Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 51:

  In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

  A. Salesforce
  B. Jira
  C. Service Now
  D. Slack
  D. Slack

  ---

  Explanation

  Cortex XDR allows you to schedule reports and forward them to Slack, a cloud-based collaboration platform. You can configure the Slack channel, frequency, and recipients of the scheduled reports. You can also view the report history and status in the Cortex XDR management console.

  References Scheduled Queries: This document explains how to create, edit, and manage scheduled queries and reports in Cortex XDR. Forward Scheduled Reports to Slack: This document provides the steps to configure Slack integration and forward scheduled reports to a Slack channel.

• Question 52:

  Which of the following is required for the Local Agent Proxy setup in Cortex XDR?

  A. A VPN connection to the internet
  B. A Broker VM setup on an isolated network
  C. A manual agent installation
  D. Integration with WildFire
  B. A Broker VM setup on an isolated network

  ---

  Explanation

  The Local Agent Proxy setup requires a Broker VM deployed on an isolated network to allow agents to communicate with the Cortex Data Lake without direct internet access. Option A, C, and D are unrelated to the setup requirements.

• Question 53:

  In the Cortex XDR console, which of the following actions can be performed on an isolated endpoint?

  A. Delete files manually
  B. Initiate a remediation suggestion
  C. Perform a full system restore
  D. Open an X2Go session
  B. Initiate a remediation suggestion

  ---

  Explanation

  In the Cortex XDR console, you can initiate remediation suggestions for isolated endpoints to automatically fix issues like removing malicious files or restoring system configurations. Option A and C are not effective or feasible actions directly from the console in isolation, while D is not a standard tool for this scenario.

  Correct Answers:

• Question 54:

  Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

  A. Hash Verdict Determination
  B. Behavioral Threat Protection
  C. Restriction Policy
  D. Child Process Protection
  A. Hash Verdict Determination

  ---

  Explanation

  The first protection module that is checked in the Cortex XDR Windows agent malware protection flow is the Hash Verdict Determination. This module compares the hash of the executable file that is about to run on the endpoint with a list of known malicious hashes stored in the Cortex XDR cloud. If the hash matches a malicious hash, the agent blocks the execution and generates an alert. If the hash does not match a malicious hash, the agent proceeds to the next protection module, which is the Restriction Policy1. The Hash Verdict Determination module is the first line of defense against malware, as it can quickly and efficiently prevent known threats from running on the endpoint. However, this module cannot protect against unknown or zero-day threats, which have no known hash signature. Therefore, the Cortex XDR agent relies on other protection modules, such as Behavioral Threat Protection, Child Process Protection, and Exploit Protection, to detect and block malicious behaviors and exploits that may occur during the execution of the file 1.

  Palo Alto Networks Cortex XDR Documentation, File Analysis and Protection Flow

• Question 55:

  Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server.

  What steps can you take to ensure the same protection is extended to all your servers?

  A. Conduct a thorough Endpoint Malware scan.
  B. Enable DLL Protection on all servers but there might be some false positives.
  C. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
  D. Create lOCs of the malicious files you have found to prevent their execution.
  D. Create lOCs of the malicious files you have found to prevent their execution.

  ---

  Explanation

  The best step to ensure the same protection is extended to all your servers is to create indicators of compromise (IOCs) of the malicious files you have found to prevent their execution. IOCs are pieces of information that indicate a potential threat or compromise on an endpoint, such as file hashes, IP addresses, domain names, or registry keys. You can create IOCs in Cortex XDR to block or alert on any file or network activity that matches the IOCs. By creating IOCs of the malicious files involved in the cobalt strike attack, you can prevent them from running or spreading on any of your servers. The other options are not the best steps for the following reasons: A is not the best step because conducting a thorough Endpoint Malware scan may not detect or prevent the cobalt strike attack if the malicious files are obfuscated, encrypted, or hidden. Endpoint Malware scan is a feature of Cortex XDR that allows you to scan endpoints for known malware and quarantine any malicious files found. However, Endpoint Malware scan may not be effective against unknown or advanced threats that use evasion techniques to avoid detection. B is not the best step because enabling DLL Protection on all servers may cause some false positives and disrupt legitimate applications. DLL Protection is a feature of Cortex XDR that allows you to block or alert on any DLL loading activity that matches certain criteria, such as unsigned DLLs, DLLs loaded from network locations, or DLLs loaded by specific processes. However, DLL Protection may also block or alert on benign DLL loading activity that is part of normal system or application operations, resulting in false positives and performance issues.

