Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 1:

  Which of the following Live Terminal options are available for Android systems?

  A. Live Terminal is not supported.
  B. Stop an app.
  C. Run APK scripts.
  D. Run Android commands.
  D. Run Android commands.

  ---

  Explanation/Reference:

  Cortex XDR supports Live Terminal for Android systems, which allows you to remotely access and manage Android endpoints using a command-line interface. You can use Live Terminal to run Android commands, such as adb shell, adb logcat, adb install, and adb uninstall. You can also use Live Terminal to view and modify files, directories, and permissions on the Android endpoints. Live Terminal for Android systems does not support stopping an app or running APK scripts. References: Cortex XDR documentation portal Initiate a Live Terminal Session Live Terminal Commands

• Question 2:

  Which Type of IOC can you define in Cortex XDR?

  A. destination port
  B. e-mail address
  C. full path
  D. App-ID
  C. full path

  ---

  Explanation/Reference:

  Cortex XDR allows you to define IOCs based on various criteria, such as file hashes, registry keys, IP addresses, domain names, and full paths. A full path IOC is a specific location of a file or folder on an endpoint, such as C:\Windows\System32\calc.exe. You can use full path IOCs to detect and respond to malicious files or folders that are located in known locations on your endpoints12. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. destination port: This is not the correct answer. Destination port is not a type of IOC that you can define in Cortex XDR. Destination port is a network attribute that indicates the port number to which a packet is sent. Cortex XDR does not support defining IOCs based on destination ports, but you can use XQL queries to filter network events by destination ports3.

  B. e-mail address: This is not the correct answer. E-mail address is not a type of IOC that you can define in Cortex XDR. E-mail address is an identifier that is used to send and receive e-mails. Cortex XDR does not support defining IOCs based on e-mail addresses, but you can use the Cortex XDR - IOC integration with Cortex XSOAR to ingest IOCs from various sources, including e-mail addresses4.

  D. App-ID: This is not the correct answer. App-ID is not a type of IOC that you can define in Cortex XDR. App-ID is a feature of Palo Alto Networks firewalls that identifies and controls applications on the network. Cortex XDR does not support defining IOCs based on App- IDs, but you can use the Cortex XDR Analytics app to create custom rules that use App- IDs as part of the rule logic5. In conclusion, full path is the type of IOC that you can define in Cortex XDR. By using full path IOCs, you can enhance your detection and response capabilities and protect your endpoints from malicious files or folders. References: Create an IOC Rule XQL Reference Guide: Network Events Schema Cortex XDR - IOC Cortex XDR Analytics App PCDRA: Which Type of IOC can define in Cortex XDR?

• Question 3:

  To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?

  A. It does not interfere with any portion of the pattern on the endpoint.
  B. It interferes with the pattern as soon as it is observed by the firewall.
  C. It does not need to interfere with the any portion of the pattern to prevent the attack.
  D. It interferes with the pattern as soon as it is observed on the endpoint.
  D. It interferes with the pattern as soon as it is observed on the endpoint.

  ---

  Explanation/Reference:

  The correct statement regarding the Cortex XDR Analytics module is D, it interferes with the pattern as soon as it is observed on the endpoint. The Cortex XDR Analytics module is a feature of Cortex XDR that uses machine learning and behavioral analytics to detect and prevent network-based attacks on endpoints. The Cortex XDR Analytics module analyzes the network traffic and activity on the endpoint, and compares it with the attack patterns defined by Palo Alto Networks threat research team. The Cortex XDR Analytics module interferes with the attack pattern as soon as it is observed on the endpoint, by blocking the malicious network connection, process, or file. This way, the Cortex XDR Analytics module can stop the attack before it causes any damage or compromise. The other statements are incorrect for the following reasons: A is incorrect because the Cortex XDR Analytics module does interfere with the attack pattern on the endpoint, by blocking the malicious network connection, process, or file. The Cortex XDR Analytics module does not rely on the firewall or any other network device to stop the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the interference. B is incorrect because the Cortex XDR Analytics module does not interfere with the attack pattern as soon as it is observed by the firewall. The Cortex XDR Analytics module does not depend on the firewall or any other network device to detect or prevent the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the analysis and interference. The firewall may not be able to observe or block the attack pattern if it is encrypted, obfuscated, or bypassed by the attacker. C is incorrect because the Cortex XDR Analytics module does need to interfere with the attack pattern to prevent the attack. The Cortex XDR Analytics module does not only detect the attack pattern, but also prevents it from succeeding by blocking the malicious network connection, process, or file. The Cortex XDR Analytics module does not rely on any other response mechanism or human intervention to stop the attack, but rather uses the Cortex XDR agent installed on the endpoint to perform the interference. References: Cortex XDR Analytics Module Cortex XDR Analytics Module Detection and Prevention

• Question 4:

  Which of the following is NOT a precanned script provided by Palo Alto Networks?

