Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 21:

  What does WildFire in Cortex XDR primarily do?

  A. Analyzes network traffic for security threats
  B. Detects ransomware activity on endpoints
  C. Analyzes suspicious files in the cloud
  D. Applies behavioral analysis to prevent exploits
  C. Analyzes suspicious files in the cloud

  ---

  Explanation

  WildFire is a cloud-based analysis engine that primarily analyzes suspicious files to determine if they are malicious. It generates verdicts based on file behavior in a controlled environment. Options A, B, and D focus on other functionalities, not WildFire's file analysis.

• Question 22:

  Which function describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed?

  A. Search & destroy
  B. Isolation
  C. Quarantine
  D. Flag for removal
  C. Quarantine

  ---

  Explanation

  The function that describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed is quarantine. Quarantine is a feature of Cortex XDR that allows you to isolate malicious or suspicious files from the endpoint and prevent them from running or spreading. You can quarantine files manually from the Cortex XDR console, or automatically based on the malware analysis profile or the remediation suggestions. When you quarantine a file, the Cortex XDR agent encrypts the file and moves it to a hidden folder under the agent installation directory.

  The file is also renamed with a random string and a.quarantine extension. You can view, restore, or delete the quarantined files from the Cortex XDR console. References Quarantine Files Manage Quarantined Files

• Question 23:

  As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it.

  What steps can you take to ensure that the same protection is extended to all your servers?

  A. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
  B. Enable DLL Protection on all servers but there might be some false positives.
  C. Create IOCs of the malicious files you have found to prevent their execution.
  D. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
  A. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

  ---

  Explanation

  To ensure that the same protection is extended to all your servers, you need to create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity. BTP is a feature of Cortex XDR that allows you to create custom rules that detect and block malicious or suspicious behaviors on your endpoints, such as file execution, process injection, network connection, or registry modification. BTP rules can use various operators, functions, and variables to define the criteria and the actions for the rules. By creating BTP rules that match the behaviors of the supply chain attack, you can prevent the attack from compromising your servers 12.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  B. Enable DLL Protection on all servers but there might be some false positives: This is not the correct answer. Enabling DLL Protection on all servers will not ensure that the same protection is extended to all your servers. DLL Protection is a feature of Cortex XDR that allows you to block the execution of unsigned or untrusted DLL files on your endpoints. DLL Protection can help to prevent some types of attacks that use malicious DLL files, but it may not be effective against the supply chain attack that used a Trojanized DLL file that was digitally signed by a trusted vendor. DLL Protection may also cause some false positives, as it may block some legitimate DLL files that are unsigned or untrusted3.

  C. Create IOCs of the malicious files you have found to prevent their execution: This is not the correct answer. Creating IOCs of the malicious files you have found will not ensure that the same protection is extended to all your servers. IOCs are indicators of compromise that you can create to detect and respond to known threats on your endpoints, such as file hashes, registry keys, IP addresses, domain names, or full paths. IOCs can help to identify and block the malicious files that you have already discovered, but they may not be effective against the supply chain attack that used different variants of the malicious files with different hashes or names. IOCs may also become outdated, as the attackers may change or update their files to evade detection4.

  D. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading: This is not the correct answer. Enabling BTP with cytool will not ensure that the same protection is extended to all your servers. BTP is a feature of Cortex XDR that allows you to create custom rules that detect and block malicious or suspicious behaviors on your endpoints, such as file execution, process injection, network connection, or registry modification. BTP rules can help to prevent the attack from spreading, but they need to be created and configured in the Cortex XDR app, not with cytool. Cytool is a command-line tool that allows you to perform various operations on the Cortex XDR agent, such as installing, uninstalling, upgrading, or troubleshooting. Cytool does not have an option to enable or configure BTP rules. In conclusion, to ensure that the same protection is extended to all your servers, you need to create BTP rules to recognize and prevent the activity. By using BTP rules, you can create custom and flexible prevention rules that match the behaviors of the supply chain attack. Behavioral Threat Protection Create a BTP Rule DLL Protection Create an IOC Rule [Cytool]

• Question 24:

  In the Cortex XDR console, from which two pages are you able to manually perform the agent upgrade action? (Choose two.)

  A. Asset Management
  B. Agent Installations
  C. Action Center
  D. Endpoint Administration
  A. Asset Management
  D. Endpoint Administration

  ---

  Explanation

  To manually upgrade the Cortex XDR agents, you can use the Asset Management page or the Endpoint Administration page in the Cortex XDR console. On the Asset Management page, you can select one or more endpoints and click Actions > Upgrade Agent. On the Endpoint Administration page, you can select one or more agent versions and click Upgrade. You can also schedule automatic agent upgrades using the Agent Installations page. References Asset Management Endpoint Administration Agent Installations

• Question 25:

  Why would one threaten to encrypt a hypervisor or, potentially, a multiple number of virtual machines running on a server?

  A. To extort a payment from a victim or potentially embarrass the owners.
  B. To gain notoriety and potentially a consulting position.
  C. To better understand the underlying virtual infrastructure.
  D. To potentially perform a Distributed Denial of Attack.
  A. To extort a payment from a victim or potentially embarrass the owners.

