ExamGecko

Palo Alto Networks PCDRA Practice Test - Questions Answers, Page 9

Question list
Search
Search

In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

A.
Salesforce
A.
Salesforce
Answers
B.
Jira
B.
Jira
Answers
C.
Service Now
C.
Service Now
Answers
D.
Slack
D.
Slack
Answers
Suggested answer: D

Explanation:

Cortex XDR allows you to schedule reports and forward them to Slack, a cloud-based collaboration platform. You can configure the Slack channel, frequency, and recipients of the scheduled reports. You can also view the report history and status in the Cortex XDR management console.Reference:

Scheduled Queries: This document explains how to create, edit, and manage scheduled queries and reports in Cortex XDR.

Forward Scheduled Reports to Slack: This document provides the steps to configure Slack integration and forward scheduled reports to a Slack channel.

Can you disable the ability to use the Live Terminal feature in Cortex XDR?

A.
Yes, via the Cortex XDR console or with an installation switch.
A.
Yes, via the Cortex XDR console or with an installation switch.
Answers
B.
No, a separate installer package without Live Terminal is required.
B.
No, a separate installer package without Live Terminal is required.
Answers
C.
No, it is a required feature of the agent.
C.
No, it is a required feature of the agent.
Answers
D.
Yes, via Agent Settings Profile.
D.
Yes, via Agent Settings Profile.
Answers
Suggested answer: D

Explanation:

The Live Terminal feature in Cortex XDR allows you to initiate a remote connection to an endpoint and perform various actions such as running commands, uploading and downloading files, and terminating processes. You can disable the ability to use the Live Terminal feature in Cortex XDR by configuring the Agent Settings Profile. The Agent Settings Profile defines the behavior and functionality of the Cortex XDR agent on the endpoint. You can create different profiles for different groups of endpoints and assign them accordingly. To disable the Live Terminal feature, you need to uncheck theEnable Live Terminaloption in the Agent Settings Profile and save the changes. This will prevent the Cortex XDR agent from accepting any Live Terminal requests from the Cortex XDR management console.Reference:

Live Terminal: This document explains how to use the Live Terminal feature to investigate and respond to security events on Windows endpoints.

Agent Settings Profile: This document describes how to create and manage Agent Settings Profiles to define the behavior and functionality of the Cortex XDR agent on the endpoint.

Which of the following represents a common sequence of cyber-attack tactics?

A.
Actions on the objective Reconnaissance Weaponization & Delivery Exploitation Installation Command & Control
A.
Actions on the objective Reconnaissance Weaponization & Delivery Exploitation Installation Command & Control
Answers
B.
Installation >> Reconnaissance Weaponization & Delivery Exploitation Command & Control Actions on the objective
B.
Installation >> Reconnaissance Weaponization & Delivery Exploitation Command & Control Actions on the objective
Answers
C.
Reconnaissance Weaponization & Delivery Exploitation Installation Command & Control Actions on the objective
C.
Reconnaissance Weaponization & Delivery Exploitation Installation Command & Control Actions on the objective
Answers
D.
Reconnaissance >> Installation Weaponization & Delivery Exploitation Command & Control Actions on the objective
D.
Reconnaissance >> Installation Weaponization & Delivery Exploitation Command & Control Actions on the objective
Answers
Suggested answer: C

Explanation:

A common sequence of cyber-attack tactics is based on the Cyber Kill Chain model, which describes the stages of a cyber intrusion from the perspective of the attacker. The Cyber Kill Chain model consists of seven phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on the objective. These phases are briefly explained below:

Reconnaissance: The attacker gathers information about the target, such as its network, systems, vulnerabilities, employees, and business operations. The attacker may use various methods, such as scanning, phishing, or searching open sources, to collect data that can help them plan the attack.

Weaponization: The attacker creates or obtains a malicious payload, such as malware, exploit, or script, that can be used to compromise the target. The attacker may also embed the payload into a delivery mechanism, such as an email attachment, a web link, or a removable media.

Delivery: The attacker sends or delivers the weaponized payload to the target, either directly or indirectly. The attacker may use various channels, such as email, web, or physical access, to reach the target's network or system.

Exploitation: The attacker exploits a vulnerability or weakness in the target's network or system to execute the payload. The vulnerability may be technical, such as a software flaw, or human, such as a social engineering trick.

Installation: The attacker installs or drops additional malware or tools on the target's network or system to establish a foothold and maintain persistence. The attacker may use various techniques, such as registry modification, file manipulation, or process injection, to hide their presence and evade detection.