  C is not the best step because enabling Behavioral Threat Protection (BTP) with cytool may not prevent the attack from spreading if the malicious files are already on the endpoints or if the attack uses other methods to evade detection. Behavioral Threat Protection is a feature of Cortex XDR that allows you to block or alert on any endpoint behavior that matches certain patterns, such as ransomware, credential theft, or lateral movement. Cytool is a command-line tool that allows you to configure and manage the Cortex XDR agent on the endpoint. However, Behavioral Threat Protection may not prevent the attack from spreading if the malicious files are already on the endpoints or if the attack uses other methods to evade detection, such as encryption, obfuscation, or proxy servers.

  Create IOCs

  Scan an Endpoint for Malware

  DLL Protection

  Behavioral Threat Protection

  Cytool for Windows

• Question 56:

  When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose Two)

  A. The agent technical support file.
  B. The prevention archive from the alert.
  C. The distribution id of the agent.
  D. A list of all the current exceptions applied to the agent.
  E. The unique agent id.
  A. The agent technical support file.
  B. The prevention archive from the alert.

  ---

  Explanation

  When reaching out to TAC for additional technical support related to a security event, two critical pieces of information you need to collect from the agent are: The agent technical support file. This is a file that contains diagnostic information about the agent, such as its configuration, status, logs, and system information. The agent technical support file can help TAC troubleshoot and resolve issues with the agent or the endpoint. You can generate and download the agent technical support file from the Cortex XDR console, or from the agent itself. The prevention archive from the alert. This is a file that contains forensic data related to the alert, such as the process tree, the network activity, the registry changes, and the files involved. The prevention archive can help TAC analyze and understand the alert and the malicious activity. You can generate and download the prevention archive from the Cortex XDR console, or from the agent itself. The other options are not critical pieces of information for TAC, and may not be available or relevant for every security event. For example: The distribution id of the agent is a unique identifier that is assigned to the agent when it is installed on the endpoint. The distribution id can help TAC identify the agent and its profile, but it is not sufficient to provide technical support or forensic analysis. The distribution id can be found in the Cortex XDR console, or in the agent installation folder.

  A list of all the current exceptions applied to the agent is a set of rules that define the files, processes, or behaviors that are excluded from the agent's security policies. The exceptions can help TAC understand the agent's configuration and behavior, but they are not essential to provide technical support or forensic analysis. The exceptions can be found in the Cortex XDR console, or in the agent configuration file. The unique agent id is a unique identifier that is assigned to the agent when it registers with Cortex XDR. The unique agent id can help TAC identify the agent and its endpoint, but it is not sufficient to provide technical support or forensic analysis. The unique agent id can be found in the Cortex XDR console, or in the agent log file.

  Generate and Download the Agent Technical Support File Generate and Download the Prevention Archive Cortex XDR Agent Administrator Guide:

  Agent Distribution ID Cortex XDR Agent Administrator Guide: Exception Security Profiles [Cortex XDR Agent Administrator Guide: Unique Agent ID]

• Question 57:

  What should you do to automatically convert leads into alerts after investigating a lead?

  A. Lead threats can't be prevented in the future because they already exist in the environment.
  B. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
  C. Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
  D. Build a search query using Query Builder or XQL using a list of lOCs.
  B. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

  ---

  Explanation

  To automatically convert leads into alerts after investigating a lead, you should create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

  IOC rules are used to detect known threats based on indicators of compromise (IOCs) such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can prevent future occurrences of the same threats and generate alerts for them.

  References PCDRA Study Guide, page 25

  Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2

  Cortex XDR Documentation, section "Create IOC Rules"

• Question 58:

  Which of the following is an example of a successful exploit?

  A. connecting unknown media to an endpoint that copied malware due to Autorun.
  B. a user executing code which takes advantage of a vulnerability on a local service.
  C. identifying vulnerable services on a server.
  D. executing a process executable for well-known and signed software.
  B. a user executing code which takes advantage of a vulnerability on a local service.

  ---

  Explanation

  A successful exploit is a piece of software or code that takes advantage of a vulnerability and executes malicious actions on the target system. A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by an attacker. A successful exploit is one that achieves its intended goal, such as gaining unauthorized access, executing arbitrary code, escalating privileges, or compromising data. In the given options, only B is an example of a successful exploit, because it involves a user executing code that exploits a vulnerability on a local service, such as a web server, a database, or a network protocol. This could allow the attacker to gain control over the service, access sensitive information, or perform other malicious actions.

  Option A is not a successful exploit, because it involves connecting unknown media to an endpoint that copied malware due to Autorun. Autorun is a feature that automatically runs a program or script when a removable media, such as a USB drive, is inserted into a computer. This feature can be abused by malware authors to spread their malicious code, but it is not an exploit in itself. The malware still needs to exploit a vulnerability on the endpoint to execute its payload and cause damage.

