Palo Alto Networks XDR Engineer - XDR-Engineer Exam Practice Test

Which action is being taken with the query below?
dataset = xdr_data
| fields agent_hostname, _time, _product
| comp latest as latest_time by agent_hostname, _product | join
type=inner (dataset = endpoints
| fields endpoint_name, endpoint_status, endpoint_type) as lookup
lookup.endpoint_name = agent_hostname
| filter endpoint_status = ENUM.CONNECTED
| fields agent_hostname, endpoint_status, latest_time, _product

An engineer wants to automate the handling of alerts in Cortex XDR and defines several automation rules with different actions to be triggered based on specific alert conditions. Some alerts do not trigger the automation rules as expected. Which statement explains why the automation rules might not apply to certain alerts?

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

A malware profile is configured with all the default settings for a specific endpoint group. For the same group, a restrictions profile has also been configured with the defaults, except with the restriction as shown in the image below. A user opens a command prompt and runs a mimikatz executable from C:\temp.

What is the first alert produced on the XDR Console for that endpoint?

When onboarding a Palo Alto Networks NGFW to Cortex XDR, what must be done to confirm that logs are being ingested successfully after a device is selected and verified?

Based on the image of a validated false positive alert below, which action is recommended for resolution?

A Cortex XDR administrator wants to suppress alerts generated by a trusted internal application without creating unnecessary security blind spots. What is recommended?

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

A query is created that will run weekly via API. After it is tested and ready, it is reviewed in the Query Center. Which available column should be checked to determine how many compute units will be used when the query is run?