Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 41:

  In Cortex XDR, which of the following allows you to monitor the most critical alerts across your environment?

  A. Dashboard
  B. Asset Management
  C. Security Events
  D. Incident View
  A. Dashboard

  ---

  Explanation

  The Dashboard in Cortex XDR provides an overview of critical security metrics and allows users to monitor the most pressing alerts across the environment. Asset Management focuses on endpoint details, while Security Events and Incident View are focused on specific incidents or events.

• Question 42:

  What is the function of the WildFire engine within Cortex XDR?

  A. It analyzes file behavior in the cloud to determine if a file is malicious.
  B. It runs locally on endpoints to detect real-time malware threats.
  C. It blocks malicious processes and network traffic.
  D. It integrates with firewalls to provide perimeter security.
  A. It analyzes file behavior in the cloud to determine if a file is malicious.

  ---

  Explanation

  WildFire is a cloud-based service that analyzes suspicious files to detect malware by examining their behavior. This analysis helps provide a verdict on whether the file is malicious, benign, or grayware.

  Options B, C, and D describe other functions not related to WildFire's primary purpose.

• Question 43:

  When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

  A. Click the three dots on the widget and then choose "Save" and this will link the query to the Widget Library.
  B. This isn't supported, you have to exit the dashboard and go into the Widget Library first to create it.
  C. Click on "Save to Action Center" in the dashboard and you will be prompted to give the query a name and description.
  D. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.
  D. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.

  ---

  Explanation

  To save a custom XQL query to the Widget Library, you need to click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description. This will allow you to reuse the query in other dashboards or reports. You cannot save a query to the Widget Library by clicking the three dots on the widget, as this will only give you options to edit, delete, or clone the widget. You also cannot save a query to the Action Center, as this is a different feature that allows you to create alerts or remediation actions based on the query results. You do not have to exit the dashboard and go into the Widget Library first to create a query, as you can do it directly from the dashboard.

  References Cortex XDR Pro Admin Guide: Save a Custom Query to the Widget Library Cortex XDR Pro Admin Guide: Create a Dashboard

• Question 44:

  With a Cortex XDR Prevent license, which objects are considered to be sensors?

  A. Syslog servers
  B. Third-Party security devices
  C. Cortex XDR agents
  D. Palo Alto Networks Next-Generation Firewalls
  C. Cortex XDR agents

  ---

  Explanation

  The objects that are considered to be sensors with a Cortex XDR Prevent license are Cortex XDR agents and Palo Alto Networks Next-Generation Firewalls. These are the two sources of data that Cortex XDR can collect and analyze for threat detection and response. Cortex XDR agents are software components that run on endpoints, such as Windows, Linux, and Mac devices, and provide protection against malware, exploits, and fileless attacks. Cortex XDR agents also collect and send endpoint data, such as process activity, network traffic, registry changes, and user actions, to the Cortex Data Lake for analysis and correlation. Palo Alto Networks Next-Generation Firewalls are network security devices that provide visibility and control over network traffic, and enforce security policies based on applications, users, and content. Next-Generation Firewalls also collect and send network data, such as firewall logs, DNS logs, HTTP headers, and WildFire verdicts, to the Cortex Data Lake for analysis and correlation. By integrating data from both Cortex XDR agents and Next-Generation Firewalls, Cortex XDR can provide a comprehensive view of the attack surface and detect threats across the network and endpoint layers.

  References

  Cortex XDR Prevent License

  Cortex XDR Agent Features

  Next-Generation Firewall Features

• Question 45:

  What types of actions you can execute with live terminal session?

  A. Manage Network configurations, Quarantine Files, Run PowerShell scripts
  B. Manage Processes, Manage Files, Run Operating System Commands, Run Ruby Commands and Scripts
  C. Apply patches, Reboot System, send notification for end user, Run Python Commands and Scripts
  D. Manage Processes, Manage Files, Run Operating System Commands, Run Python Commands and Scripts
  D. Manage Processes, Manage Files, Run Operating System Commands, Run Python Commands and Scripts

  ---

  Explanation

  Live terminal session is a feature of Cortex XDR that allows you to remotely access and control endpoints from the Cortex XDR console. With live terminal session, you can execute various actions on the endpoints, such as:

  Manage Processes: You can view, start, or kill processes on the endpoint, and monitor their CPU and memory usage.

