1.4 Demonstrate Understanding of Data Retention and Compute Units XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a compute unit in the context of Palo Alto Networks XDR?

   • AA unit of storage capacity used to retain data
   • BA measure of processing capacity used to ingest, process, and store XDR data
   • CA network bandwidth allocation for data transfer
   • DA licensing metric that limits the number of users
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the context of Palo Alto Networks XDR, what is the primary purpose of data retention?

   • ATo increase the speed of real-time alert correlation by keeping only recent data
   • BTo ensure that historical data remains available for threat hunting, forensics, and compliance
   • CTo reduce the storage footprint by automatically deleting low-priority alerts
   • DTo encrypt data at rest and in transit to protect it from unauthorized access
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to ensure that they can investigate a security incident that occurred 45 days ago. Their current Cortex XDR retention policy is set to 30 days for all data types. What is the most appropriate action to enable this investigation?

   • AReduce the retention period to 15 days to free up storage for the investigation.
   • BIncrease the compute unit allocation to allow the platform to retain data longer automatically.
   • CKeep the retention at 30 days and rely on the incident report that was generated at the time.
   • DIncrease the retention period to at least 60 days for the data types needed for the investigation.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations team notices that their Cortex XDR deployment is consuming compute units at a much higher rate than expected. They recently extended the retention period for endpoint telemetry from 30 days to 90 days to support a longer investigation window. The volume of daily ingested data has not changed. What is the most likely reason for the increased compute unit consumption?

   • AExtending retention automatically triggers a one-time re-ingestion of all historical data, which temporarily spikes compute usage.
   • BCompute units are only consumed during ingestion, so the retention change should have no effect on compute unit usage.
   • CLonger retention increases the total volume of stored data, which requires more compute units for indexing and ongoing processing.
   • DThe longer retention period causes the system to run more frequent threat-hunting queries against older data by default.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is experiencing high compute unit consumption and wants to reduce costs. They have a 365-day retention period for all data types. They are considering reducing the retention period to 180 days. What is the most important trade-off they should consider before making this change?

   • AReducing retention will require purchasing more compute units to handle the deletion process.
   • BReducing retention will increase compute unit consumption because the platform will need to process data faster before it is deleted.
   • CReducing retention will have no effect on compute unit consumption because compute units are only used for ingestion.
   • DReducing retention will lower compute unit consumption but will also limit the ability to investigate incidents that are older than 180 days.
   Reveal Solution Discussion Select an answer first