最新なPalo Alto Networks XDR-Engineer問題集（83題）、真実試験の問題を全部にカバー！

質問 1：
How can a customer ingest additional events from a Windows DHCP server into Cortex XDR with minimal configuration?
A. Activate Windows Event Collector (WEC)
B. Enable HTTP collector integration
C. Install the XDR Collector
D. Install the Cortex XDR agent
正解：C
解説: (Pass4Test メンバーにのみ表示されます)

質問 2：
A cloud administrator reports high network bandwidth costs attributed to Cortex XDR operations and asks for bandwidth usage to be optimized without compromising agent functionality. Which two techniques should the engineer implement? (Choose two.)
A. Configure P2P download sources for agent upgrades and content updates
B. Enable agent content management bandwidth control
C. Enable minor content version updates
D. Deploy a Broker VM and activate the local agent settings applet
正解：A,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 3：
An XDR engineer is configuring an automation playbook to respond to high-severity malware alerts by automatically isolating the affected endpoint and notifying the security team via email.
The playbook should only trigger for alerts generated by the Cortex XDR analytics engine, not custom BIOCs. Which two conditions should the engineer include in the playbook trigger to meet these requirements? (Choose two.)
A. Alert category is Malware
B. Alert status is New
C. Alert severity is High
D. Alert source is Cortex XDR Analytics
正解：C,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 4：
Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly regulated environment? (Choose two.)
A. Create an agent settings profile where the agent upgrade scope is maintenance releases only
B. Create an agent settings profile, enable content auto-update, and include a delay of four days
C. Enable critical environment versions
D. Enable minor content version updates
正解：A,B
解説: (Pass4Test メンバーにのみ表示されます)

質問 5：
What happens when the XDR Collector is uninstalled from an endpoint by using the Cortex XDR console?
A. The associated configuration data is removed from the Action Center immediately after uninstallation
B. It is uninstalled during the next heartbeat communication, machine status changes to Uninstalled, and the configuration data is retained for 90 days
C. The files are removed immediately, and the machine is deleted from the system without any retention period
D. The machine status remains active until manually removed, and the configuration data is retained for up to seven days
正解：B
解説: (Pass4Test メンバーにのみ表示されます)

質問 6：
What happens when two or more values are specified for a disable prevention rule in Cortex XDR to allow file execution?
A. The rule is ignored if multiple values are specified for the target properties.
B. The rule automatically applies to all files regardless of their properties.
C. The exception is applied if the file satisfies all of the specified target properties.
D. The rule applies if the file satisfies any of the specified target properties.
正解：C
解説: (Pass4Test メンバーにのみ表示されます)

質問 7：
A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected. What may be the cause of this behavior?
A. The filter stage is dropping the logs
B. The Broker VM is offline
C. The XDR Collector is dropping the logs
D. The parsing rule corrupted the database
正解：A
解説: (Pass4Test メンバーにのみ表示されます)

質問 8：
A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)
[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]
A. Apply an alert exclusion to the XDR behavioral indicator of compromise (BIOC) alert
B. Modify the behavioral indicator of compromise (BIOC) logic
C. Apply an alert exclusion to the XDR agent alert
D. Apply an alert exception
正解：B,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 9：
Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

A. It will not execute
B. It will execute after one hour
C. It will execute after the second attempt
D. It will immediately execute
正解：A
解説: (Pass4Test メンバーにのみ表示されます)