Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 101:

  What kind of attacks does Cortex XDR primarily help defend against?

  A. Network-based denial-of-service attacks
  B. Behavioral threats, file-based malware, and exploit-based attacks
  C. Insider threats only
  D. Web application attacks
  B. Behavioral threats, file-based malware, and exploit-based attacks

  ---

  Explanation

  Annotation:

  Cortex XDR is designed to protect against behavioral threats, file-based malware, and exploit-based attacks. It uses a combination of behavioral analytics and prevention techniques to identify and block these types of attacks. Option A, C, and D represent narrower categories that Cortex XDR does not solely focus on.

• Question 102:

  Phishing belongs to which of the following MITRE ATT&CK tactics?

  A. Initial Access, Persistence
  B. Persistence, Command and Control
  C. Reconnaissance, Persistence
  D. Reconnaissance, Initial Access
  D. Reconnaissance, Initial Access

  ---

  Explanation

  Phishing is a technique that belongs to two MITRE ATT&CK tactics: Reconnaissance and Initial Access.

  Reconnaissance is the process of gathering information about a target before launching an attack.

  Phishing for information is a sub-technique of Reconnaissance that involves sending phishing messages to elicit sensitive information that can be used during targeting. Initial Access is the process of gaining a foothold in a network or system. Phishing is a sub-technique of Initial Access that involves sending phishing messages to execute malicious code on victim systems. Phishing can be used for both Reconnaissance and Initial Access depending on the objective and content of the phishing message.

  References Phishing, Technique T1566 - Enterprise | MITRE ATT&CK(R) 1 Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK(R) 2 Phishing for information, Part 2: Tactics and techniques 3 PHISHING AND THE MITREATT&CK FRAMEWORK - EnterpriseTalk 4 Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK(R) 5

• Question 103:

  Which of the following represents the correct relation of alerts to incidents?

  A. Only alerts with the same host are grouped together into one Incident in a given time frame.
  B. Alerts that occur within a three-hour time frame are grouped together into one Incident.
  C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.
  D. Every alert creates a new Incident.
  C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

  ---

  Explanation

  The correct relation of alerts to incidents is that alerts with same causality chains that occur within a given time frame are grouped together into an incident. A causality chain is a sequence of events that are related to the same malicious activity, such as a malware infection, a lateral movement, or a data exfiltration.

  Cortex XDR uses a set of rules that take into account different attributes of the alerts, such as the alert source, type, and time period, to determine if they belong to the same causality chain. By grouping related alerts into incidents, Cortex XDR reduces the number of individual events to review and provides a complete picture of the attack with rich investigative details 1.

  Option A is incorrect, because alerts with the same host are not necessarily grouped together into one incident in a given time frame. Alerts with the same host may belong to different causality chains, or may be unrelated to any malicious activity. For example, if a host has a malware infection and a network anomaly, these alerts may not be grouped into the same incident, unless they are part of the same attack.

  Option B is incorrect, because alerts that occur within a three hour time frame are not always grouped together into one incident. The time frame is not the only criterion for grouping alerts into incidents. Alerts that occur within a three hour time frame may belong to different causality chains, or may be unrelated to any malicious activity. For example, if a host has a file download and a registry modification within a three hour time frame, these alerts may not be grouped into the same incident, unless they are part of the same attack.

  Option D is incorrect, because every alert does not create a new incident. Creating a new incident for every alert would result in alert fatigue and inefficient investigations. Cortex XDR aims to reduce the number of incidents by grouping related alerts into one incident, based on their causality chains and other attributes.

  Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 9 Palo Alto Networks Cortex XDR Documentation, Incident Management Overview2 Cortex XDR: Stop Breaches with AI-Powered Cybersecurity1

• Question 104:

  What action can you perform directly from the Cortex XDR console in the event of an isolated endpoint?

  A. Upgrade agent
  B. Quarantine file
  C. Run a scan
  D. Perform full system restoration
  B. Quarantine file

  ---

  Explanation

  You can directly quarantine files on an endpoint from the Cortex XDR console. This isolates the malicious files to prevent further damage. While agent upgrades and scans are possible, performing a full system restoration is not a direct action from the console.

• Question 105:

  When creating a BIOC rule, which XQL query can be used?

  A. dataset = xdr_data | filter event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  B. dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  C. dataset = xdr_data | filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" | fields action_process_image
  D. dataset = xdr_data | filter event_behavior = true event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  B. dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

  ---

  Explanation

  A BIOC rule is a custom detection rule that uses the Cortex Query Language (XQL) to define the behavior or actions that indicate a potential threat. A BIOC rule can use the xdr_data and cloud_audit_log datasets and presets for these datasets. A BIOC rule can also use the filter stage, alter stage, and functions without any aggregations in the XQL query. The query must return a single field named action_process_image, which is the process image name of the suspicious process. The query must also include the event_type and event_sub_type fields in the filter stage to specify the type and sub-type of the event that triggers the rule.

  Option B is the correct answer because it meets all the requirements for a valid BIOC rule query. It uses the xdr_data dataset, the filter stage, the event_type and event_sub_type fields, and the action_process_image_name field with a regular expression to match any process image name that ends with. pdf.exe or.docx.exe, which are common indicators of malicious files.

  Option A is incorrect because it does not include the event_type field in the filter stage, which is mandatory for a BIOC rule query.

  Option C is incorrect because it does not include the event_type and event_sub_type fields in the filter stage, and it uses the fields stage, which is not supported for a BIOC rule query. It also returns the action_process_image field instead of the action_process_image_name field, which is the expected output for a BIOC rule query.