  ---

  Explanation

  Encrypting a hypervisor or a multiple number of virtual machines running on a server is a form of ransomware attack, which is a type of cyberattack that involves locking or encrypting the victim's data or system and demanding a ransom for its release. The attacker may threaten to encrypt the hypervisor or the virtual machines to extort a payment from the victim or potentially embarrass the owners by exposing their sensitive or confidential information. Encrypting a hypervisor or a multiple number of virtual machines can have a severe impact on the victim's business operations, as it can affect the availability, integrity, and confidentiality of their data and applications. The attacker may also use the encryption as a leverage to negotiate a higher ransom or to coerce the victim into complying with their demands. References Encrypt an Existing Virtual Machine or Virtual Disk: This document explains how to encrypt an existing virtual machine or virtual disk using the vSphere Client.

  How to Encrypt an Existing or New Virtual Machine: This article provides a guide on how to encrypt an existing or new virtual machine using AOMEI Backupper.

  Ransomware: This document provides an overview of ransomware, its types, impacts, and prevention methods.

• Question 26:

  What is the outcome of creating and implementing an alert exclusion?

  A. The Cortex XDR agent will allow the process that was blocked to run on the endpoint.
  B. The Cortex XDR console will hide those alerts.
  C. The Cortex XDR agent will not create an alert for this event in the future.
  D. The Cortex XDR console will delete those alerts and block ingestion of them in the future.
  B. The Cortex XDR console will hide those alerts.

  ---

  Explanation

  The outcome of creating and implementing an alert exclusion is that the Cortex XDR console will hide those alerts that match the exclusion criteria. An alert exclusion is a policy that allows you to filter out alerts that are not relevant, false positives, or low priority, and focus on the alerts that require your attention.

  When you create an alert exclusion, you can specify the criteria that define which alerts you want to exclude, such as alert name, severity, source, or endpoint. After you create an alert exclusion, Cortex XDR will hide any future alerts that match the criteria, and exclude them from incidents and search query results.

  However, the alert exclusion does not affect the behavior of the Cortex XDR agent or the security policy on the endpoint. The Cortex XDR agent will still create an alert for the event and apply the appropriate action, such as blocking or quarantining, according to the security policy. The alert exclusion only affects the visibility of the alert on the Cortex XDR console, not the actual protection of the endpoint. Therefore, the correct answer is B, the Cortex XDR console will hide those alerts12

  Alert Exclusions

  Create an Alert Exclusion Policy

• Question 27:

  Which of the following is NOT an option when filtering incidents in the Cortex XDR console?

  A. By severity
  B. By assigned analyst
  C. By incident age
  D. By file type
  D. By file type

  ---

  Explanation

  In Cortex XDR, filtering incidents by severity, assigned analyst, and incident age are valid. However, incidents cannot be directly filtered by file type. Option D is incorrect as it is not a valid incident filter criteria.

• Question 28:

  Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

  A. exception profiles that apply to specific endpoints
  B. agent exception profiles that apply to specific endpoints
  C. global exception profiles that apply to all endpoints
  D. role-based profiles that apply to specific endpoints
  B. agent exception profiles that apply to specific endpoints
  C. global exception profiles that apply to all endpoints

  ---

  Explanation

  Cortex XDR allows you to create two types of exception profiles: agent exception profiles and global exception profiles. Agent exception profiles apply to specific endpoints that are assigned to the profile.

  Global exception profiles apply to all endpoints in your network. You can use exception profiles to configure different types of exceptions, such as process exceptions, support exceptions, behavioral threat protection rule exceptions, local analysis rules exceptions, advanced analysis exceptions, or digital signer exceptions.

  Exception profiles help you fine-tune the security policies for your endpoints and reduce false positives.

  References:

  Exception Security Profiles

  Create an Agent Exception Profile Create a Global Exception Profile

• Question 29:

  The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign.

  Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?

  A. Create an individual alert exclusion.
  B. Create a global inclusion.
  C. Create an endpoint-specific exception.
  D. Create a global exception.
  D. Create a global exception.

  ---

  Explanation

  A global exception is a rule that allows you to exclude specific files, processes, or behaviors from being blocked or detected by Cortex XDR. A global exception applies to all endpoints in your organization that are protected by Cortex XDR. Creating a global exception for a vitally important piece of software that is known to be benign would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization.

  To create a global exception, you need to follow these steps:

  In the Cortex XDR management console, go to Policy Management > Exceptions and click Add Exception.

  Select the Global Exception option and click Next.

  Enter a name and description for the exception and click Next. Select the type of exception you want to create, such as file, process, or behavior, and click Next. Specify the criteria for the exception, such as file name, hash, path, process name, command line, or behavior name, and click Next.

  Review the summary of the exception and click Finish.

  Create Global Exceptions: This document explains how to create global exceptions to exclude specific files, processes, or behaviors from being blocked or detected by Cortex XDR. Exceptions Overview: This document provides an overview of exceptions and how they can be used to fine-tune the Cortex XDR security policy.

• Question 30:

  Which statement is true based on the following Agent Auto Upgrade widget?

  

  A. There are a total of 689 Up To Date agents.
  B. Agent Auto Upgrade was enabled but not on all endpoints.
  C. Agent Auto Upgrade has not been enabled.
  D. There are more agents in Pending status than In Progress status.
  B. Agent Auto Upgrade was enabled but not on all endpoints.

  ---

  Explanation

  The Agent Auto Upgrade widget shows the status of the agent auto upgrade feature on the endpoints. The widget displays the number of agents that are up to date, in progress, pending, failed, and not configured.

  In this case, the widget shows that there are 450 agents that are up to date, 78 in progress, 15 pending, 18 failed, and 128 not configured. This means that the agent auto upgrade feature was enabled but not on all endpoints.

  References:

  Cortex XDR Agent Auto Upgrade

  PCDRA Study Guide