Palo Alto Networks PCDRA Questions and Answers

dumps2023-12-21T10:12:22+08:00

Palo Alto Networks PCDRA exam is easy for you to pass now. The latest PCDRA questions and answers are online for you to test all the related topics. In real Palo Alto Networks PCDRA exam, there are 60 multiple-choice items, and you have 80 minutes to complete all the questions. Free Palo Alto Networks PCDRA exam questions and answers are below.

Page 1 of 3

1. Phishing belongs to which of the following MITRE ATT&CK tactics?

Initial Access, Persistence

Persistence, Command and Control

Reconnaissance, Persistence

Reconnaissance, Initial Access

2. When creating a BIOC rule, which XQL query can be used?

dataset = xdr_data | filter event_sub_type = PROCESS_START and action_process_image_name ~= ".*?.(?:pdf|docx).exe"

dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?.(?:pdf|docx).exe"

dataset = xdr_data | filter action_process_image_name ~= ".*?.(?:pdf|docx).exe" | fields action_process_image

dataset = xdr_data | filter event_behavior = true event_sub_type = PROCESS_START and action_process_image_name ~= ".*?.(?:pdf|docx).exe"

3. Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

Security Manager Dashboard

Data Ingestion Dashboard

Security Admin Dashboard

Incident Management Dashboard

4. What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automatically block the IP addresses involved in malicious traffic.

5. When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

Click the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.

This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.

Click on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.

Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.

6. What license would be required for ingesting external logs from various vendors?

Cortex XDR Pro per Endpoint

Cortex XDR Vendor Agnostic Pro

Cortex XDR Pro per TB

Cortex XDR Cloud per Host

7. An attacker tries to load dynamic libraries on macOS from an unsecure location.

Which Cortex XDR module can prevent this attack?

DDL Security

Hot Patch Protection

Kernel Integrity Monitor (KIM)

Dylib Hijacking

8. What is the purpose of the Unit 42 team?

Unit 42 is responsible for automation and orchestration of products

Unit 42 is responsible for the configuration optimization of the Cortex XDR server

Unit 42 is responsible for threat research, malware analysis and threat hunting

Unit 42 is responsible for the rapid deployment of Cortex XDR agents

9. Which Type of IOC can you define in Cortex XDR?

destination port

e-mail address

full path

App-ID

10. When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

Pending

It is blank

Unassigned

New

Page 2 of 3

11. In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

Create a custom XQL widget

This is not currently supported

Create a custom report and filter on starred incidents

Click the star in the widget

12. Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response --> Action Center

under the gear icon --> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

13. What does the following output tell us?

There is one low severity incident.

Host shpapy_win10 had the most vulnerabilities.

There is one informational severity alert.

This is an actual output of the Top 10 hosts with the most malware.

14. Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

Sensor Engine

Causality Analysis Engine

Log Stitching Engine

Causality Chain Engine

15. Which type of BIOC rule is currently available in Cortex XDR?

Threat Actor

Discovery

Network

Dropper

16. In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer.

What is one way to add an exception for the singer?

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

17. As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it.

What steps can you take to ensure that the same protection is extended to all your servers?

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

Enable DLL Protection on all servers but there might be some false positives.

Create IOCs of the malicious files you have found to prevent their execution.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

18. Which statement is true based on the following Agent Auto Upgrade widget?

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than In Progress status.

19. What is the purpose of targeting software vendors in a supply-chain attack?

to take advantage of a trusted software delivery method.

to steal users’ login credentials.

to access source code.

to report Zero-day vulnerabilities.

20. What is the standard installation disk space recommended to install a Broker VM?

1GB disk space

2GB disk space

512GB disk space

256GB disk space

Page 3 of 3

21. Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

in the macOS Malware Protection Profile to indicate allowed signers

in the Linux Malware Protection Profile to indicate allowed Java libraries

SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

in the Windows Malware Protection Profile to indicate allowed executables

22. How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

by encrypting the disk first.

by utilizing decoy Files.

by retrieving the encryption key.

by patching vulnerable applications.

23. What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

Netflow Collector

Syslog Collector

DB Collector

Pathfinder

24. In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Agent Proxy

Agent Installer and Content Caching

Syslog Collector

CSV Collector

25. When is the wss (WebSocket Secure) protocol used?

when the Cortex XDR agent downloads new security content

when the Cortex XDR agent uploads alert data

when the Cortex XDR agent connects to WildFire to upload files for analysis

when the Cortex XDR agent establishes a bidirectional communication channel

26. With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

27. Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Cortex XDR Pro per TB

Host Insights

Cortex XDR Pro per Endpoint

Cortex XDR Cloud per Host

28. What kind of the threat typically encrypts user files?

ransomware

SQL injection attacks

Zero-day exploits

supply-chain attacks

Palo Alto Networks PCDRA Questions and Answers

Palo Alto Networks PCDRA Questions and Answers

Share this post

Leave a Reply Cancel reply

Related Posts