  Manage Files: You can view, create, delete, or move files and folders on the endpoint, and upload or download files to or from the endpoint.

  Run Operating System Commands: You can run commands on the endpoint using the native command-line interface of the operating system, such as cmd.exe for Windows, bash for Linux, or zsh for macOS.

  Run Python Commands and Scripts: You can run Python commands and scripts on the endpoint using the Python interpreter embedded in the Cortex XDR agent. You can use the Python commands and scripts to perform advanced tasks or automation on the endpoint.

  Initiate a Live Terminal Session Manage Processes Manage Files Run Operating System Commands Run Python Commands and Scripts

• Question 46:

  Which of the following paths will successfully activate Remediation Suggestions?

  A. Incident View > Actions > Remediation Suggestions
  B. Causality View > Actions > Remediation Suggestions
  C. Alerts Table > Right-click on a process node > Remediation Suggestions
  D. Alerts Table > Right-click on an alert > Remediation Suggestions
  B. Causality View > Actions > Remediation Suggestions

  ---

  Explanation

  Remediation Suggestions is a feature of Cortex XDR that provides you with recommended actions to remediate the root cause and impact of an incident. Remediation Suggestions are based on the analysis of the causality chain, the behavior of the malicious files or processes, and the best practices for incident response. Remediation Suggestions can help you to quickly and effectively contain and resolve an incident, as well as prevent future recurrence.

  To activate Remediation Suggestions, you need to follow these steps: In the Cortex XDR management console, go to Incidents and select an incident that you want to remediate.

  Click Causality View to see the graphical representation of the causality chain of the incident. Click Actions and select Remediation Suggestions. This will open a new window that shows the suggested actions for each node in the causality chain.

  Review the suggested actions and select the ones that you want to apply. You can also edit or delete the suggested actions, or add your own custom actions. Click Apply to execute the selected actions on the affected endpoints. You can also schedule the actions to run at a later time or date.

  Remediate Changes from Malicious Activity: This document explains how to use Remediation Suggestions to remediate the root cause and impact of an incident.

  Causality View: This document describes how to use Causality View to investigate the causality chain of an incident.

• Question 47:

  An attacker tries to load dynamic libraries on macOS from an unsecure location.

  Which Cortex XDR module can prevent this attack?

  A. DDL Security
  B. Hot Patch Protection
  C. Kernel Integrity Monitor (KIM)
  D. Dylib Hijacking
  D. Dylib Hijacking

  ---

  Explanation

  The correct answer is D. Dylib Hijacking. Dylib Hijacking, also known as Dynamic Library Hijacking, is a technique used by attackers to load malicious dynamic libraries on macOS from an unsecure location. This technique takes advantage of the way macOS searches for dynamic libraries to load when an application is executed. To prevent such attacks, Palo Alto Networks offers the Dylib Hijacking prevention capability as part of their Cortex XDR platform. This capability is designed to detect and block attempts to load dynamic libraries from unauthorized or unsecure locations 1.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  A. DDL Security: This is not the correct answer. DDL Security is not specifically designed to prevent dynamic library loading attacks on macOS. DDL Security is focused on protecting against DLL (Dynamic Link Library) hijacking on Windows systems2.

  B. Hot Patch Protection: Hot Patch Protection is not directly related to preventing dynamic library loading attacks. It is a security feature that protects against runtime patching or modification of code in memory, often used by advanced attackers to bypass security measures3. While Hot Patch Protection is a valuable security feature, it is not directly relevant to the scenario described.

