Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?
Incident scoring threshold override
Data stitching rule assignment
Incident starring
Incident starring lets the analyst manually flag individual incidents in the Incident View, satisfying the requirement for executive visibility of critical cases. Starred incidents surface in a dedicated filter, enabling rapid triage and prioritisation without altering severity, status, or classification. This directly addresses the need to highlight specific incidents requiring immediate executive attention.
Featured fields configuration
While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?
The incident score was manually overridden to low
Alert starring was disabled on the network data source
Featured fields were not configured for the network logs
The time delta between the endpoint and network events exceeds the stitching correlation window
Stitching correlates network and endpoint alerts only when their timestamps fall within the configured correlation window. Events separated by more than that delta are treated as unrelated, so they remain in separate incidents despite matching IP address and user.
During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?
Immediately upon correlation and grouping by the Incident Engine
The Incident Engine correlates and groups related raw alerts, and that grouping action itself creates the incident. The alert becomes actionable at correlation, not at detection or after manual analyst triage, which is why grouping defines the transition point.
Only after an analyst manually assigns a severity score
Once featured fields are populated for the data source
When the alert is starred by a tier-2 analyst
An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?
Incident scoring threshold filter
Featured fields sorting
Data stitching status toggle
Alerts View filter and search capabilities
The Alerts View supports filtering and free-text search across all alerts, letting the analyst query the external IP address directly and see every matching alert regardless of incident grouping. This satisfies the stem's constraint of avoiding per-incident inspection, since results span multiple incidents in one consolidated table.
An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?
Create an alert exclusion or exception rule
An alert exclusion rule suppresses matching low-level behavioural alerts before they reach the incident queue, directly addressing the clutter constraint. Because the scripts are legitimate and already triaged as benign, excluding them by known signature preserves analyst capacity without disabling the underlying detection logic for genuine threats.
Manually star all related alerts
Increase the data stitching window
Modify featured fields to hide script alerts
An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?
Syslog forwarding profile filters
Manual aggregation by the assigned security analyst
Cortex XDR correlation rules and analytics grouping
Cortex XDR correlation rules and analytics group related low-severity alerts from multiple endpoints into a single incident, satisfying the stem's automated grouping requirement. The analytics engine stitches these disparate endpoint detections together by shared indicators and causal relationships, rather than treating each alert in isolation.
The endpoint agent local threshold configuration
Want more Alert Lifecycle And Incident Correlation practice?
Practice this domainAn organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?
A pre-shared IPSec tunnel key configured on the perimeter firewall
A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM
Pairing requires a unique registration token generated in the Cortex XDR console under Settings > Configurations > Broker VM. The administrator enters this token during Broker VM setup, authenticating the appliance to the management console without manual certificate exchange.
An imported enterprise PKI root certificate bundle
An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal
An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?
Panther Agent Gateway
Cortex XDR Broker VM
The Broker VM acts as the local communication proxy and log collector, aggregating traffic from agents outside the corporate network and forwarding it to Cortex XDR. It satisfies the requirement for remote endpoints that cannot reach the management server directly.
Cortex XDR Agent Collector Service
Panorama Log Forwarding App
An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?
TCP port 22 for SSH tunnel maintenance
TCP port 389 and 636 for directory synchronization
TCP port 443 for HTTPS API and tenant communication
The Broker VM registers with the Cortex XDR tenant and maintains synchronisation over outbound HTTPS. Allowing TCP 443 permits this encrypted API and tenant communication, satisfying the secure connectivity requirement without exposing additional inbound ports.
TCP port 6514 for secure syslog ingestion
An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?
Data Collector > Broker VM > Agent Packages
Incidents > Actions > Export Agent
Settings > Configurations > Endpoint Settings > Install Packages
Installation packages are downloaded from Settings > Configurations > Endpoint Settings > Install Packages, which hosts the signed .msi and .pkg bundles required for silent deployment via SCCM or Intune. This location satisfies the stem's constraint of obtaining deployment-ready installers directly from the Cortex XDR management console.
Monitoring > System Health > Agent Distribution
An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?
Push an XML configuration update using Panorama
Reboot the Broker VM hypervisor with the Syslog ISO attached
Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM
Broker VM apps are managed and enabled directly through the Cortex XDR console configuration menus.
Manually compile the rsyslog.conf file via SSH on the Broker VM CLI
An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?
Microsoft .NET Framework 4.8 Runtime
IIS Web Server Role and ASP.NET
Active Directory Domain Services Client tools
Kernel headers and dependent build tools matching the running kernel version
Cortex XDR's kernel module and eBPF components compile against the running kernel, so matching kernel headers and build tools must be present before installation. Without them, agent installation or the protection module fails on Ubuntu 20.04 endpoints.
Want more Planning And Installation practice?
Practice this domainAn administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?
Response Playbooks -> Playbook Designer
Playbook Designer under Response Playbooks defines trigger conditions and automated actions, so a critical-severity alert can invoke a script that collects forensic artifacts without analyst intervention. This satisfies the automation requirement; endpoint policy rules and alert exclusions cannot execute remediation scripts conditionally on severity.
