Palo Alto Networks PAN-XDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-XDRA Online Questions & Answers

• Question 71:

  What is the main goal of the Incident Management Dashboard in Cortex XDR?

  A. To manage asset configurations
  B. To display detailed forensic analysis reports
  C. To monitor the Mean Time to Resolution (MTTR) metric
  D. To configure custom security policies
  C. To monitor the Mean Time to Resolution (MTTR) metric

  ---

  Explanation

  The Incident Management Dashboard is focused on tracking and optimizing the MTTR, a key performance indicator for incident response. It provides a high-level overview of incidents, but it does not directly manage assets or configure policies. Option B is more aligned with forensic reports, which are handled separately.

• Question 72:

  Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

  A. Memory Limit Heap spray check
  B. UASLR
  C. JIT Mitigation
  D. DLL Security
  B. UASLR

  ---

  Explanation

  UASLR stands for User Address Space Layout Randomization, which is a feature of Exploit Prevention Module (EPM) that provides better entropy for randomization of memory locations. UASLR adds entropy to the base address of the executable image and the heap, making it harder for attackers to predict the memory layout of a process. UASLR is enabled by default for all processes, but can be disabled or customized for specific applications using the EPM policy settings.

  References Exploit Prevention Module (EPM) entropy randomization memory locations Exploit protection reference

• Question 73:

  What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?

  A. Ransomware
  B. Worm
  C. Keylogger
  D. Rootkit
  A. Ransomware

  ---

  Explanation

  The kind of malware that uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim is ransomware. Ransomware is a type of malware that encrypts the victim's files or blocks access to their system, and then demands a ransom for the decryption key or the restoration of access. Ransomware can also threaten to expose or delete the victim's data if the ransom is not paid.

  Ransomware can cause significant damage and disruption to individuals, businesses, and organizations, and can be difficult to remove or recover from. Some examples of ransomware are CryptoLocker, WannaCry, Ryuk, and REvil.

  12 Types of Malware + Examples.

  That You Should Know - CrowdStrike.

  What is Malware? Malware Definition, Types and Protection 12+ Types of Malware Explained with Examples (Complete List)

• Question 74:

  To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

  A. causality_chain
  B. endpoint_name
  C. threat_event
  D. event_type
  D. event_type

  ---

  Explanation

  To create a BIOC rule with XQL query, you must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. The event_type field indicates the type of event that triggered the alert, such as PROCESS, FILE, REGISTRY, NETWORK, or USER_ACCOUNT. Filtering on this field helps you narrow down the scope of your query and focus on the relevant events for your use case. Other fields, such as causality_chain, endpoint_name, threat_event, are optional and can be used to further refine your query or display additional information in the alert. References Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 9 Palo Alto Networks Cortex XDR Documentation, BIOC Rule Query Syntax

• Question 75:

  Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

  A. Cortex XDR Pro per TB
  B. Host Insights
  C. Cortex XDR Pro per Endpoint
  D. Cortex XDR Cloud per Host
  D. Cortex XDR Cloud per Host

  ---

  Explanation

  When deploying Cortex XDR agent on Kubernetes clusters as a DaemonSet, the license required is Cortex XDR Cloud per Host. This license allows you to protect and monitor your cloud workloads, such as Kubernetes clusters, containers, and serverless functions, using Cortex XDR. With Cortex XDR Cloud per Host license, you can deploy Cortex XDR agents as DaemonSets on your Kubernetes clusters, which ensures that every node in the cluster runs a copy of the agent. The Cortex XDR agent collects and sends data from the Kubernetes cluster, such as pod events, container logs, and network traffic, to the Cortex Data Lake for analysis and correlation. Cortex XDR can then detect and respond to threats across your cloud environment, and provide visibility and context into your cloud workloads. The Cortex XDR Cloud per Host license is based on the number of hosts that run the Cortex XDR agent, regardless of the number of containers or functions on each host. A host is defined as a virtual machine, a physical server, or a Kubernetes node that runs the Cortex XDR agent. You can read more about the Cortex XDR Cloud per Host license and how to deploy Cortex XDR agent on Kubernetes clusters here1 and here 2. References Cortex XDR Cloud per Host License Deploy Cortex XDR Agent on Kubernetes Clusters as a DaemonSet

• Question 76:

  When configuring Cortex XDR to prevent ransomware attacks, what is the role of decoy files?