Command and Control: The attacker establishes a communication channel between the compromised target and a remote server or controller. The attacker may use various protocols, such as HTTP, DNS, or IRC, to send commands and receive data from the target.

Actions on the objective: The attacker performs the final actions that achieve their goal, such as stealing data, destroying files, encrypting systems, or disrupting services. The attacker may also try to move laterally within the target's network or system to access more resources or data.

Cyber Kill Chain: This document explains the Cyber Kill Chain model and how it can be used to analyze and respond to cyberattacks.

Cyber Attack Tactics: This document provides an overview of some common cyber attack tactics and examples of how they are used by threat actors.

What is the maximum number of agents one Broker VM local agent applet can support?

A.
5,000
A.
5,000
Answers
B.
10,000
B.
10,000
Answers
C.
15,000
C.
15,000
Answers
D.
20,000
D.
20,000
Answers
Suggested answer: B

Explanation:

The Broker VM is a virtual machine that you can deploy in your network to provide various services and functionalities to the Cortex XDR agents. One of the services that the Broker VM offers is the Local Agent Settings applet, which allows you to configure the agent proxy, agent installer, and content caching settings for the agents. The Local Agent Settings applet can support a maximum number of10,000 agentsper Broker VM. If you have more than 10,000 agents in your network, you need to deploy additional Broker VMs and distribute the load among them.Reference:

Broker VM Overview: This document provides an overview of the Broker VM and its features, requirements, and deployment options.

Configure the Broker VM: This document explains how to install, set up, and configure the Broker VM in an ESXi environment.

Manage Broker VM from the Cortex XDR Management Console: This document describes how to activate and manage the Broker VM applets from the Cortex XDR management console.

Which Exploit Protection Module (EPM) can be used to prevent attacks based on OS function?

A.
UASLR
A.
UASLR
Answers
B.
JIT Mitigation
B.
JIT Mitigation
Answers
C.
Memory Limit Heap Spray Check
C.
Memory Limit Heap Spray Check
Answers
D.
DLL Security
D.
DLL Security
Answers
Suggested answer: B

Explanation:

JIT Mitigation is an Exploit Protection Module (EPM) that can be used to prevent attacks based on OS function. JIT Mitigation protects against exploits that use the Just-In-Time (JIT) compiler of the OS to execute malicious code. JIT Mitigation monitors the memory pages that are allocated by the JIT compiler and blocks any attempts to execute code from those pages. This prevents attackers from using the JIT compiler as a way to bypass other security mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).Reference:

Palo Alto Networks. (2023). PCDRA Study Guide. PDF file. Retrieved from https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-study-guide.pdf

Palo Alto Networks. (2021). Exploit Protection Modules. Web page. Retrieved from https://docs.paloaltonetworks.com/traps/6-0/traps-endpoint-security-manager-admin/traps-endpoint-security-policies/exploit-protection-modules.html

Why would one threaten to encrypt a hypervisor or, potentially, a multiple number of virtual machines running on a server?

A.
To extort a payment from a victim or potentially embarrass the owners.
A.
To extort a payment from a victim or potentially embarrass the owners.
Answers
B.
To gain notoriety and potentially a consulting position.
B.
To gain notoriety and potentially a consulting position.
Answers
C.
To better understand the underlying virtual infrastructure.
C.
To better understand the underlying virtual infrastructure.
Answers
D.
To potentially perform a Distributed Denial of Attack.
D.
To potentially perform a Distributed Denial of Attack.
Answers
Suggested answer: A

Explanation:

Encrypting a hypervisor or a multiple number of virtual machines running on a server is a form of ransomware attack, which is a type of cyberattack that involves locking or encrypting the victim's data or system and demanding a ransom for its release. The attacker may threaten to encrypt the hypervisor or the virtual machines to extort a payment from the victim or potentially embarrass the owners by exposing their sensitive or confidential information. Encrypting a hypervisor or a multiple number of virtual machines can have a severe impact on the victim's business operations, as it can affect the availability, integrity, and confidentiality of their data and applications. The attacker may also use the encryption as a leverage to negotiate a higher ransom or to coerce the victim into complying with their demands.Reference:

Encrypt an Existing Virtual Machine or Virtual Disk: This document explains how to encrypt an existing virtual machine or virtual disk using the vSphere Client.

How to Encrypt an Existing or New Virtual Machine: This article provides a guide on how to encrypt an existing or new virtual machine using AOMEI Backupper.

