Palo Alto Networks Certified XDR Analyst — Free Practice Questions
10 free sample questions from a bank of 50, with the correct answers and explanations. No signup required — start practising right now.
- A dataset is a built-in or third-party source; presets group XDR data fields.
- A dataset is a third-party data source; presets are built-in data source.
- A dataset is a Cortex data lake data source only; presets are built-in data source.
- A dataset is a database; presets is a field.
The short version
A — datasets are sources, presets are field groups. A dataset is a built-in or third-party data source; presets bundle XDR data fields for querying.
Key concepts in this question
- Dataset: a queryable data source (Cortex tables, data lake, third-party feeds).
- Preset: a saved grouping of XDR fields that speeds up query building.
- XQL layer: queries run against datasets, shaped with presets.
Why A is correct
Datasets supply the rows (built-in or third-party sources) while presets organize the XDR fields analysts select from them.
Why the others are wrong
- B. Datasets are not third-party-only; most are built-in Cortex sources.
- C. Datasets are not lake-only; they span built-in and external sources.
- D. A dataset is a source table, not a database engine; a preset is a field group, not a single field.
XDR Analyst exam tip
Source equals dataset, field bundle equals preset. Never swap the two.
- WebSocket
- NetBIOS over TCP
- TCP, over port 80
- UDP and a random port
The short version
A — Live Terminal rides WebSocket. The persistent bidirectional channel carries shell traffic between console and agent.
Key concepts in this question
- Live Terminal: remote shell on the endpoint from the XDR console.
- WebSocket: full-duplex channel over standard web ports.
- Why it matters: traverses NAT and proxies where raw sockets would not.
Why A is correct
Cortex XDR documents Live Terminal communication with the agent over WebSocket (wss).
Why the others are wrong
- B. NetBIOS over TCP is legacy LAN sharing, never the terminal transport.
- C. Plain TCP/80 is not the documented channel; the session is WebSocket-based.
- D. Random UDP ports describe no XDR terminal mechanism.
XDR Analyst exam tip
Terminal equals WebSocket. The wss channel also answers the agent-connectivity question.
- JIT Mitigation
- UASLR
- DLL Security
- Memory Limit Heap spray check
The short version
B — UASLR wins on entropy. Micro-ASLR randomizes memory locations with the strongest spread of the options.
Key concepts in this question
- ASLR goal: unpredictable memory layout defeats location-dependent exploits.
- UASLR: user-mode micro randomization with high entropy.
- Peers: JIT, DLL, and heap-spray checks target narrower techniques.
Why B is correct
Among the listed Exploit Prevention Modules, UASLR provides the better entropy for randomizing memory locations.
Why the others are wrong
- A. JIT Mitigation targets just-in-time spraying, not general entropy.
- C. DLL Security guards library loading, not address-space entropy.
- D. The heap-spray check detects spray patterns rather than randomizing layout.
XDR Analyst exam tip
Entropy questions answer UASLR; loading questions answer DLL/Dylib modules.
- Slack
- Service Now
- Salesforce
- Jira
The short version
A — scheduled reports forward to Slack. The reporting engine pushes finished reports to the connected Slack destination.
Key concepts in this question
- Scheduled reports: recurring dashboard/report generation.
- Forwarding target: the configured collaboration sink, here Slack.
- Ticketing contrast: ITSM tools serve incidents, not report delivery.
Why A is correct
Slack is the supported forwarding application for scheduled Cortex XDR reports.
Why the others are wrong
- B. ServiceNow consumes incidents and tickets, not scheduled report pushes.
- C. Salesforce is a CRM, not a report sink.
- D. Jira tracks issues; it does not receive scheduled XDR reports.
XDR Analyst exam tip
Reports go to collaboration (Slack); incidents go to ticketing (ServiceNow/Jira).
- In the Restrictions Profile, add the file name and path to the Executable Files allow list.
- Add the signer to the allow list in the malware profile.
- Create a new rule exception and use the singer as the characteristic.
- Add the signer to the allow list under the action center page.
The short version
B — signer trust lives in the malware profile allow list. Adding the digital signer there stops signer-based blocking on Windows and macOS.
Key concepts in this question
- Signer-based blocking: agent blocks execution by certificate signer.
- Malware profile allow list: the trust override for signers.
- Restrictions vs malware: file-path rules differ from signer trust.
Why B is correct
The documented exception for a blocked digital signer is adding that signer to the allow list in the malware profile.
Why the others are wrong
- A. Executable-file path lists gate paths, not signers.
- C. Rule exceptions with characteristics serve other rule types, not signer trust.
- D. The action center manages response actions, not profile trust lists.
XDR Analyst exam tip
Signer problem means malware profile; path problem means restrictions profile.