  C. Kernel Integrity Monitor (KIM): Kernel Integrity Monitor is also not the correct answer. KIM is a module in Cortex XDR that focuses on monitoring and protecting the integrity of the macOS kernel. It detects and prevents unauthorized modifications to critical kernel components4. While KIM plays an essential role in overall macOS security, it does not specifically address the prevention of dynamic library loading attacks. In conclusion, Dylib Hijacking is the Cortex XDR module that specifically addresses the prevention of attackers loading dynamic libraries from unsecure locations on macOS. By leveraging this module, organizations can enhance their security posture and protect against this specific attack vector. Endpoint Protection Modules DDL Security Hot Patch Protection Kernel Integrity Monitor

• Question 48:

  What is by far the most common tactic used by ransomware to shut down a victim's operation?

  A. preventing the victim from being able to access APIs to cripple infrastructure
  B. denying traffic out of the victims network until payment is received
  C. restricting access to administrative accounts to the victim
  D. encrypting certain files to prevent access by the victim
  D. encrypting certain files to prevent access by the victim

  ---

  Explanation

  Ransomware is a type of malicious software, or malware, that encrypts certain files or data on the victim's system or network and prevents them from accessing their data until they pay a ransom. This is by far the most common tactic used by ransomware to shut down a victim's operation, as it can cause costly disruptions, data loss, and reputational damage. Ransomware can affect individual users, businesses, and organizations of all kinds. Ransomware can spread through various methods, such as phishing emails, malicious attachments, compromised websites, or network vulnerabilities. Some ransomware variants can also self-propagate and infect other devices or networks. Ransomware authors typically demand payment in cryptocurrency or other untraceable methods, and may threaten to delete or expose the encrypted data if the ransom is not paid within a certain time frame. However, paying the ransom does not guarantee that the files will be decrypted or that the attackers will not target the victim again. Therefore, the best way to protect against ransomware is to prevent infection in the first place, and to have a backup of the data in case of an attack1234

  What is Ransomware? | How to Protect Against Ransomware in 2023 Ransomware - Wikipedia

  What is ransomware? | Ransomware meaning | Cloudflare

  [What Is Ransomware? | Ransomware.org]

  [Ransomware - FBI]

• Question 49:

  Can you disable the ability to use the Live Terminal feature in Cortex XDR?

  A. Yes, via the Cortex XDR console or with an installation switch.
  B. No, a separate installer package without Live Terminal is required.
  C. No, it is a required feature of the agent.
  D. Yes, via Agent Settings Profile.
  D. Yes, via Agent Settings Profile.

  ---

  Explanation

  The Live Terminal feature in Cortex XDR allows you to initiate a remote connection to an endpoint and perform various actions such as running commands, uploading and downloading files, and terminating processes. You can disable the ability to use the Live Terminal feature in Cortex XDR by configuring the Agent Settings Profile. The Agent Settings Profile defines the behavior and functionality of the Cortex XDR agent on the endpoint. You can create different profiles for different groups of endpoints and assign them accordingly. To disable the Live Terminal feature, you need to uncheck the Enable Live Terminal option in the Agent Settings Profile and save the changes. This will prevent the Cortex XDR agent from accepting any Live Terminal requests from the Cortex XDR management console. References Live Terminal: This document explains how to use the Live Terminal feature to investigate and respond to security events on

  Windows endpoints.

  Agent Settings Profile: This document describes how to create and manage Agent Settings Profiles to define the behavior and functionality of the Cortex XDR agent on the endpoint.

• Question 50:

  What is the purpose of targeting software vendors in a supply-chain attack?

  A. to take advantage of a trusted software delivery method.
  B. to steal users' login credentials.
  C. to access source code.
  D. to report Zero-day vulnerabilities.
  A. to take advantage of a trusted software delivery method.

  ---

  Explanation

  A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers services or software vital to the supply chain. Software supply chain attacks inject malicious code into an application in order to infect all users of an app. The purpose of targeting software vendors in a supply-chain attack is to take advantage of a trusted software delivery method, such as an update or a download, that can reach a large number of potential victims. By compromising a software vendor, an attacker can bypass the security measures of the downstream organizations and gain access to their systems, data, or networks.

  References

  What Is a Supply Chain Attack? - Definition, Examples & More | Proofpoint US What Is a Supply Chain Attack? - CrowdStrike

  What Is a Supply Chain Attack? | Zscaler

  What Is a Supply Chain Attack? Definition, Examples & Prevention