Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response --> Action Center

under the gear icon --> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

What does the following output tell us?

This is an actual output of the Top 10 hosts with the most malware.

There is one low severity incident.

Host shpapy_win10 had the most vulnerabilities.

There is one informational severity alert.

This is an actual output of the Top 10 hosts with the most malware.

In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

Add the signer to the allow list in the malware profile.

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

Enable DLL Protection on all servers but there might be some false positives.

Create IOCs of the malicious files you have found to prevent their execution.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Which statement is true based on the following Agent Auto Upgrade widget?

Agent Auto Upgrade was enabled but not on all endpoints.

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than In Progress status.

What is the purpose of targeting software vendors in a supply-chain attack?

to take advantage of a trusted software delivery method.

to steal users' login credentials.

to report Zero-day vulnerabilities.

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

in the Windows Malware Protection Profile to indicate allowed executables

in the macOS Malware Protection Profile to indicate allowed signers

in the Linux Malware Protection Profile to indicate allowed Java libraries

SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

in the Windows Malware Protection Profile to indicate allowed executables

How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

by retrieving the encryption key.

by patching vulnerable applications.

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Agent Installer and Content Caching

When is the wss (WebSocket Secure) protocol used?

when the Cortex XDR agent establishes a bidirectional communication channel

when the Cortex XDR agent downloads new security content

when the Cortex XDR agent uploads alert data

when the Cortex XDR agent connects to WildFire to upload files for analysis

when the Cortex XDR agent establishes a bidirectional communication channel

With a Cortex XDR Prevent license, which objects are considered to be sensors?

Palo Alto Networks Next-Generation Firewalls

If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

Local Agent Installer and Content Caching

What is by far the most common tactic used by ransomware to shut down a victim's operation?

encrypting certain files to prevent access by the victim

preventing the victim from being able to access APIs to cripple infrastructure

denying traffic out of the victims network until payment is received

restricting access to administrative accounts to the victim

encrypting certain files to prevent access by the victim

Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.

Exfiltration, Command and Control, Lateral Movement

Exfiltration, Command and Control, Collection

Exfiltration, Command and Control, Privilege Escalation

Exfiltration, Command and Control, Impact

Exfiltration, Command and Control, Lateral Movement

When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

Assign incidents to an analyst in bulk.

Change the status of multiple incidents.

Assign incidents to an analyst in bulk.

Change the status of multiple incidents.

Investigate several Incidents at once.

What is the outcome of creating and implementing an alert exclusion?

The Cortex XDR console will hide those alerts.

The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

The Cortex XDR console will hide those alerts.

The Cortex XDR agent will not create an alert for this event in the future.

The Cortex XDR console will delete those alerts and block ingestion of them in the future.

Which statement is true for Application Exploits and Kernel Exploits?

The ultimate goal of any exploit is to reach the kernel.

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.

Which of the following is an example of a successful exploit?

a user executing code which takes advantage of a vulnerability on a local service.

connecting unknown media to an endpoint that copied malware due to Autorun.

a user executing code which takes advantage of a vulnerability on a local service.

identifying vulnerable services on a server.

executing a process executable for well-known and signed software.

Which of the following represents the correct relation of alerts to incidents?

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three-hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Resolved -- False Positive

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved -- False Positive

Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.

Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.

Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

After scan, how does file quarantine function work on an endpoint?

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine takes ownership of the files and folders and prevents execution through access control.

Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

exception profiles that apply to specific endpoints

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

role-based profiles that apply to specific endpoints

To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?

It interferes with the pattern as soon as it is observed on the endpoint.

It does not interfere with any portion of the pattern on the endpoint.

It interferes with the pattern as soon as it is observed by the firewall.

It does not need to interfere with the any portion of the pattern to prevent the attack.

It interferes with the pattern as soon as it is observed on the endpoint.

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection is extended to all your servers?

Create lOCs of the malicious files you have found to prevent their execution.

Conduct a thorough Endpoint Malware scan.

Enable DLL Protection on all servers but there might be some false positives.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Create lOCs of the malicious files you have found to prevent their execution.

What is the difference between presets and datasets in XQL?

A dataset is a built-in or third-party source; presets group XDR data fields.

A dataset is a Cortex data lake data source only; presets are built-in data source.

A dataset is a built-in or third-party source; presets group XDR data fields.

A dataset is a database; presets is a field.

A dataset is a third-party data source; presets are built-in data source.

What should you do to automatically convert leads into alerts after investigating a lead?

Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Lead threats can't be prevented in the future because they already exist in the environment.

Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Build a search query using Query Builder or XQL using a list of lOCs.

Which type of IOC can you define in Cortex XDR?

Destination IP Address: Destination

Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

The endpoint is disconnected or the verdict from WildFire is of a type unknown.

The endpoint is disconnected or the verdict from WildFire is of a type benign.

The endpoint is disconnected or the verdict from WildFire is of a type unknown.

The endpoint is disconnected or the verdict from WildFire is of a type malware.

The endpoint is disconnected or the verdict from WildFire is of a type grayware.

Palo Alto Networks PCDRA Practice Test 2 - Free Online Exam Prep & Questions

In incident-related widgets, how would you filter the display to only show incidents that were ''starred''?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCDRA Practice Test 2

Question

Drag and Drop

Hot Area

Palo Alto Networks PCDRA Practice Tests

Practice Tests