XDR-Analyst Evidence Review And Response Actions Practice Question
An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exceptions settings page, scoping the rule to the target endpoint group
Exceptions in Cortex XDR can be scoped to specific agent groups and detection types via the Exceptions management interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the individual user's operating system environment variables
Why it's wrong here
OS environment variables do not control Cortex XDR security agent detection logic.
- ✗
By modifying the BIOS firmware on the endpoint group
Why it's wrong here
BIOS firmware controls hardware boot procedures, not EDR software detection rules.
- ✓
Exceptions settings page, scoping the rule to the target endpoint group
Why this is correct
Scoping exceptions to specific groups ensures targeted suppression without disabling protections globally.
- ✗
Through the global firewall packet filter configuration
Why it's wrong here
Packet filters manage network layer connectivity, not signature-based agent endpoint detections.
About these practice questions
Courseiva writes every XDR-Analyst question from scratch — 210 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XDR-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XDR-Analyst exam.