  Option D is incorrect because it uses the event_behavior field, which is not supported for a BIOC rule query. It also does not include the event_type field in the filter stage, and it uses the event_sub_type field incorrectly. The event_sub_type field should be equal to PROCESS_START, not true.

  Working with BIOCs

  Cortex Query Language (XQL) Reference

• Question 106:

  Which statement regarding scripts in Cortex XDR is true?

  A. Any version of Python script can be run.
  B. The level of risk is assigned to the script upon import.
  C. Any script can be imported including Visual Basic (VB) scripts.
  D. The script is run on the machine uploading the script to ensure that it is operational.
  B. The level of risk is assigned to the script upon import.

  ---

  Explanation

  The correct answer is B, the level of risk is assigned to the script upon import. When you import a script to the Agent Script Library in Cortex XDR, you need to specify the level of risk associated with the script. The level of risk determines the permissions and restrictions for running the script on endpoints. The levels of risk are:

  Low: The script can be run on any endpoint without requiring approval from the Cortex XDR administrator.

  The script can also be used in remediation suggestions or automation actions.

  Medium: The script can be run on any endpoint, but requires approval from the Cortex XDR administrator. The script can also be used in remediation suggestions or automation actions.

  High: The script can only be run on isolated endpoints, and requires approval from the Cortex XDR administrator. The script cannot be used in remediation suggestions or automation actions. The other options are incorrect for the following reasons: A is incorrect because not any version of Python script can be run in Cortex XDR. The scripts must be written in Python 2.7, and must follow the guidelines and limitations described in the Cortex XDR documentation. For example, the scripts must not exceed 64 KB in size, must not use external libraries or modules, and must not contain malicious or harmful code.

  C is incorrect because not any script can be imported to Cortex XDR, including Visual Basic (VB) scripts.

  The scripts must be written in Python 2.7, and must follow the guidelines and limitations described in the Cortex XDR documentation. VB scripts are not supported by Cortex XDR, and will not run on the endpoints.

  D is incorrect because the script is not run on the machine uploading the script to ensure that it is operational. The script is only validated for syntax errors and size limitations when it is imported to the Agent Script Library. The script is not executed or tested on the machine uploading the script, and the script may still fail or cause errors when it is run on the endpoints.

  Agent Script Library

  Import a Script

  Run Scripts on an Endpoint

• Question 107:

  Which of the following is NOT a precanned script provided by Palo Alto Networks?

  A. delete_file
  B. quarantine_file
  C. process_kill_name
  D. list_directories
  D. list_directories

  ---

  Explanation

  Palo Alto Networks provides a set of precanned scripts that you can use to perform various actions on your endpoints, such as deleting files, killing processes, or quarantining malware. The precanned scripts are written in Python and are available in the Agent Script Library in the Cortex XDR console. You can use the precanned scripts as they are, or you can customize them to suit your needs. The precanned scripts are: delete_file: Deletes a specific file from a local or removable drive. quarantine_file: Moves a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed. process_kill_name: Kills a process by its name on the endpoint. process_kill_pid: Kills a process by its process ID (PID) on the endpoint. process_kill_tree: Kills a process and all its child processes by its name on the endpoint. process_kill_tree_pid: Kills a process and all its child processes by its PID on the endpoint. process_list: Lists all the processes running on the endpoint, along with their names, PIDs, and command lines. process_list_tree: Lists all the processes running on the endpoint, along with their names, PIDs, command lines, and parent processes. process_start: Starts a process on the endpoint by its name or path. registry_delete_key: Deletes a registry key and all its subkeys and values from the Windows registry. registry_delete_value: Deletes a registry value from the Windows registry. registry_list_key: Lists all the subkeys and values under a registry key in the Windows registry. registry_list_value: Lists the value and data of a registry value in the Windows registry. registry_set_value: Sets the value and data of a registry value in the Windows registry. The script list_directories is not a precanned script provided by Palo Alto Networks. It is a custom script that you can write yourself using Python commands.

  Run Scripts on an Endpoint Agent Script Library Precanned Scripts

• Question 108:

  When using the "File Search and Destroy" feature, which of the following search hash type is supported?

  A. SHA256 hash of the file
  B. AES256 hash of the file
  C. MD5 hash of the file
  D. SHA1 hash of the file
  A. SHA256 hash of the file

  ---

  Explanation

  The File Search and Destroy feature is a capability of Cortex XDR that allows you to search for and delete malicious or unwanted files across your endpoints. You can use this feature to quickly respond to incidents, remediate threats, and enforce compliance policies. To use the File Search and Destroy feature, you need to specify the file name and the file hash of the file you want to search for and delete. The file hash is a unique identifier of the file that is generated by a cryptographic hash function. The file hash ensures that you are targeting the exact file you want, and not a file with a similar name or a different version. The File Search and Destroy feature supports the SHA256 hash type, which is a secure hash algorithm that produces a 256-bit (32-byte) hash value. The SHA256 hash type is widely used for file integrity verification and digital signatures. The File Search and Destroy feature does not support other hash types, such as AES256, MD5, or SHA1, which are either encryption algorithms or less secure hash algorithms. Therefore, the correct answer is A, SHA256 hash of the file1234

  File Search and Destroy.

  What is a File Hash?

  SHA-2 - Wikipedia

  When using the "File Search and Destroy" feature, which of the following search hash type is supported?

• Question 109:

  Which protocol does the Cortex XDR agent use to upload alert data to the management console?

  A. FTP
  B. HTTP
  C. WSS
  D. SMTP
  B. HTTP

  ---

  Explanation

  The Cortex XDR agent uses HTTP for uploading alert data to the management console, ensuring secure transmission of information. WSS is used for bidirectional communication, but HTTP is primarily used for sending data to the console.