  A. delete_file
  B. quarantine_file
  C. process_kill_name
  D. list_directories
  D. list_directories

  ---

  Explanation/Reference:

  Palo Alto Networks provides a set of precanned scripts that you can use to perform various actions on your endpoints, such as deleting files, killing processes, or quarantining malware. The precanned scripts are written in Python and are

  available in the Agent Script Library in the Cortex XDR console. You can use the precanned scripts as they are, or you can customize them to suit your needs. The precanned scripts are:

  delete_file: Deletes a specific file from a local or removable drive. quarantine_file: Moves a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed. process_kill_name: Kills a

  process by its name on the endpoint. process_kill_pid: Kills a process by its process ID (PID) on the endpoint. process_kill_tree: Kills a process and all its child processes by its name on the endpoint.

  process_kill_tree_pid: Kills a process and all its child processes by its PID on the endpoint.

  process_list: Lists all the processes running on the endpoint, along with their names, PIDs, and command lines.

  process_list_tree: Lists all the processes running on the endpoint, along with their names, PIDs, command lines, and parent processes.

  process_start: Starts a process on the endpoint by its name or path. registry_delete_key: Deletes a registry key and all its subkeys and values from the Windows registry.

  registry_delete_value: Deletes a registry value from the Windows registry. registry_list_key: Lists all the subkeys and values under a registry key in the Windows registry.

  registry_list_value: Lists the value and data of a registry value in the Windows registry.

  registry_set_value: Sets the value and data of a registry value in the Windows registry.

  The script list_directories is not a precanned script provided by Palo Alto Networks. It is a custom script that you can write yourself using Python commands.

  References:

  Run Scripts on an Endpoint

  Agent Script Library

  Precanned Scripts

• Question 5:

  Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection is extended to all your servers?

  A. Conduct a thorough Endpoint Malware scan.
  B. Enable DLL Protection on all servers but there might be some false positives.
  C. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
  D. Create lOCs of the malicious files you have found to prevent their execution.
  D. Create lOCs of the malicious files you have found to prevent their execution.

  ---

  Explanation/Reference:

  The best step to ensure the same protection is extended to all your servers is to create indicators of compromise (IOCs) of the malicious files you have found to prevent their execution. IOCs are pieces of information that indicate a potential threat or compromise on an endpoint, such as file hashes, IP addresses, domain names, or registry keys. You can create IOCs in Cortex XDR to block or alert on any file or network activity that matches the IOCs. By creating IOCs of the malicious files involved in the cobalt strike attack, you can prevent them from running or spreading on any of your servers. The other options are not the best steps for the following reasons: A is not the best step because conducting a thorough Endpoint Malware scan may not detect or prevent the cobalt strike attack if the malicious files are obfuscated, encrypted, or hidden. Endpoint Malware scan is a feature of Cortex XDR that allows you to scan endpoints for known malware and quarantine any malicious files found. However, Endpoint Malware scan may not be effective against unknown or advanced threats that use evasion techniques to avoid detection. B is not the best step because enabling DLL Protection on all servers may cause some false positives and disrupt legitimate applications. DLL Protection is a feature of Cortex XDR that allows you to block or alert on any DLL loading activity that matches certain criteria, such as unsigned DLLs, DLLs loaded from network locations, or DLLs loaded by specific processes. However, DLL Protection may also block or alert on benign DLL loading activity that is part of normal system or application operations, resulting in false positives and performance issues. C is not the best step because enabling Behavioral Threat Protection (BTP) with cytool may not prevent the attack from spreading if the malicious files are already on the endpoints or if the attack uses other methods to evade detection. Behavioral Threat Protection is a feature of Cortex XDR that allows you to block or alert on any endpoint behavior that matches certain patterns, such as ransomware, credential theft, or lateral movement. Cytool is a command-line tool that allows you to configure and manage the Cortex XDR agent on the endpoint. However, Behavioral Threat Protection may not prevent the attack from spreading if the malicious files are already on the endpoints or if the attack uses other methods to evade detection, such as encryption, obfuscation, or proxy servers. References: Create IOCs Scan an Endpoint for Malware DLL Protection Behavioral Threat Protection Cytool for Windows

• Question 6:

  You can star security events in which two ways? (Choose two.)

  A. Create an alert-starring configuration.
  B. Create an Incident-starring configuration.
  C. Manually star an alert.
  D. Manually star an Incident.
  C. Manually star an alert.
  D. Manually star an Incident.

