Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 11:

  What license would be required for ingesting external logs from various vendors?

  A. Cortex XDR Pro per Endpoint
  B. Cortex XDR Vendor Agnostic Pro
  C. Cortex XDR Pro per TB
  D. Cortex XDR Cloud per Host
  C. Cortex XDR Pro per TB

  ---

  Explanation

  To ingest external logs from various vendors, you need a Cortex XDR Pro per TB license. This license allows you to collect and analyze logs from Palo Alto Networks and third-party sources, such as firewalls, proxies, endpoints, cloud services, and more. You can use the Log Forwarding app to forward logs from the Logging Service to an external syslog receiver. The Cortex XDR Pro per Endpoint license only supports logs from Cortex XDR agents installed on endpoints.

  The Cortex XDR Vendor Agnostic Pro and Cortex XDR Cloud per Host licenses do not exist. References Features by Cortex XDR License Type Log Forwarding App for Cortex XDR Analytics SaaS Log Collection

• Question 12:

  When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

  A. Assign incidents to an analyst in bulk.
  B. Change the status of multiple incidents.
  C. Investigate several Incidents at once.
  D. Delete the selected Incidents.
  A. Assign incidents to an analyst in bulk.
  B. Change the status of multiple incidents.

  ---

  Explanation

  When selecting multiple incidents at a time, the options that are available from the menu when a user right-clicks the incidents are: Assign incidents to an analyst in bulk and Change the status of multiple incidents.

  These options allow the user to perform bulk actions on the selected incidents, such as assigning them to a specific analyst or changing their status to open, in progress, resolved, or closed. These options can help the user to manage and prioritize the incidents more efficiently and effectively. To use these options, the user needs to select the incidents from the incident table, right-click on them, and choose the desired option from the menu. The user can also use keyboard shortcuts to perform these actions, such as Ctrl+A to select all incidents, Ctrl+Shift+A to assign incidents to an analyst, and Ctrl+Shift+S to change the status of incidents12

  Assign Incidents to an Analyst in Bulk Change the Status of Multiple Incidents

• Question 13:

  What is the difference between presets and datasets in XQL?

  A. A dataset is a Cortex data lake data source only; presets are built-in data source.
  B. A dataset is a built-in or third-party source; presets group XDR data fields.
  C. A dataset is a database; presets is a field.
  D. A dataset is a third-party data source; presets are built-in data source.
  B. A dataset is a built-in or third-party source; presets group XDR data fields.

  ---

  Explanation

  The difference between presets and datasets in XQL is that a dataset is a built-in or third-party data source, while a preset is a group of XDR data fields. A dataset is a collection of data that you can query and analyze using XQL. A dataset can be a Cortex data lake data source, such as endpoints, alerts, incidents, or network flows, or a third-party data source, such as AWS CloudTrail, Azure Activity Logs, or Google Cloud Audit Logs. A preset is a predefined set of XDR data fields that are relevant for a specific use case, such as process execution, file operations, or network activity. A preset can help you simplify and standardize your XQL queries by selecting the most important fields for your analysis. You can use presets with any Cortex data lake data source, but not with third-party data sources. References Datasets and Presets

  XQL Language Reference

• Question 14:

  Which search methods is supported by File Search and Destroy?

  A. File Seek and Destroy
  B. File Search and Destroy
  C. File Seek and Repair
  D. File Search and Repair
  B. File Search and Destroy

  ---

  Explanation

  File Search and Destroy is a feature of Cortex XDR that allows you to search for and remove malicious files from endpoints. You can use this feature to find files by their hash, full path, or partial path using regex parameters. You can then select the files from the search results and destroy them by hash or by path.

  When you destroy a file by hash, all the file instances on the endpoint are removed. File Search and Destroy is useful for quickly responding to threats and preventing further damage. References Search and Destroy Malicious Files Cortex XDR Pro Administrator Guide

• Question 15:

  Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

  A. Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
  B. From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
  C. Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
  D. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.
  D. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

  ---

  Explanation

  To add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint, you need to use the Action Center in Cortex XDR. The Action Center allows you to create and manage actions that apply to endpoints, such as adding files or processes to the allow list or block list, isolating or unisolating endpoints, or initiating live terminal sessions. To add a file hash to the allow list, you need to choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

  This will prevent the Malware profile from scanning or blocking the file on the endpoints that match the scope of the action.

  References:

  Cortex XDR 3: Responding to Attacks1, Action Center2

• Question 16:

  What does the following output tell us?

  

  A. There is one low severity incident.
  B. Host shpapy_win10 had the most vulnerabilities.
  C. There is one informational severity alert.
  D. This is an actual output of the Top 10 hosts with the most malware.
  D. This is an actual output of the Top 10 hosts with the most malware.

