Question 1
Which Cortex XDR agent license tier adds Behavioral Threat Protection (BTP), Local Analysis via WildFire, and exploit prevention modules beyond what the base Prevent agent provides?
Correct Answer:
Cortex XDR Pro per Endpoint
Question 2
An analyst is triaging a high-severity incident in Cortex XDR. Which view stitches together related alerts, processes, and network connections into a single causal timeline anchored on the causality actor?
Correct Answer:
Causality View
Question 3
Which Cortex XDR feature uses machine learning to score and group related alerts from multiple sources (NGFW, EDR, identity, cloud) into a single incident?
Correct Answer:
Smart Grouping
Question 4
A Tier-1 analyst needs to quickly determine whether an alert is part of a known attack campaign or an isolated event. Which incident field should they check first?
Correct Answer:
MITRE ATT&CK technique
Question 5
Which alert source in Cortex XDR is generated by analyst-defined detection rules that match on raw EDR telemetry such as process, file, registry, or network events?
Correct Answer:
BIOC (Behavioral Indicator of Compromise)
Question 1
Exam overview

About this Exam

Prepare with the XDR Analyst Practice Questions - Palo Alto Networks Certified XDR Analyst (Specialist) Exam practice quiz. This question bank includes 100 questions covering cortex, analyst, alert, endpoint, and incident. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

XDR Analyst Practice Questions - Palo Alto Networks Certified XDR Analyst (Specialist) Exam

This practice set contains 100 questions from the matching question bank and focuses on cortex, analyst, alert, endpoint, and incident. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions