Free Palo Alto Networks XDR-Engineer Practice Test Questions and Answers (2026)

Last Update Check

Get ready for the Palo Alto Networks XDR-Engineer exam using trusted 2026 learning materials and realistic exam questions.

Cert Empire offers precise and current Palo Alto Networks XDR-Engineer exam questions built for cybersecurity experts proving their threat detection and incident response abilities. These resources replicate real testing conditions and align with the latest XDR-Engineer syllabus. To make studying easier, part of our Palo Alto Networks XDR-Engineer content is free. You can attempt the XDR-Engineer Practice Test anytime to strengthen your preparation before the actual exam.

View Mode
Q: 1
[Cortex XDR Agent Configuration] Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint? Palo Alto Networks Certified XDR Engineer question
Options
49 comments in the community discussion
7
Option B. saw a similar question in recent exam reports and the profile blocks unknown apps.
2
Option B since "block" for unknowns stops custom apps right away. D is tempting but only if there's delay policy.
Q: 2
[Detection Engineering] An analyst considers an alert with the category of lateral movement to be allowed and not needing to be checked in the future. Based on the image below, which action can an engineer take to address the requirement? Palo Alto Networks Certified XDR Engineer question
Options
49 comments in the community discussion
5
Option B is best here since it excludes alerts by source and name, covering all similar future lateral movement alerts. D would only handle a specific parent process or command. Pretty sure B matches Palo Alto's expected workflow, but let me know if you see it differently.
4
B . Blocking by alert source and name is what you need if you want to stop this category from alerting again. D's more for single process/command use, trap for broader cases.
Q: 3
[Data Ingestion and Integration] What will be the output of the function below? L_TRIM("a* aapple", "a")
Options
54 comments in the community discussion
4
A . Had something like this in a mock, and L_TRIM only removes the 'a' characters from the left, not spaces or anything else. The first char is 'a', then '*' stays, so you're left with ' aapple' as output. Let me know if someone disagrees but this matches what I've seen in labs.
2
D imo, but pretty sure that's a trap. If the trim set was different I'd say C, but not confident here.
Q: 4
[Maintenance and Troubleshooting] An insider compromise investigation has been requested to provide evidence of an unauthorized removable drive being mounted on a company laptop. Cortex XDR agent is installed with default prevention agent settings profile and default extension "Device Configuration" profile. Where can an engineer find the evidence?
Options
47 comments in the community discussion
6
My pick: A, since default device profiles log mounts in Host Inventory. C is tricky but only if custom or restricted configs are in play, which isn't the case here. Pretty sure about this based on similar exam reports. Disagree?
4
A. saw a similar question in recent exam reports and Host Inventory > Mounts is what gets checked with defaults.
Q: 5
[Cortex XDR Agent Configuration] How are dynamic endpoint groups created and managed in Cortex XDR?
Options
57 comments in the community discussion
9
Option D
6
C/D? Leaning D since dynamic endpoint groups use OS type and other criteria.
Q: 6
[Dashboards and Reporting] Which action is being taken with the query below? dataset = xdr_data | fields agent_hostname, _time, _product | comp latest as latest_time by agent_hostname, _product | join type=inner (dataset = endpoints | fields endpoint_name, endpoint_status, endpoint_type) as lookup lookup.endpoint_name = agent_hostname | filter endpoint_status = ENUM.CONNECTED | fields agent_hostname, endpoint_status, latest_time, _product
Options
40 comments in the community discussion
4
Option A had a similar question in exam reports and it matches the query logic.
1
Seen something like this in official study material, it's tracking latest activity for any endpoint. A
Q: 7
[Post-Deployment Management and Configuration] What happens when the XDR Collector is uninstalled from an endpoint by using the Cortex XDR console?
Options
52 comments in the community discussion
2
Option C that's the retention you see in official guides and practice tests. If you want to double check, go through the latest admin guide or sample exam.
2
In official docs and most practice tests for XDR, configuration retention is usually set to the default (90 days), but I've seen some guides reference 7 days too. Anyone confirm from the latest admin guide?
Q: 8
[Post-Deployment Management and Configuration] A cloud administrator reports high network bandwidth costs attributed to Cortex XDR operations and asks for bandwidth usage to be optimized without compromising agent functionality. Which two techniques should the engineer implement? (Choose two.)
Options
49 comments in the community discussion
1
I think B and D. Had something like this in a mock, and those two seemed like they reduced bandwidth just by limiting what gets downloaded and using local settings. Could be missing something, but not ruling these out yet.
1
Don’t think D is the right fit unless you’re dealing with segmentation or brokers specifically. A and C actually target bandwidth reduction: P2P reduces cloud pulls, and bandwidth control limits usage. Pretty sure that's what the question wants, but open to other views.
Q: 9
[Data Ingestion and Integration] In addition to using valid authentication credentials, what is required to enable the setup of the Database Collector applet on the Broker VM to ingest database activity?
Options
48 comments in the community discussion
6
I don't think it's B or D here. The collector applet setup just asks for a valid SQL query that pulls the activity you want, not access to logs. Option A matches what I've seen in similar practice material. Happy if someone sees it differently but pretty sure A's correct since the others are more for audit/forensic
2
A . Seen this in a lab before, just need a valid SQL query for the applet to ingest data.
Q: 10
[Maintenance and Troubleshooting] A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center. Which available column should be checked to determine how many compute units will be used when the query is run?
Options
41 comments in the community discussion
6
Option B here. Compute Unit Usage shows what's actually used when the query runs on schedule, not just a simulated estimate. I think that's what they're looking for but if anyone saw something different in the UI, let me know.
4
Option B popped up in a practice set I did, pretty sure it's right. "Compute Unit Usage" reflects what actually gets consumed when the query runs live, not just in test mode.
Question 1 of 20

Premium Access Includes

  • ✓Quiz Simulator
  • ✓Exam Mode
  • ✓Progress Tracking
  • ✓Question Saving
  • ✓Flash Cards
  • ✓Drag & Drops
  • ✓3 Months Access
  • ✓PDF Downloads
Get Premium Access

← Back to all Palo Alto Networks exams & practice tests

Scroll to Top