Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 61:

  In Cortex XDR, which type of IOC rule can you define based on a destination IP address?

  A. Network IOC
  B. File IOC
  C. Behavioral IOC
  D. User Account IOC
  A. Network IOC

  ---

  Explanation

  Network-based IOCs can be defined using destination IP addresses, which are commonly used to identify and block suspicious network traffic. Other IOC types like File IOC or Behavioral IOC do not apply to network-related data.

• Question 62:

  Which module in Cortex XDR allows the detection of malicious patterns based on host data?

  A. Security Events
  B. Host Insights
  C. Endpoint Protection
  D. WildFire
  B. Host Insights

  ---

  Explanation

  The Host Insights module provides visibility into vulnerabilities and threats on your endpoints by analyzing data from the host system. It is specifically designed to help detect and remediate issues at the host level.

  The other modules deal with broader or different aspects of security.

• Question 63:

  When creating a scheduled report which is not an option?

  A. Run weekly on a certain day and time.
  B. Run quarterly on a certain day and time.
  C. Run monthly on a certain day and time.
  D. Run daily at a certain time (selectable hours and minutes).
  B. Run quarterly on a certain day and time.

  ---

  Explanation

  When creating a scheduled report in Cortex XDR, the option to run quarterly on a certain day and time is not available. You can only schedule reports to run daily, weekly, or monthly. You can also specify the start and end dates, the time zone, and the recipients of the report. Scheduled reports are useful for generating regular reports on the security events, incidents, alerts, or endpoints in your network. You can create scheduled reports from the Reports page in the Cortex XDR console, or from the Query Center by saving a query as a report. References Run or Schedule Reports Create a Scheduled Report

• Question 64:

  To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding.

  Which statement is correct regarding the Cortex XDR Analytics module?

  A. It does not interfere with any portion of the pattern on the endpoint.
  B. It interferes with the pattern as soon as it is observed by the firewall.
  C. It does not need to interfere with the any portion of the pattern to prevent the attack.
  D. It interferes with the pattern as soon as it is observed on the endpoint.
  D. It interferes with the pattern as soon as it is observed on the endpoint.

  ---

  Explanation

  The correct statement regarding the Cortex XDR Analytics module is D, it interferes with the pattern as soon as it is observed on the endpoint. The Cortex XDR Analytics module is a feature of Cortex XDR that uses machine learning and behavioral analytics to detect and prevent network-based attacks on endpoints.

  The Cortex XDR Analytics module analyzes the network traffic and activity on the endpoint, and compares it with the attack patterns defined by Palo Alto Networks threat research team. The Cortex XDR Analytics module interferes with the attack pattern as soon as it is observed on the endpoint, by blocking the malicious network connection, process, or file. This way, the Cortex XDR Analytics module can stop the attack before it causes any damage or compromise.

  The other statements are incorrect for the following reasons: A is incorrect because the Cortex XDR Analytics module does interfere with the attack pattern on the endpoint, by blocking the malicious network connection, process, or file. The Cortex XDR Analytics module does not rely on the firewall or any other network device to stop the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the interference. B is incorrect because the Cortex XDR Analytics module does not interfere with the attack pattern as soon as it is observed by the firewall. The Cortex XDR Analytics module does not depend on the firewall or any other network device to detect or prevent the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the analysis and interference. The firewall may not be able to observe or block the attack pattern if it is encrypted, obfuscated, or bypassed by the attacker. C is incorrect because the Cortex XDR Analytics module does need to interfere with the attack pattern to prevent the attack. The Cortex XDR Analytics module does not only detect the attack pattern, but also prevents it from succeeding by blocking the malicious network connection, process, or file. The Cortex XDR Analytics module does not rely on any other response mechanism or human intervention to stop the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the interference.

  Cortex XDR Analytics Module

  Cortex XDR Analytics Module Detection and Prevention

• Question 65:

  What kind of the threat typically encrypts user files?

  A. ransomware
  B. SQL injection attacks
  C. Zero-day exploits
  D. supply-chain attacks
  A. ransomware

  ---

  Explanation

  Ransomware is a type of malicious software, or malware, that encrypts user files and prevents them from accessing their data until they pay a ransom. Ransomware can affect individual users, businesses, and organizations of all kinds. Ransomware attacks can cause costly disruptions, data loss, and reputational damage. Ransomware can spread through various methods, such as phishing emails, malicious attachments, compromised websites, or network vulnerabilities. Some ransomware variants can also self-propagate and infect other devices or networks. Ransomware authors typically demand payment in cryptocurrency or other untraceable methods, and may threaten to delete or expose the encrypted data if the ransom is not paid within a certain time frame. However, paying the ransom does not guarantee that the files will be decrypted or that the attackers will not target the victim again. Therefore, the best way to protect against ransomware is to prevent infection in the first place, and to have a backup of the data in case of an attack123456

  What is Ransomware? | How to Protect Against Ransomware in 2023 Ransomware - Wikipedia

  What is ransomware? | Ransomware meaning | Cloudflare

  What Is Ransomware? | Ransomware.org Ransomware - FBI

• Question 66:

  If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

  A. Broker VM Pathfinder
  B. Local Agent Proxy
  C. Local Agent Installer and Content Caching
  D. Broker VM Syslog Collector
  B. Local Agent Proxy

  ---

  Explanation

  If you have an isolated network that is prevented from connecting to the Cortex Data Lake, you can use the Local Agent Proxy setup to facilitate the communication. The Local Agent Proxy is a type of Broker VM that acts as a proxy server for the Cortex XDR agents that are deployed on the isolated network. The Local Agent Proxy enables the Cortex XDR agents to communicate securely with the Cortex Data Lake and the Cortex XDR management console over the internet, without requiring direct access to the internet from the isolated network. The Local Agent Proxy also allows the Cortex XDR agents to download installation packages and content updates from the Cortex XDR management console. To use the Local Agent Proxy setup, you need to deploy a Broker VM on the isolated network and configure it as a Local Agent Proxy.

