thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Palo Alto Networks · Cybersecurity · Professional

Palo Alto Networks Certified XDR Engineer exam guide

Exam XDR Engineer (Specialist)

The XDR Engineer certification validates deploying and engineering Cortex XDR: planning and installation, agent configuration, data ingestion and automation, detection and reporting, and maintenance. Endpoint and extended detection remain central to SOC tooling in 2026.

QuestionsSee official page
Time limitSee official page
Passing score860 (300-1000 scale)
Exam fee$250 USD
Valid for2 years
DeliveryPearson VUE test center; online proctoring (OnVUE) where offered

Format: Multiple choice, matching and ordering items.

Who it's for

Security engineers and SOC engineers who deploy, tune and maintain Cortex XDR.

What the exam covers

Cortex XDR Agent Configuration22%
Ingestion and Automation22%
Detection and Reporting22%
Maintenance and Troubleshooting20%
Planning and Installation14%

Eligibility & prerequisites

Required: None.

Recommended: Working knowledge of security operations, endpoint OS fundamentals, scripting (Python, PowerShell, XQL), log onboarding and MITRE ATT&CK; follow the official learning path.

Keeping it active

Valid 2 years from passing. Renew by retaking the current exam before expiry; passing a higher-level certification in the same track also extends active lower-level certifications by 2 years.

Skills & careers

Skills it validates

  • Cortex XDR tenant and broker VM deployment
  • Agent profiles and prevention policies
  • Data ingestion and parsing rules
  • XQL queries and BIOC/correlation rules
  • Automation and response actions
  • Agent troubleshooting

Job roles

XDR EngineerEndpoint Security EngineerSOC EngineerDetection EngineerSecurity Engineer

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Planning and installation: tenant setup, broker VM, agent installation across Windows, macOS and Linux.
  2. Week 2: Agent configuration: prevention profiles, exceptions, device control, host firewall.
  3. Week 3: Ingestion and automation: data sources, parsing rules, automation rules; XQL practice.
  4. Week 4: Detection and reporting: BIOCs, correlation rules, dashboards; maintenance and troubleshooting; datasheet review.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Three domains are tied at 22%; balance your study instead of focusing only on detection.
  • Practise XQL syntax; expect questions that ask which query returns a given result.
  • Know the difference between BIOC, IOC and correlation rules and when to use each.
  • Agent troubleshooting questions often hinge on content and agent version compatibility.

Key terms for this exam

All 12 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does the XDR Engineer exam cost?

$250 plus applicable taxes; vouchers are sold through the Pearson VUE voucher store.

What score do I need to pass?

Palo Alto Networks sets the converted passing score at 860 on a 300-1000 scale.

How long is the certification valid?

Two years. Retake the exam before it expires, or earn a higher-level certification in the same track to extend it.

XDR Engineer vs XSIAM Engineer?

XDR Engineer covers Cortex XDR deployment and detection; XSIAM Engineer covers the broader XSIAM SOC platform including SIEM-style ingestion and playbooks.

Do I need scripting?

Basic Python, PowerShell and XQL knowledge is expected for the ingestion and detection domains.

Official page: www.paloaltonetworks.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.