Ransomware: This document provides an overview of ransomware, its types, impacts, and prevention methods.

Which minimum Cortex XDR agent version is required for Kubernetes Cluster?

A.
Cortex XDR 6.1
A.
Cortex XDR 6.1
Answers
B.
Cortex XDR 7.4
B.
Cortex XDR 7.4
Answers
C.
Cortex XDR 7.5
C.
Cortex XDR 7.5
Answers
D.
Cortex XDR 5.0
D.
Cortex XDR 5.0
Answers
Suggested answer: C

Explanation:

The minimum Cortex XDR agent version required for Kubernetes Cluster is Cortex XDR 7.5. This version introduces the Cortex XDR agent for Kubernetes hosts, which provides protection and visibility for Linux hosts that run on Kubernetes clusters. The Cortex XDR agent for Kubernetes hosts supports the following features:

Anti-malware protection

Behavioral threat protection

Exploit protection

File integrity monitoring

Network security

Audit and remediation

Live terminal

To install the Cortex XDR agent for Kubernetes hosts, you need to deploy the Cortex XDR agent as a DaemonSet on your Kubernetes cluster. You also need to configure the agent settings profile and the agent installer in the Cortex XDR management console.Reference:

Cortex XDR Agent Release Notes: This document provides the release notes for Cortex XDR agent versions, including the new features, enhancements, and resolved issues.

Install the Cortex XDR Agent for Kubernetes Hosts: This document explains how to install and configure the Cortex XDR agent for Kubernetes hosts using the Cortex XDR management console and the Kubernetes command-line tool.

What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

A.
MTH researches for threats in the tenant and generates a report with the findings.
A.
MTH researches for threats in the tenant and generates a report with the findings.
Answers
B.
MTH researches for threats in the logs and reports to engineering.
B.
MTH researches for threats in the logs and reports to engineering.
Answers
C.
MTH runs queries and investigative actions and no further action is taken.
C.
MTH runs queries and investigative actions and no further action is taken.
Answers
D.
MTH pushes content updates to prevent against the zero-day exploits.
D.
MTH pushes content updates to prevent against the zero-day exploits.
Answers
Suggested answer: A

Explanation:

The Managed Threat Hunting (MTH) team is a group of security experts who proactively hunt for threats in the Cortex XDR tenant and generate a report with the findings. The MTH team uses advanced queries and investigative actions to identify and analyze potential threats, such as zero-day exploits, that may have bypassed the prevention and detection capabilities of Cortex XDR. The MTH team also provides recommendations and best practices to help customers remediate the threats and improve their security posture.Reference:

Managed Threat Hunting Service

Managed Threat Hunting Report

Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

A.
Memory Limit Heap spray check
A.
Memory Limit Heap spray check
Answers
B.
UASLR
B.
UASLR
Answers
C.
JIT Mitigation
C.
JIT Mitigation
Answers
D.
DLL Security
D.
DLL Security
Answers
Suggested answer: B

Explanation:

UASLR stands for User Address Space Layout Randomization, which is a feature of Exploit Prevention Module (EPM) that provides better entropy for randomization of memory locations. UASLR adds entropy to the base address of the executable image and the heap, making it harder for attackers to predict the memory layout of a process. UASLR is enabled by default for all processes, but can be disabled or customized for specific applications using the EPM policy settings.Reference:

Exploit Prevention Module (EPM) entropy randomization memory locations

Exploit protection reference

Which statement is correct based on the report output below?

A.
Host Inventory Data Collection is enabled.
A.
Host Inventory Data Collection is enabled.
Answers
B.
3,297 total incidents have been detected.
B.
3,297 total incidents have been detected.
Answers
C.
Forensic inventory data collection is enabled.
C.
Forensic inventory data collection is enabled.
Answers
D.
133 agents have full disk encryption.
D.
133 agents have full disk encryption.
Answers
Suggested answer: C

Explanation:

The report output shows the number of endpoints that have forensic inventory data collection enabled, which is a feature of Cortex XDR that allows the collection of detailed information about the endpoint's hardware, software, and network configuration. This feature helps analysts to investigate and respond to incidents more effectively by providing a comprehensive view of the endpoint's state and activity. Forensic inventory data collection can be enabled or disabled per policy in Cortex XDR.Reference:

Forensic Inventory Data Collection

Cortex XDR 3: Getting Started with Endpoint Protection

Total 91 questions
Go to page: of 10