  A. They monitor encryption processes
  B. They attract ransomware to stop encryption
  C. They encrypt backups to protect them
  D. They store ransom demands
  B. They attract ransomware to stop encryption

  ---

  Explanation

  Decoy files are used to attract ransomware, simulating valuable files that the malware would attempt to encrypt. When the ransomware tries to modify these files, Cortex XDR blocks the process. Option A, C, and D are not applicable to the use of decoy files in ransomware protection.

• Question 77:

  Which of the following options is NOT a valid scheduling option when configuring scheduled reports in Cortex XDR?

  A. Run monthly on a specific day
  B. Run weekly on a specific day and time
  C. Run yearly on a specific day
  D. Run daily at a specific time
  C. Run yearly on a specific day

  ---

  Explanation

  The option to schedule reports yearly is not available in Cortex XDR. The valid options for scheduling reports are daily, weekly, and monthly. Option A, B, and D are valid scheduling frequencies supported by the platform.

• Question 78:

  Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

  A. The endpoint is disconnected or the verdict from WildFire is of a type benign.
  B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.
  C. The endpoint is disconnected or the verdict from WildFire is of a type malware.
  D. The endpoint is disconnected or the verdict from WildFire is of a type grayware.
  B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.

  ---

  Explanation

  Local Analysis is a feature of Cortex XDR that allows the agent to evaluate files locally on the endpoint, without sending them to WildFire for analysis. Local Analysis is evoked when the following conditions are met: The endpoint is disconnected from the internet or the Cortex XDR management console, and therefore cannot communicate with WildFire. The verdict from WildFire is of a type unknown, meaning that WildFire has not yet analyzed the file or has not reached a conclusive verdict. Local Analysis uses machine learning models to assess the behavior and characteristics of the file and assign it a verdict of either benign, malware, or grayware. If the verdict is malware or grayware, the agent will block the file from running and report it to the Cortex XDR management console. If the verdict is benign, the agent will allow the file to run and report it to the Cortex XDR management console.

  References

  Local Analysis

  WildFire File Verdicts

• Question 79:

  Which of the following Live Terminal options are available for Android systems?

  A. Live Terminal is not supported.
  B. Stop an app.
  C. Run APK scripts.
  D. Run Android commands.
  D. Run Android commands.

  ---

  Explanation

  Cortex XDR supports Live Terminal for Android systems, which allows you to remotely access and manage Android endpoints using a command-line interface. You can use Live Terminal to run Android commands, such as adb shell, adb logcat, adb install, and adb uninstall. You can also use Live Terminal to view and modify files, directories, and permissions on the Android endpoints. Live Terminal for Android systems does not support stopping an app or running APK scripts.

  References Cortex XDR documentation portal

  Initiate a Live Terminal Session Live Terminal Commands

• Question 80:

  What is the maximum number of agents one Broker VM local agent applet can support?

  A. 5,000
  B. 10,000
  C. 15,000
  D. 20,000
  B. 10,000

  ---

  Explanation

  The Broker VM is a virtual machine that you can deploy in your network to provide various services and functionalities to the Cortex XDR agents. One of the services that the Broker VM offers is the Local Agent Settings applet, which allows you to configure the agent proxy, agent installer, and content caching settings for the agents. The Local Agent Settings applet can support a maximum number of 10,000 agents per Broker VM. If you have more than 10,000 agents in your network, you need to deploy additional Broker VMs and distribute the load among them.

  References Broker VM Overview: This document provides an overview of the Broker VM and its features, requirements, and deployment options.

  Configure the Broker VM: This document explains how to install, set up, and configure the Broker VM in an ESXi environment.

  Manage Broker VM from the Cortex XDR Management Console: This document describes how to activate and manage the Broker VM applets from the Cortex XDR management console.