최신 XDR-Engineer 무료덤프 - Palo Alto Networks XDR Engineer

문제1

An XDR engineer is creating a correlation rule to monitor login activity on specific systems. When the activity is identified, an alert is created. The alerts are being generated properly but are missing the username when viewed. How can the username information be included in the alerts?

A. Select "Initial Access" in the MITRE ATT&CK mapping to include the username

B. Add a drill-down query to the alert which pulls the username field

C. Update the query in the correlation rule to include the username field

D. Add a mapping for the username field in the alert fields mapping

정답: D

설명: (DumpTOP 회원만 볼 수 있음)

문제2

An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected. Which statement explains why the automation rules might not apply to certain alerts?

A. They can only be triggered by alerts with high severity; alerts with low or informational severity will not trigger the automation rules

B. They are executed in sequential order, so alerts may not trigger the correct actions if the rules are not configured properly

C. They can be applied to any alert, but they only work if the alert is manually grouped into an incident by the analyst

D. They only apply to new alerts grouped into incidents by the system and only alerts that generateincidents trigger automation actions

정답: D

설명: (DumpTOP 회원만 볼 수 있음)

문제3

Using the Cortex XDR console, how can additional network access be allowed from a set of IP addresses to an isolated endpoint?

A. Add entries in Exceptions Configuration section of Isolation Exceptions

B. Add entries in Configuration section of Security Settings

C. Add entries in the Allowed Domains section of Security Settings for the tenant

D. Add entries in Response Actions section of Agent Settings profile

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제4

A security analyst is using Cortex XDR to analyze web server logs from an Apache server and wants to build a parsing rule to structure the incoming JSON-formatted logs, with the intent to extract specific fields.
Based on the log image below, which JSON function should be used to extract remote_ip, scanned_ip, and source_log fields?

A. json_extract_scalar

B. json_extract_string

C. json_extract_array

D. to_json_string

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제5

Based on the SBAC scenario image below, when the tenant is switched to permissive mode, which endpoint(s) data will be accessible?

A. E1 only

B. E1, E2, and E3

C. E1, E2, E3, and E4

D. E2 only

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

문제6

Which external threat intelligence source is available out-of-the-box to supplement WildFire verdicts for key artifacts in an incident?

A. MineMeld

B. ESET Protect

C. VirusTotal

D. PhishTank

정답: C

설명: (DumpTOP 회원만 볼 수 있음)

문제7

Some company employees are able to print documents when working from home, but not on network-attached printers, while others are able to print only to file. What can be inferred about the affected users' inability to print?

A. They may be on different device extensions profiles set to block different print jobs

B. They may have different disk encryption profiles that are not allowing print jobs on encrypted files

C. They may have a host firewall profile set to block activity to all network-attached printers

D. They may be attached to the default extensions policy and profile

정답: A

설명: (DumpTOP 회원만 볼 수 있음)

문제8

What will enable a custom prevention rule to block specific behavior?

A. A custom behavioral indicator of compromise (BIOC) added to an Exploit profile

B. A correlation rule added to a Malware profile

C. A correlation rule added to an Agent Blocking profile

D. A custom behavioral indicator of compromise (BIOC) added to a Restriction profile

정답: D

설명: (DumpTOP 회원만 볼 수 있음)

문제9

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

A. It will execute after the second attempt

B. It will not execute

C. It will immediately execute

D. It will execute after one hour

정답: B

설명: (DumpTOP 회원만 볼 수 있음)

최신 XDR-Engineer 무료덤프 - Palo Alto Networks XDR Engineer

우리와 연락하기

유용한 링크

최신 업데이트