Agent Settings -> Granular Control
Security Information and Event Management (SIEM) forwarder
Data Collection rules
An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?
Modify the Agent Settings profile to stop reporting all file execution events.
Disable the BIOC rule globally in the Profiles page.
Create a local exception using the specific file hash or path within the Exceptions management page.
A local exception scoped to the specific file hash or path suppresses alerts for that known-benign internal tool while leaving the BIOC rule active for all other endpoints. This satisfies the stem's constraint of preventing future alerts without globally disabling detection coverage.
Delete the alert from the Incident View to prevent re-triggering.
An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?
To verify the hardware specifications of the endpoint
To determine how the attacker established persistence on the system
Scheduled tasks survive reboots and run automatically, so attackers use them to maintain a foothold after initial compromise. Examining the task's action, trigger and author reveals the persistence mechanism, satisfying the stem's requirement to establish how the attacker retained access rather than merely detecting the initial intrusion.
To analyze the local user group membership policies
To inspect the network throughput limits of the adapter
An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?
Network packet capture (PCAP)
Master Boot Record (MBR) analysis
Identity and authentication logs
Identity and authentication logs record each sign-in with source IP, timestamp and geolocation, letting the analyst correlate the two impossible-travel events and confirm whether the locations are genuine. This directly satisfies the stem's requirement to validate login locations, unlike endpoint or network telemetry, which lacks the identity-provider context Microsoft Entra ID sign-in data provides.
Endpoint memory dump
While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?
Disable User
Isolate Endpoint
Isolate Endpoint enforces a host-based network containment policy, blocking all traffic except the Cortex XDR management channel, so the analyst retains administrative control while lateral movement is prevented. This directly satisfies the stem's dual requirement: network isolation with preserved administrative access for investigation.
Kill Process Tree
Quarantine File
An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?
Retrieve File
Block File Hash
Kill Process Tree
Kill Process Tree terminates the specified process together with every descendant it spawned, satisfying the requirement to eliminate the entire malicious process hierarchy on the endpoint. A single-process kill would leave children running and able to persist, whereas this action removes the full tree directly from the Cortex XDR incident view.
Isolate Endpoint
Want more Evidence Review And Response Actions practice?
Practice this domainAn analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?
Cloud storage audit logs
Firewall URL filtering logs
Process execution telemetry from endpoint agents
Endpoint agents capture process creation events, including command-line arguments, so a BIOC matching 'whoami' execution by a domain user requires this process execution telemetry. Network or authentication logs lack the command-level visibility the rule depends on.
DHCP lease tables
An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?
Registry modifications affecting the Windows Firewall state
DNS query logs for newly registered domains
Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process
Monitoring the target process name for lsass.exe with suspicious access rights directly satisfies the stem's endpoint telemetry criterion. Credential dumping requires a source process opening LSASS with rights such as PROCESS_VM_READ, so correlating target image and granted access mask detects the technique regardless of the dumping tool used.
Outbound HTTPS connections to unknown external IP addresses on port 443
An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?
The Cortex XDR Network Traffic Analyzer
The Cortex XDR Broker VM configured with the User-ID integration
The Broker VM with User-ID integration queries Active Directory to harvest user and group metadata, forwarding it to Cortex XDR for identity-based correlation. This satisfies the ITDR requirement by supplying the directory context that alert enrichment depends on.
WildFire cloud analysis engine
The Cortex XSOAR Content Pack for Active Directory
When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?
Comprehensive profile information including recent alerts, associated devices, and identity attributes
The User View aggregates identity-centric context: the user's profile, recent alerts, associated devices and identity attributes. This lets the analyst correlate an identity-based alert with the account's activity and endpoints, satisfying the need to investigate the alert's full identity context.
Real-time packet captures of the user's active browsing session
The hardware warranty status of endpoints assigned to the user
Group Policy Object (GPO) editing capabilities
An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?
Cloud > Posture > Identity
Incident Response > Alerts, filtering by Analytics category related to Identity
Incident Response > Alerts with an Analytics category filter isolates UBA-generated identity analytics alerts, satisfying the requirement to inspect identity-specific behavioural detections rather than all alert types. Cortex XDR surfaces user behaviour analytics findings within the Analytics category, so filtering there returns exactly the compromised-credential identity alerts the administrator needs.
XQL Search > Identity_Raw schema
Endpoints > Agent Configurations > Identity
An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?
Antivirus scan reports
DNS query logs showing external root hints
Windows Security Event logs (specifically Event ID 4769) collected via Broker VM
Windows Security Event ID 4769 records Kerberos service ticket requests, including the target SPN and encryption type, which exposes Kerberoasting against high-privilege SPNs. Broker VM collection ensures these domain controller events reach Cortex XDR, satisfying the requirement for detecting service ticket requests.
DHCP lease allocation tables
Want more Identity Threat Detection And Response practice?
Practice this domainThe vendor does not publish an exact question count for the XDR-Analyst. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Alert Lifecycle And Incident Correlation, Planning And Installation, Evidence Review And Response Actions, Identity Threat Detection And Response. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks XDR-Analyst exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.