- Causality Analysis Engine
- Sensor Engine
- Causality Chain Engine
- Log Stitching Engine
The short version
A — the Causality Analysis Engine builds incidents. It picks each alert key artifacts and fuses related alerts into one incident.
Key concepts in this question
- Artifact selection: the most relevant entities per alert.
- Aggregation: alerts sharing an event stitch into an incident.
- Engine split: causality analyzes, stitching joins logs, sensors collect.
Why A is correct
Determining relevant artifacts per alert and aggregating event-related alerts into incidents is the Causality Analysis Engine role.
Why the others are wrong
- B. The Sensor Engine collects endpoint data; it aggregates nothing.
- C. Causality Chain Engine is not the named aggregation engine here.
- D. The Log Stitching Engine joins raw logs; incident assembly sits above it.
XDR Analyst exam tip
Alerts-to-incident assembly always names Causality Analysis. Stitching is just log joining.
- Agent Auto Upgrade has not been enabled.
- There are a total of 689 Up To Date agents.
- There are more agents in Pending status than In Progress status.
- Agent Auto Upgrade was enabled but not on all endpoints.
The short version
D — enabled but not on all endpoints. The widget shows live upgrade statuses plus a 128-agent Not Configured slice, so auto-upgrade is on yet not universal.
Key concepts in this question
- Agent Auto Update Status widget: donut of Pending (15), In Progress (78), Up To Date (450), Failed (18), Not Configured (128) over 689 agents.
- Not Configured: endpoints outside auto-upgrade scope, proving coverage is partial.
- Total vs Up To Date: 689 is the fleet total, not the Up To Date count (450).
Why D is correct
The exhibit shows active Pending and In Progress upgrades, so auto-upgrade is enabled, alongside 128 Not Configured agents, so it is not applied to every endpoint. 689 is the center total while Up To Date reads 450.
Why the others are wrong
- A. Pending (15) and In Progress (78) activity proves the feature is enabled.
- B. 689 is the total fleet; the Up To Date slice is 450.
- C. Pending (15) is smaller than In Progress (78), so the comparison is reversed.
XDR-Analyst exam tip
Center number equals fleet total; always read each legend slice before picking a count-based option.
- It does not interfere with any portion of the pattern on the endpoint.
- It interferes with the pattern as soon as it is observed on the endpoint.
- It does not need to interfere with the any portion of the pattern to prevent the attack.
- It interferes with the pattern as soon as it is observed by the firewall.
The short version
B — Analytics breaks the pattern on-endpoint at first sight. Any interference with part of the attack pattern stops a network-based attack.
Key concepts in this question
- Pattern interference: disrupting any stage collapses the chain.
- On-endpoint timing: action triggers when observed locally.
- Firewall contrast: the analytics verdict fires at the endpoint, not the firewall.
Why B is correct
The Analytics module interferes with the pattern as soon as it is observed on the endpoint, which suffices to prevent the attack.
Why the others are wrong
- A. No interference would let the pattern complete; prevention requires action.
- C. Prevention needs interference; observation alone stops nothing.
- D. The endpoint module acts on the endpoint, not via firewall observation.
XDR Analyst exam tip
Break any link, break the chain. Timing answers always say on-endpoint at observation.
- Live Terminal is not supported.
- Stop an app.
- Run Android commands.
- Run APK scripts.
The short version
C — Android Live Terminal runs Android commands. The mobile shell exposes device command execution.
Key concepts in this question
- Platform scoping: terminal options differ per OS agent.
- Android capability: command execution on the device.
- Unsupported claims: the feature exists, so absence answers fail.
Why C is correct
Running Android commands is the available Live Terminal option on Android systems.
Why the others are wrong
- A. Live Terminal support exists for Android; the absence claim is false.
- B. Stopping an app is not the listed terminal option.
- D. Running APK scripts is not the listed terminal option.
XDR Analyst exam tip
Mobile terminal questions answer device commands; desktop answers span wider.
- The ultimate goal of any exploit is to reach the application.
- Kernel exploits are easier to prevent then application exploits.
- Application exploits leverage kernel vulnerability.
- The ultimate goal of any exploit is to reach the kernel.
The short version
D — every exploit climbs toward the kernel. Admin-level control is the universal payoff.
Key concepts in this question
- Exploit goal: escalate to the most privileged layer reachable.
- Kernel prize: full system control below all defenses.
- Application step: a foothold, never the final aim.
Why D is correct
Whether starting in an app or a driver, the ultimate goal of any exploit is reaching the kernel.
Why the others are wrong
- A. Applications are entry points, not the ultimate goal.
- B. Kernel exploits face deeper protections; they are not easier to prevent.
- C. Application exploits leverage application flaws, not kernel bugs, by definition.
XDR Analyst exam tip
Goal questions climb: app is the door, kernel is the destination.
Want the full bank of 50 questions for Palo Alto Networks Certified XDR Analyst? See all practice exams.