Learn with Palo Alto Networks : XDR-Engineer training material for 100% pass

What will enable a custom prevention rule to block specific behavior?

• A. A correlation rule added to an Agent Blocking profile
• B. A custom behavioral indicator of compromise (BIOC) added to an Exploit profile
• C. A custom behavioral indicator of compromise (BIOC) added to a Restriction profile
• D. A correlation rule added to a Malware profile

A mobile device management (MDM) system is configured per documentation, and after Cortex XDR agent deployment, many users show their operational status as "Partially Protected." What is a potential cause for this behavior?

• A. Affected users are still using the Default Malware Prevention Module on Policy.
• B. The Safari Safeguard module has not been enabled for all websites.
• C. The Network and EDR Security Module is not set to auto-detect malicious URL filtering.
• D. URL filtering is currently disabled on the Malware Prevention Module.

A threat hunter needs to correlate DNS queries, process executions, and network connections across historical telemetry using advanced search logic. Which feature should be used?

• A. Asset Inventory
• B. Incident Dashboard
• C. XQL Search
• D. Host Firewall Profiles

What is the earliest time frame an alert could be automatically generated once the conditions of a new correlation rule are met?

• A. Between 10 and 20 minutes
• B. Immediately
• C. 5 minutes or less
• D. Between 30 and 45 minutes

Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

• A. dataset = xdr_data| filter event_type = ENUM.DEVICE and action_process_image_name =
  "**"and action_process_image_command_line = "-e cmd*"and
  action_process_image_command_line != "*cmd.exe -a /c*"
• B. dataset = xdr_data| filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and action_process_image_name = "**"and action_process_image_command_line = "-e cmd*"and action_process_image_command_line != "*cmd.exe -a /c*"
• C. dataset = xdr_data| filter event_type = ENUM.PROCESS and action_process_image_name =
  "**"and action_process_image_command_line = "-e cmd*"and
  action_process_image_command_line != "*cmd.exe -a /c*"
• D. dataset = xdr_data| filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname"| filter lowercase(action_file_path) in ("/etc/*",
  "/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt")| fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path