here? Contribute to this exam
Back home