  ---

  Explanation

  The output shows the top 10 hosts with the most malware in the last 30 days, based on the Cortex XDR data. The output is sorted by the number of incidents, with the host with the most incidents at the top. The output also shows the number of alerts, the number of endpoints, and the percentage of endpoints for each host. The output is generated by using the ACC (Application Command Center) feature of Cortex XDR, which provides a graphical representation of the network activity and threat landscape. The ACC allows you to view and analyze various widgets, such as the Top 10 hosts with the most malware, the Top 10 applications by bandwidth, the Top 10 threats by count, and more.

  Use the ACC to Analyze Network Activity Top 10 Hosts with the Most Malware

• Question 17:

  Where would you view the WildFire report in an incident?

  A. next to relevant Key Artifacts in the incidents details page
  B. under Response --> Action Center
  C. under the gear icon --> Agent Audit Logs
  D. on the HUB page at apps.paloaltonetworks.com
  A. next to relevant Key Artifacts in the incidents details page

  ---

  Explanation

  To view the WildFire report in an incident, you need to go to the incident details page and look for the relevant key artifacts that are related to the WildFire analysis. A key artifact is a piece of evidence that is associated with an alert or an incident, such as a file hash, a registry key, an IP address, a domain name, or a full path. If a key artifact is related to a WildFire analysis, you will see a WildFire icon next to it, indicating that there is a WildFire report available for that artifact. You can click on the WildFire icon to view the report, which will show you the detailed information about the artifact, such as the verdict, the behavior, the severity, the signatures, and the screenshots 12.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  B. under Response --> Action Center: This is not the correct answer. The Action Center is a feature that allows you to create and manage actions that you can perform on your endpoints, such as isolating, scanning, collecting files, or executing scripts. The Action Center does not show you the WildFire reports for the incidents, but it can help you to remediate the incidents by applying the appropriate actions3.

  C. under the gear icon --> Agent Audit Logs: This is not the correct answer. The Agent Audit Logs are logs that show you the activities and events that occurred on the Cortex XDR agents, such as installation, upgrade, connection, policy update, or prevention. The Agent Audit Logs do not show you the WildFire reports for the incidents, but they can help you to troubleshoot the agent issues or verify the agent status4.

  D. on the HUB page at apps.paloaltonetworks.com: This is not the correct answer. The HUB page is a web portal that allows you to access and manage your Palo Alto Networks applications, such as Cortex XDR, Cortex XSOAR, Prisma Cloud, or AutoFocus. The HUB page does not show you the WildFire reports for the incidents, but it can help you to navigate to the different applications or view the notifications and alerts5. In conclusion, to view the WildFire report in an incident, you need to go to the incident details page and look for the relevant key artifacts that are related to the WildFire analysis. By viewing the WildFire report, you can gain more insights and context about the incident and the artifact. View Incident Details View WildFire Reports Action Center Agent Audit Logs HUB

• Question 18:

  What is the function of WildFire for Cortex XDR?

  A. WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.
  B. WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.
  C. WildFire accepts and analyses a sample to provide a verdict.
  D. WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.
  C. WildFire accepts and analyses a sample to provide a verdict.

  ---

  Explanation

  WildFire is a cloud-based service that accepts and analyses samples from various sources, including Cortex XDR, to provide a verdict of malware, benign, or grayware. WildFire also generates detailed analysis reports that show the behaviour and characteristics of the samples. Cortex XDR uses WildFire verdicts and reports to enhance its detection and prevention capabilities, as well as to provide more visibility and context into the threats. References WildFire Analysis Concepts WildFire Overview

• Question 19:

  Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

  A. a hierarchical database that stores settings for the operating system and for applications
  B. a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the "swap"
  C. a central system, available via the internet, for registering officially licensed versions of software to prove ownership
  D. a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system
  A. a hierarchical database that stores settings for the operating system and for applications

  ---

  Explanation

  The Windows Registry is a hierarchical database that stores settings for the operating system and for applications that run on Windows. The registry contains information, settings, options, and other values for programs and hardware installed on all versions of Microsoft Windows operating systems. The registry is organized into five main sections, called hives, each of which contains keys, subkeys, and values. The Cortex XDR agent uses the registry to store its configuration, status, and logs, as well as to monitor and control the endpoint's security features. The Cortex XDR agent also allows you to run scripts that can read, write, or delete registry keys and values on the endpoint. References Windows Registry - Wikipedia Registry Operations

• Question 20:

  Which statement is correct based on the report output below?

  

  A. Host Inventory Data Collection is enabled.
  B. 3,297 total incidents have been detected.
  C. Forensic inventory data collection is enabled.
  D. 133 agents have full disk encryption.
  A. Host Inventory Data Collection is enabled.