XDR-Engineer Detection And Reporting Practice Question
An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The underlying XQL query string that defines the detection logic.
When configuring scheduled XQL rules, administrators must specify the query string, execution frequency/time window, and alert severity mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The physical memory allocation limit on the Broker VM handling syslog collection.
Why it's wrong here
Incorrect. Broker VM memory limits are managed under appliance settings, not scheduled XQL alert configurations.
- ✗
The kernel bypass configuration parameters for Windows endpoints.
Why it's wrong here
Incorrect. Kernel configurations pertain to endpoint agent prevention profiles, not cloud-based XQL alerting.
- ✓
The underlying XQL query string that defines the detection logic.
Why this is correct
Correct. The query string defines what events or data to search for.
- ✓
The mapping for generated alert attributes such as severity, name, and description.
Why this is correct
Correct. Scheduled XQL rules require mapping fields to populate the resulting Cortex XDR alert details (severity, name, description).
- ✓
The schedule frequency (how often the query runs) and the time range of the data evaluated.
Why this is correct
Correct. The schedule frequency and time range determine when the query executes and what historical window it evaluates.
About these practice questions
One of 226 original XDR-Engineer practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XDR-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XDR-Engineer exam.