Pretty sure it's D. That rule would cover the parent process and exact command, so you wouldn't see this alert for that specific case again. I saw a similar question in old practice sets and D was close to what they wanted, but maybe I'm missing something about category-wide suppression? Disagree?

B makes sense here. The question wants to allow all similar lateral movement alerts in the future, not just for one process or command. Creating an alert exclusion rule by source and name covers that category across the board, which matches how XDR handles alert silencing at scale. I think that’s what Palo Alto expects but wouldn’t mind seeing confirmation from the official guide or lab materials if anyone has them.

I actually think D is closer, since it talks about making an exception for that parent process and the specific command. If you just want to never see this exact alert again, that's usually safer than excluding all similar alerts like B would. Trap here is going too broad with B and potentially missing legit detections later. Pretty sure but open to correction if I'm missing a XDR nuance.

Always Palo Alto and their default config gotchas! It's A here, Host Inventory > Mounts shows removable drive mounts as long as you haven't messed with the defaults. Seen this asked in similar practice sets. Let me know if I missed some recent change in Cortex XDR though.

Option D makes sense for dynamic endpoint groups in Cortex XDR since they're defined by fields like OS or segment, auto-populating as endpoints match those criteria. B would apply if the question was about static groups, but "dynamic" is the key here. I think some folks mix this up since other EDRs blur the lines. Agree?

Is anyone else thinking B could sorta make sense if the question focused more on group membership flexibility? The "dynamic" part pushes me toward D though, since those use things like OS and network segment to assign endpoints automatically. Am I missing something?

Yeah, A fits since there isn’t any filter on endpoint_type so it’s pulling latest activity for all connected endpoints, not just firewalls. Would have to see endpoint_type=firewall for C to make sense. Pretty sure on this, but open if I missed something.

Option A but I get why some go for C. The trap is that there’s no endpoint_type filter, so it’s all connected endpoints, not just firewalls. Pretty sure about this, unless I missed something in the join step. Anyone see it differently?

In official docs and most practice tests for XDR, configuration retention is usually set to the default (90 days), but I've seen some guides reference 7 days too. Anyone confirm from the latest admin guide?

I don't think D is right here since config data isn't wiped instantly. C makes sense because the uninstallation waits for the next heartbeat and keeps config for 90 days, that's in line with what I’ve seen in exam reports.

I was thinking C and D since Broker VM (D) acts as local relay, so less cloud traffic. C is obvious for direct bandwidth management. Not totally sure though, maybe A helps more internally? Open to better logic here.

I don't think it's B or D here. The collector applet setup just asks for a valid SQL query that pulls the activity you want, not access to logs. Option A matches what I've seen in similar practice material. Happy if someone sees it differently but pretty sure A's correct since the others are more for audit/forensic cases.

C or B? If they're asking for what's actually consumed after the query goes live via API, it's gotta be B (Compute Unit Usage). But if the question wanted a pre-run estimate, then C (Simulated Compute Units) would make sense. Based on the wording though, pretty sure it's B here. Let me know if you interpret it different.

I've seen similar questions in official guides, and B is the way to go for live API usage. "Compute Unit Usage" directly shows the actual compute resources your scheduled query will consume, not just estimates or quotas. If anyone's used official practice tests, should match up there too. Pretty sure about this but open to other views.