  ---

  Explanation/Reference:

  You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or create an alert-starring or incident-starring configuration. Starring security events helps you prioritize and track the events that are most important to you. You can also filter and sort the events by their star status in the Cortex XDR console. To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents table. You can also star an alert from the Causality View or the Query Center Results table. You can star an incident from the Incident View or the Query Center Results table. You can also unstar an event by clicking the star icon again. To create an alert-starring or incident-starring configuration, you can use the Alert Starring Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define the criteria for starring alerts or incidents based on their severity, category, source, or other attributes. You can also enable or disable the configurations as needed. References: Star Security Events Create an Alert Starring Configuration Create an Incident Starring Configuration

• Question 7:

  Why would one threaten to encrypt a hypervisor or, potentially, a multiple number of virtual machines running on a server?

  A. To extort a payment from a victim or potentially embarrass the owners.
  B. To gain notoriety and potentially a consulting position.
  C. To better understand the underlying virtual infrastructure.
  D. To potentially perform a Distributed Denial of Attack.
  A. To extort a payment from a victim or potentially embarrass the owners.

  ---

  Explanation/Reference:

  Encrypting a hypervisor or a multiple number of virtual machines running on a server is a form of ransomware attack, which is a type of cyberattack that involves locking or encrypting the victim's data or system and demanding a ransom for its release. The attacker may threaten to encrypt the hypervisor or the virtual machines to extort a payment from the victim or potentially embarrass the owners by exposing their sensitive or confidential information. Encrypting a hypervisor or a multiple number of virtual machines can have a severe impact on the victim's business operations, as it can affect the availability, integrity, and confidentiality of their data and applications. The attacker may also use the encryption as a leverage to negotiate a higher ransom or to coerce the victim into complying with their demands. References: Encrypt an Existing Virtual Machine or Virtual Disk: This document explains how to encrypt an existing virtual machine or virtual disk using the vSphere Client. How to Encrypt an Existing or New Virtual Machine: This article provides a guide on how to encrypt an existing or new virtual machine using AOMEI Backupper. Ransomware: This document provides an overview of ransomware, its types, impacts, and prevention methods.

• Question 8:

  What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

  A. Netflow Collector
  B. Syslog Collector
  C. DB Collector
  D. Pathfinder
  B. Syslog Collector

  ---

  Explanation/Reference:

  The Broker VM is a virtual machine that acts as a data broker between third- party data sources and the Cortex Data Lake. It can ingest different types of data, such as syslog, netflow, database, and pathfinder. The Syslog Collector functionality of the Broker VM allows it to receive syslog messages from third-party devices, such as firewalls, routers, switches, and servers, and forward them to the Cortex Data Lake. The Syslog Collector can be configured to filter, parse, and enrich the syslog messages before sending them to the Cortex Data Lake. The Syslog Collector can also be used to ingest logs from third-party firewall vendors, such as Cisco, Fortinet, and Check Point, to the Cortex Data Lake. This enables Cortex XDR to analyze the firewall logs and provide visibility and threat detection across the network perimeter. References: Cortex XDR Data Broker VM Syslog Collector Supported Third-Party Firewall Vendors

• Question 9:

  Which function describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed?

  A. Search and destroy
  B. Isolation
  C. Quarantine
  D. Flag for removal
  C. Quarantine

  ---

  Explanation/Reference:

  The function that describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed is quarantine. Quarantine is a feature of Cortex XDR that allows you to isolate malicious or suspicious files from the endpoint and prevent them from running or spreading. You can quarantine files manually from the Cortex XDR console, or automatically based on the malware analysis profile or the remediation suggestions. When you quarantine a file, the Cortex XDR agent encrypts the file and moves it to a hidden folder under the agent installation directory. The file is also renamed with a random string and a .quarantine extension. You can view, restore, or delete the quarantined files from the Cortex XDR console. References: Quarantine Files Manage Quarantined Files

• Question 10:

  What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

  A. MTH researches for threats in the tenant and generates a report with the findings.
  B. MTH researches for threats in the logs and reports to engineering.
  C. MTH runs queries and investigative actions and no further action is taken.
  D. MTH pushes content updates to prevent against thezero-dayexploits.
  A. MTH researches for threats in the tenant and generates a report with the findings.

  ---

  Explanation/Reference:

  The Managed Threat Hunting (MTH) team is a group of security experts who proactively hunt for threats in the Cortex XDR tenant and generate a report with the findings. The MTH team uses advanced queries and investigative actions to identify and analyze potential threats, such as zero-day exploits, that may have bypassed the prevention and detection capabilities of Cortex XDR. The MTH team also provides recommendations and best practices to help customers remediate the threats and improve their security posture. References: Managed Threat Hunting Service Managed Threat Hunting Report