Palo Alto Networks Certified XDR Engineer

Last checked November 10, 2026 against the official Palo Alto Networks exam page.

1. Question 1Cortex XDR Agent Configuration

   A newly deployed internal application is blocked by an exploit prevention module on a set of endpoints. The team needs time to review telemetry without losing protection on the rest of the fleet. What is the most appropriate change?

   1. AUninstall the Cortex XDR agent from the affected endpoints until the review is finished
   2. BMove only the affected endpoints to a policy whose prevention profile reports instead of blocking
   3. CAdd the application's hash to the allow list on every endpoint group permanently and without any review
   4. DDisable all prevention modules in the profile that is shared by every endpoint group in the tenant
   Show answer and explanationHide answer

   Correct answer: B

   Scoping the change to the affected endpoints lets the team collect telemetry while blocking stays active elsewhere. Uninstalling the agent removes all protection, a permanent allow-list skips review, and disabling every module in a shared profile weakens protection tenant-wide.

2. Question 2Ingestion and Automation

   A network team wants a firewall's syslog events to appear in Cortex XDR. The firewall cannot run an endpoint agent. Which component is the typical starting point?

   1. AA Cortex XDR agent installed directly on the firewall appliance itself so that it reports its own events
   2. BA Broker VM with a syslog collector applet configured to receive the firewall's events
   3. CAn endpoint group assigned to the firewall's management address
   4. DA prevention profile that forwards every firewall log entry to the console
   Show answer and explanationHide answer

   Correct answer: B

   A Broker VM can host a syslog collector applet that receives events from devices that cannot run an agent. Agents cannot be installed on a firewall appliance, and endpoint groups and prevention profiles do not collect syslog data.

3. Question 3Detection and Reporting

   Which description best fits an IOC in Cortex XDR?

   1. AA scripted response that isolates an endpoint from the network when it is triggered
   2. BAn indicator such as a file hash, domain, or IP address that the platform can match against activity
   3. CA dashboard widget that displays the number of alerts grouped by severity level
   4. DA scheduled task that runs a query to count failed logins over a fixed time window in the data lake and emails the results
   Show answer and explanationHide answer

   Correct answer: B

   An IOC is a known indicator, such as a file hash, domain, or IP address, that the platform matches against observed activity. Isolation scripts, dashboard widgets, and scheduled queries do not describe indicators.

4. Question 4Maintenance and Troubleshooting

   An employee's laptop no longer appears as checked in to the Cortex XDR console, although the laptop is online. What is the most logical first troubleshooting step?

   1. ACheck the agent service and its network path to the tenant, including proxy and firewall rules
   2. BReinstall the operating system so that the agent receives a fresh identity
   3. CDelete the endpoint group that the laptop belongs to, recreate it with the same name, and reassign its policies
   4. DTurn off the Broker VM syslog applet so that it stops competing for the laptop's bandwidth
   Show answer and explanationHide answer

   Correct answer: A

   Verifying the agent service and the network path to the tenant, including proxy and firewall settings, and then checking agent logs narrows down a disconnected endpoint quickly. Reinstalling the operating system, deleting groups, or disabling an unrelated Broker VM applet does not address the connection.

5. Question 5Planning and Installation

   A company plans to roll out the Cortex XDR agent to several thousand Windows workstations. The security lead wants to avoid widespread disruption if a problem appears. Which approach best fits the deployment process?

   1. AInstall the agent on every workstation at once and write the policies afterward
   2. BConfirm the tenant and licensing are ready, then pilot the agent on a small group before a wider rollout
   3. CDeploy Broker VM clusters before any network requirements have been reviewed
   4. DTurn on automation rules for incident handling before any endpoint has reported to the tenant and before the policies have been reviewed by the team
   Show answer and explanationHide answer

   Correct answer: B

   A phased pilot confirms that the tenant, licensing, and policies behave as expected before the agent reaches the whole fleet. Installing everywhere first, building Broker VM clusters before reviewing network needs, or enabling automation before any endpoint reports in all skip that validation and raise the risk of widespread disruption.