1.3 Configure User Roles, Permissions, and Access Controls XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An employee is leaving the company, and you need to ensure they no longer have access to the XDR system. What is the recommended action?

   • ADelete the user's account from the XDR system.
   • BRemove the user from all roles but leave the account active.
   • CChange the user's password to a random value and inform them of the change.
   • DDeactivate the user's account in XDR.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of configuring access controls in XDR?

   • AConfiguring the XDR console's theme
   • BInstalling the XDR agent on endpoints
   • CCreating a custom role that allows only incident management and denying access to threat intelligence
   • DSetting up email notifications for alerts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your security team needs to verify that a recently implemented access control policy is working correctly. They want to see if any users have attempted to access a restricted feature. What should they review?

   • AThe audit logs for access control events.
   • BThe user's browser history.
   • CThe network firewall logs.
   • DThe system's performance metrics.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A new SOC manager needs to have full visibility into all XDR features, including user management and system configuration, but should not be able to delete the XDR system itself. Which predefined role should you assign?

   • ASuper Admin
   • BViewer
   • CAdministrator
   • DAnalyst
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the scope of RBAC in Palo Alto Networks XDR?

   • ARBAC controls access to XDR features, data, and administrative functions based on user roles
   • BRBAC is a one-time configuration that cannot be changed after initial setup
   • CRBAC is only used for external users, not internal administrators
   • DRBAC only controls access to the XDR console, not the data collected from endpoints
   Reveal Solution Discussion Select an answer first