1.4 Demonstrate Understanding of Data Retention and Compute Units XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is configuring Cortex XDR and wants to understand the scope of data retention. Which data types are typically subject to retention policies in Cortex XDR?

   • AOnly network telemetry, since endpoint telemetry is processed in real-time and not stored.
   • BOnly alerts and incidents, since raw telemetry is stored permanently.
   • COnly raw endpoint telemetry, since alerts and incidents are generated on demand.
   • DRaw endpoint telemetry, alerts, incidents, and forensic snapshots.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How do retention policies govern the data lifecycle in XDR?

   • ABy determining which data is encrypted and which is not
   • BBy prioritizing which alerts are investigated first
   • CBy specifying how long each data type is stored and when it is deleted
   • DBy controlling which users can access the data
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is planning its Cortex XDR budget for the next year. They expect a steady increase in data volume as they onboard more endpoints. They want to avoid unexpected cost overruns. Which approach to compute unit planning is the most effective?

   • AStart with a baseline allocation based on current volume and plan to review and adjust compute units quarterly as data volume grows.
   • BSet a fixed compute unit allocation and never change it, regardless of data volume changes.
   • CRely entirely on automatic scaling and do not set a baseline allocation.
   • DPurchase the maximum compute units they might need for the entire year upfront to lock in a lower price.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is configuring Cortex XDR and wants to optimize costs. They have a large volume of low-sensitivity endpoint logs that are rarely queried, and a smaller volume of high-sensitivity alert data that is frequently investigated. Which retention strategy best balances cost and operational needs?

   • ADisable retention policies entirely and let the platform decide how long to keep data.
   • BSet a shorter retention period for the low-sensitivity logs and a longer retention period for the high-sensitivity alert data.
   • CSet the same long retention period for all data types to ensure nothing is ever lost.
   • DSet a short retention period for all data types and rely on external backups for any long-term needs.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which types of data are typically subject to retention policies in Palo Alto Networks XDR?

   • AAlerts, endpoint telemetry, and forensic artifacts
   • BOnly alerts and incidents generated by the XDR platform
   • COnly configuration backups and system logs
   • DOnly raw packet captures from network sensors
   Reveal Solution Discussion Select an answer first