An analyst is investigating a spike in alerts that occurred between 2:00 AM and 3:00 AM. The default dashboard shows the last 24 hours. Which action should the analyst take to focus on that specific hour?

Click on the alert count widget to drill down into the alert list.

Refresh the dashboard to update the data.

Apply a filter for the alert source to narrow the data.

Use the time range selector on the dashboard to set a custom range from 2:00 AM to 3:00 AM.

A security analyst needs to quickly identify which endpoints have the most alerts in the last 24 hours. Which dashboard and action should the analyst use?

Use the 'Endpoint Management' dashboard and sort by alert count.

Use the 'Alert Management' dashboard and apply a filter for 'last 24 hours'.

Create a report with alerts grouped by endpoint and schedule it to run daily.

Use the 'Overview' dashboard, set the time range to 'last 24 hours', and click on the 'Top Endpoints by Alerts' widget.

A security team needs to provide a daily summary of all alerts to the management team. The summary should include a breakdown by severity and be delivered automatically every morning at 8:00 AM. What should the team configure?

Create a report with a severity breakdown, schedule it to run daily at 8:00 AM, and set email delivery to the management team.

Create a report and manually export it to PDF every morning at 8:00 AM.

Use the 'Alert Management' dashboard and schedule a screenshot to be emailed.

Create a dashboard with a severity widget and share the dashboard link with the management team.

An analyst is viewing the 'Top Malware' widget on a dashboard and wants to see the specific endpoints affected by a particular malware family. What should the analyst do?

Apply a filter for the malware family name on the dashboard.

Click on the malware family name in the widget to drill down to the affected endpoints.

Open the 'Endpoints' tab and search for the malware family name.

Export the widget data to a CSV file and search for the malware family.

Palo Alto NetworksCertified XDR Analyst

Domain 3Objective 6

3.6 Demonstrate Understanding of Cortex XDR Dashboards and Reports XDR-ANALYST Practice Questions (Page 4)

Part of the Data Analysis domain, which accounts for 28% of the XDR-ANALYST exam.

27questions here

6free pages

7concepts

28%of the exam

Questions 16–20

16application · medium
An analyst is investigating a spike in alerts that occurred between 2:00 AM and 3:00 AM. The default dashboard shows the last 24 hours. Which action should the analyst take to focus on that specific hour?
Select an answer first
17application · medium
A security analyst needs to quickly identify which endpoints have the most alerts in the last 24 hours. Which dashboard and action should the analyst use?
Select an answer first
18application · medium
A security team needs to provide a daily summary of all alerts to the management team. The summary should include a breakdown by severity and be delivered automatically every morning at 8:00 AM. What should the team configure?
Select an answer first
19foundation · easy
Which of the following formats can a Cortex XDR report be exported to?
Select an answer first
20application · medium
An analyst is viewing the 'Top Malware' widget on a dashboard and wants to see the specific endpoints affected by a particular malware family. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.