  You also need to deploy another Broker VM on a network that has internet access and configure it as a Remote Agent Proxy. The Remote Agent Proxy acts as a relay between the Local Agent Proxy and the Cortex Data Lake. You also need to install a strong cipher SHA256-based SSL certificate on both the Local Agent Proxy and the Remote Agent Proxy to ensure secure communication. You can read more about the Local Agent Proxy setup and how to configure it here1 and here 2. References Local Agent Proxy Configure the Local Agent Proxy Setup

• Question 67:

  What is the Wildfire analysis file size limit for Windows PE files?

  A. No Limit
  B. 500MB
  C. 100MB
  D. 1GB
  C. 100MB

  ---

  Explanation

  The Wildfire analysis file size limit for Windows PE files is 100MB. Windows PE files are executable files that run on the Windows operating system, such as.exe,.dll,.sys, or.scr files. Wildfire is a cloud-based service that analyzes files and URLs for malicious behavior and generates signatures and protections for them. Wildfire can analyze various file types, such as PE, APK, PDF, MS Office, and others, but each file type has a different file size limit. The file size limit determines the maximum size of the file that can be uploaded or forwarded to Wildfire for analysis. If the file size exceeds the limit, Wildfire will not analyze the file and will return an error message. According to the Wildfire documentation1, the file size limit for Windows PE files is 100MB. This means that any PE file that is larger than 100MB will not be analyzed by Wildfire. However, the firewall can still apply other security features, such as antivirus, anti-spyware, vulnerability protection, and file blocking, to the PE file based on the security policy settings. The firewall can also perform local analysis on the PE file using the Cortex XDR agent, which uses machine learning models to assess the file and assign it a verdict 2.

  WildFire File Size Limits: This document provides the file size limits for different file types that can be analyzed by Wildfire. Local Analysis: This document explains how the Cortex XDR agent performs local analysis on files that cannot be sent to Wildfire for analysis.

• Question 68:

  How can you pivot within a row to Causality view and Timeline views for further investigate?

  A. Using the Open Card Only
  B. Using the Open Card and Open Timeline actions respectively
  C. You can't pivot within a row to Causality view and Timeline views
  D. Using Open Timeline Actions Only
  B. Using the Open Card and Open Timeline actions respectively

  ---

  Explanation

  To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row, showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident. References Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1: Investigate alerts using the Causality view and

  Timeline view

• Question 69:

  You can star security events in which two ways? (Choose two.)

  A. Create an alert-starring configuration.
  B. Create an Incident-starring configuration.
  C. Manually star an alert.
  D. Manually star an Incident.
  C. Manually star an alert.
  D. Manually star an Incident.

  ---

  Explanation

  You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or create an alert-starring or incident-starring configuration. Starring security events helps you prioritize and track the events that are most important to you. You can also filter and sort the events by their star status in the Cortex XDR console.

  To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents table.

  You can also star an alert from the Causality View or the Query Center Results table. You can star an incident from the Incident View or the Query Center Results table. You can also unstar an event by clicking the star icon again.

  To create an alert-starring or incident-starring configuration, you can use the Alert Starring Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define the criteria for starring alerts or incidents based on their severity, category, source, or other attributes. You can also enable or disable the configurations as needed.

  Star Security Events

  Create an Alert Starring Configuration Create an Incident Starring Configuration

• Question 70:

  In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

  A. Create a custom XQL widget
  B. This is not currently supported
  C. Create a custom report and filter on starred incidents
  D. Click the star in the widget
  D. Click the star in the widget

  ---

  Explanation

  To filter the display to only show incidents that were "starred", you need to click the star in the widget. This will apply a filter that shows only the incidents that contain a starred alert, which is an alert that matches a specific condition that you define in the incident starring configuration. You can use the incident starring feature to prioritize and focus on the most important or relevant incidents in your environment 1. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Create a custom XQL widget: This is not the correct answer. Creating a custom XQL widget is not necessary to filter the display to only show starred incidents. A custom XQL widget is a widget that you create by using the XQL query language to define the data source and the visualization type. You can use custom XQL widgets to create your own dashboards or reports, but they are not required for filtering incidents by stars2.

  B. This is not currently supported: This is not the correct answer. Filtering the display to only show starred incidents is currently supported by Cortex XDR. You can use the star icon in the widget to apply this filter, or you can use the Filter Builder to create a custom filter based on the Starred field1.

  C. Create a custom report and filter on starred incidents: This is not the correct answer. Creating a custom report and filtering on starred incidents is not the only way to filter the display to only show starred incidents. A custom report is a report that you create by using the Report Builder to define the data source, the layout, and the schedule. You can use custom reports to generate and share periodic reports on your Cortex XDR data, but they are not the only option for filtering incidents by stars3. In conclusion, clicking the star in the widget is the simplest and easiest way to filter the display to only show incidents that were "starred". By using this feature, you can quickly identify and focus on the most critical or relevant incidents in your environment. Filter Incidents by Stars Create a Custom XQL Widget Create a Custom Report