  Option C is not a successful exploit, because it involves identifying vulnerable services on a server. This is a step in the reconnaissance phase of an attack, where the attacker scans the target system for potential vulnerabilities that can be exploited. However, this does not mean that the attacker has successfully exploited any of the vulnerabilities, or that the vulnerabilities are even exploitable.

  Option D is not a successful exploit, because it involves executing a process executable for well-known and signed software. This is a legitimate action that does not exploit any vulnerability or cause any harm. Well-known and signed software are programs that are widely used and trusted, and have a digital signature that verifies their authenticity and integrity.

  Executing such software does not pose a security risk, unless the software itself is malicious or compromised.

  Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 8 What Is an Exploit? Definition, Types, and Prevention Measures(

  https://heimdalsecurity.com/blog/what-is-an-exploit/)

  Exploit Definition & Meaning - Merriam-Webster(

  https://www.merriam-webster.com/dictionary/exploit)

• Question 59:

  In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer.

  What is one way to add an exception for the singer?

  A. In the Restrictions Profile, add the file name and path to the Executable Files allow list.
  B. Create a new rule exception and use the singer as the characteristic.
  C. Add the signer to the allow list in the malware profile.
  D. Add the signer to the allow list under the action center page.
  C. Add the signer to the allow list in the malware profile.

  ---

  Explanation

  To prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer in Windows and macOS, one way to add an exception for the signer is to add the signer to the allow list in the malware profile. A malware profile is a profile that defines the settings and actions for malware prevention and detection on the endpoints. A malware profile allows you to specify a list of files, folders, or signers that you want to exclude from malware scanning and blocking. By adding the signer to the allow list in the malware profile, you can prevent the Cortex XDR Agent from blocking any file that is signed by that signer 1. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. In the Restrictions Profile, add the file name and path to the Executable Files allow list: This is not the correct answer. Adding the file name and path to the Executable Files allow list in the Restrictions Profile will not prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. A Restrictions Profile is a profile that defines the settings and actions for restricting the execution of files or processes on the endpoints. A Restrictions Profile allows you to specify a list of executable files that you want to allow or block based on the file name and path. However, this method does not take into account the digital signer of the file, and it may not be effective if the file name or path changes2.

  B. Create a new rule exception and use the signer as the characteristic: This is not the correct answer. Creating a new rule exception and using the signer as the characteristic will not prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. A rule exception is an exception that you can create to modify the behavior of a specific prevention rule or BIOC rule. A rule exception allows you to specify the characteristics and the actions that you want to apply to the exception, such as file hash, process name, IP address, or domain name. However, this method does not support using the signer as a characteristic, and it may not be applicable to all prevention rules or BIOC rules3.

  D. Add the signer to the allow list under the action center page: This is not the correct answer. Adding the signer to the allow list under the action center page will not prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. The action center page is a page that allows you to create and manage actions that you can perform on your endpoints, such as isolating, scanning, collecting files, or executing scripts. The action center page does not have an option to add a signer to the allow list, and it is not related to the malware prevention or detection functionality4. In conclusion, to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer in Windows and macOS, one way to add an exception for the signer is to add the signer to the allow list in the malware profile. By using this method, you can exclude the files that are signed by the trusted signer from the malware scanning and blocking. Add a New Malware Security Profile Add a New Restrictions Security Profile Create a Rule Exception Action Center

• Question 60:

  What is the purpose of the Cortex Data Lake?

  A. a local storage facility where your logs and alert data can be aggregated
  B. a cloud-based storage facility where your firewall logs are stored
  C. the interface between firewalls and the Cortex XDR agents
  D. the workspace for your Cortex XDR agents to detonate potential malware files
  B. a cloud-based storage facility where your firewall logs are stored

  ---

  Explanation

  The purpose of the Cortex Data Lake is to provide a cloud-based storage facility where your firewall logs are stored. Cortex Data Lake is a service that collects, transforms, and integrates your enterprise's security data to enable Palo Alto Networks solutions. It powers AI and machine learning, detection accuracy, and app and service innovation. Cortex Data Lake automatically collects, integrates, and normalizes data across your security infrastructure, including your next-generation firewalls, Prisma Access, and Cortex XDR. With unified data, you can run advanced AI and machine learning to radically simplify security operations with apps built on Cortex. Cortex Data Lake is available in multiple regions and supports data residency and privacy requirements. References Cortex Data Lake - Palo Alto Networks Cortex Data Lake - Palo Alto Networks Cortex Data Lake, the technology behind Cortex XDR - Palo Alto Networks CORTEX DATA LAKE - Palo Alto Networks Sizing for Cortex Data Lake Storage - Palo Alto Networks