Free Palo Alto Networks XDR Analyst Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Palo Alto Networks XDR Analyst practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An intrusion detection system flags a routine administrative action as malicious. The analyst verifies that the action was benign. How should the analyst classify this detection?

   1. A.True positive
   2. B.False negative
   3. C.False positiveCorrect answer: C
   4. D.True negative

   Explanation: NIST states, "When an IDPS incorrectly identifies benign activity as being malicious, a false positive has occurred." The alert classified a benign action as malicious, so it is a false positive.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 2.2, Key Functions of IDPS Technologies, page 2-3

2. 2An analyst logs each person who physically handles collected evidence, together with their actions and the time. Which record is the analyst maintaining?

   1. A.An incident event timeline
   2. B.A chain of custody recordCorrect answer: B
   3. C.A forensic evidence inventory
   4. D.An evidence integrity check log

   Explanation: NIST describes chain of custody as "keeping a log of every person who had physical custody of the evidence, documenting the actions that they performed on the evidence and at what time". This record documents evidence handling.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 3.1.2, Acquiring the Data, page 3-4

3. 3A threat-hunting analyst receives an indicator calculated from the byte content of a malicious executable. Which type of indicator should the analyst search for in endpoint file telemetry?

   1. A.File hashCorrect answer: A
   2. B.IP address
   3. C.Domain name
   4. D.URL

   Explanation: NIST describes indicators for malicious files as including "file names, sizes, hash values". A digest calculated from the executable bytes is its file hash, rather than a network address, domain, or URL.

   Reference: Guide to Cyber Threat Information Sharing — Section 2, Cyber Threat Information Sharing

4. 4An analyst checks whether an endpoint detection tool has received newly published patterns for recognizing known threats. Which update content should the analyst inspect?

   1. A.Detection signature updatesCorrect answer: A
   2. B.Agent application updates
   3. C.Prevention policy updates
   4. D.Detection exception updates

   Explanation: NIST states that "signature updates add new detection capabilities or refine existing detection capabilities". The newly published recognition patterns belong to the detection signature content.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 3.3.2.3, Acquiring and Applying Updates, page 3-8

5. 5A sensor reports suspicious activity by monitoring process execution, file changes, and system logs on one server. Which kind of intrusion detection source produced this alert?

   1. A.Network behavior analysis
   2. B.Wireless intrusion detection
   3. C.Host-based intrusion detectionCorrect answer: C
   4. D.Network-based intrusion detection

   Explanation: NIST describes "Host-Based, which monitors the characteristics of a single host and the events occurring within that host for suspicious activity." The evidence comes from events on one server.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 2.4, Types of IDPS Technologies, page 2-7

6. 6An analyst is examining a live endpoint before an authorized shutdown. Which evidence is volatile and may be lost when power is removed?

   1. A.Network connection tableCorrect answer: A
   2. B.Application configuration files
   3. C.Filesystem access control lists
   4. D.Installed application binaries

   Explanation: NIST states: "Volatile data refers to data on a live system that is lost after a computer is powered down, such as the current network connections to and from the system." The current connections therefore require attention before shutdown.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Section 5.1, OS Basics, page 5-1

7. 7An analyst wants a query to include events timestamped 09:15, 09:25, and 09:35 while excluding events at 09:05 and 09:45. Each proposed interval includes its starting time and excludes its ending time. Which interval is the narrowest that meets the requirement?

   1. A.09:00–09:30
   2. B.09:10–09:40Correct answer: B
   3. C.09:20–09:50
   4. D.09:00–10:00

   Explanation: The query guidance recommends: "Use a small time frame for queries by specifying the specific date and time in the Timeframe". Only 09:10–09:40 contains all three required timestamps and excludes both unwanted timestamps.

   Reference: XQL Query best practices — Query best practices, query time frame

8. 8A client at 10.0.0.5 initiates a TCP connection to a managed endpoint's web service on port 443. The endpoint firewall must permit connections from the client's /24 subnet. Which rule on that endpoint permits the connection?

   1. A.Allow inbound TCP port 443 from 10.0.0.0/24Correct answer: A
   2. B.Allow outbound TCP port 443 to 10.0.0.0/24
   3. C.Allow inbound TCP port 80 from 10.0.0.0/24
   4. D.Allow inbound UDP port 443 from 10.0.0.0/24

   Explanation: The endpoint firewall documentation describes how to "set rules that allow or block the traffic on the devices". The stated direction, protocol, destination port, and source subnet match only the first rule.

   Reference: Host firewall — Host firewall, overview

9. 9An alerting sensor compares a user's current activity with an established profile of normal behavior and flags a significant deviation. Which detection method generated the alert?

   1. A.Signature-based detection
   2. B.Anomaly-based detectionCorrect answer: B
   3. C.Stateful protocol analysis
   4. D.Rule-based event correlation

   Explanation: NIST defines "Anomaly-based detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations." The sensor is comparing current activity with a normal profile.

   Reference: Guide to Intrusion Detection and Prevention Systems (IDPS) — Section 2.3.2, Anomaly-Based Detection, page 2-4

10. 10An investigation shows that an adversary used a command interpreter to run a malicious script on an endpoint. Which adversary tactic is directly demonstrated by running the script?

    1. A.Discovery
    2. B.ExecutionCorrect answer: B
    3. C.Persistence
    4. D.Exfiltration

    Explanation: The technique reference states, "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries." Running the script directly demonstrates execution; the scenario does not establish the other tactics.

    Reference: Command and Scripting Interpreter — T1059, Description and Tactic