Palo Alto Networks Palo Alto Networks Certifications PCDRA Questions & Answers

• Question 11:

  Which Type of IOC can you define in Cortex XDR?

  A. destination port

  B. e-mail address

  C. full path

  D. App-ID

  Correct Answer: C

  Explanation: Cortex XDR allows you to define IOCs based on various criteria, such as file hashes, registry keys, IP addresses, domain names, and full paths. A full path IOC is a specific location of a file or folder on an endpoint, such as C:\Windows\System32\calc.exe. You can use full path IOCs to detect and respond to malicious files or folders that are located in known locations on your endpoints12. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. destination port: This is not the correct answer. Destination port is not a type of IOC that you can define in Cortex XDR. Destination port is a network attribute that indicates the port number to which a packet is sent. Cortex XDR does not support defining IOCs based on destination ports, but you can use XQL queries to filter network events by destination ports3.

  B. e-mail address: This is not the correct answer. E-mail address is not a type of IOC that you can define in Cortex XDR. E-mail address is an identifier that is used to send and receive e-mails. Cortex XDR does not support defining IOCs based on e-mail addresses, but you can use the Cortex XDR - IOC integration with Cortex XSOAR to ingest IOCs from various sources, including e-mail addresses4.

  D. App-ID: This is not the correct answer. App-ID is not a type of IOC that you can define in Cortex XDR. App-ID is a feature of Palo Alto Networks firewalls that identifies and controls applications on the network. Cortex XDR does not support defining IOCs based on App- IDs, but you can use the Cortex XDR Analytics app to create custom rules that use App- IDs as part of the rule logic5. In conclusion, full path is the type of IOC that you can define in Cortex XDR. By using full path IOCs, you can enhance your detection and response capabilities and protect your endpoints from malicious files or folders. References: Create an IOC Rule XQL Reference Guide: Network Events Schema Cortex XDR - IOC Cortex XDR Analytics App PCDRA: Which Type of IOC can define in Cortex XDR?

• Question 12:

  How can you pivot within a row to Causality view and Timeline views for further investigate?

  A. Using the Open Card Only

  B. Using the Open Card and Open Timeline actions respectively

  C. You can't pivot within a row to Causality view and Timeline views

  D. Using Open Timeline Actions Only

  Correct Answer: B

  Explanation: To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row, showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident. References: Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1: Investigate alerts using the Causality view and Timeline view

• Question 13:

  What is the purpose of targeting software vendors in a supply-chain attack?

  A. to take advantage of a trusted software delivery method.

  B. to steal users' login credentials.

  C. to access source code.

  D. to report Zero-day vulnerabilities.

  Correct Answer: A

  Explanation: A supply chain attack is a type of cyberattack that targets a trusted third- party vendor who offers services or software vital to the supply chain. Software supply chain attacks inject malicious code into an application in order to infect all users of an app. The purpose of targeting software vendors in a supply-chain attack is to take advantage of a trusted software delivery method, such as an update or a download, that can reach a large number of potential victims. By compromising a software vendor, an attacker can bypass the security measures of the downstream organizations and gain access to their systems, data, or networks. References: What Is a Supply Chain Attack? - Definition, Examples and More | Proofpoint US What Is a Supply Chain Attack? - CrowdStrike What Is a Supply Chain Attack? | Zscaler What Is a Supply Chain Attack? Definition, Examples and Prevention

• Question 14:

  Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

  A. The endpoint is disconnected or the verdict from WildFire is of a type benign.

  B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.

  C. The endpoint is disconnected or the verdict from WildFire is of a type malware.

  D. The endpoint is disconnected or the verdict from WildFire is of a type grayware.

  Correct Answer: B

  Explanation: Local Analysis is a feature of Cortex XDR that allows the agent to evaluate files locally on the endpoint, without sending them to WildFire for analysis. Local Analysis is evoked when the following conditions are met: The endpoint is disconnected from the internet or the Cortex XDR management console, and therefore cannot communicate with WildFire. The verdict from WildFire is of a type unknown, meaning that WildFire has not yet analyzed the file or has not reached a conclusive verdict. Local Analysis uses machine learning models to assess the behavior and characteristics of the file and assign it a verdict of either benign, malware, or grayware. If the verdict is malware or grayware, the agent will block the file from running and report it to the Cortex XDR management console. If the verdict is benign, the agent will allow the file to run and report it to the Cortex XDR management console. References: Local Analysis WildFire File Verdicts

• Question 15:

  What is the difference between presets and datasets in XQL?

  A. A dataset is a Cortex data lake data source only; presets are built-in data source.

  B. A dataset is a built-in orthird-partysource; presets group XDR data fields.

  C. A dataset is a database; presets is a field.

  D. A dataset is a third-party data source; presets are built-in data source.

  Correct Answer: B

  Explanation: The difference between presets and datasets in XQL is that a dataset is a built-in or third-party data source, while a preset is a group of XDR data fields. A dataset is a collection of data that you can query and analyze using XQL.

  A dataset can be a Cortex data lake data source, such as endpoints, alerts, incidents, or network flows, or a third- party data source, such as AWS CloudTrail, Azure Activity Logs, or Google Cloud Audit Logs. A preset is a predefined set of

  XDR data fields that are relevant for a specific use case, such as process execution, file operations, or network activity. A preset can help you simplify and standardize your XQL queries by selecting the most important fields for youranalysis.

  You can use presets with any Cortex data lake data source, but not with third-party data sources. References:

  Datasets and Presets

  XQL Language Reference

• Question 16:

  When is the wss (WebSocket Secure) protocol used?

  A. when the Cortex XDR agent downloads new security content

  B. when the Cortex XDR agent uploads alert data

  C. when the Cortex XDR agent connects to WildFire to upload files for analysis

  D. when the Cortex XDR agent establishes a bidirectional communication channel

  Correct Answer: D

  Explanation: The WSS (WebSocket Secure) protocol is an extension of the WebSocket protocol that provides a secure communication channel over the internet. It is used to establish a persistent, full-duplex communication channel between a client (in this case, the Cortex XDR agent) and a server (such as the Cortex XDR management console or other components). The Cortex XDR agent uses the WSS protocol to establish a secure and real-time bidirectional communication channel with the Cortex XDR management console or other components in the Palo Alto Networks security ecosystem. This communication channel allows the agent to send data, such as security events, alerts, and other relevant information, to the management console, and receive commands, policy updates, and responses in return. By using the WSS protocol, the Cortex XDR agent can maintain a persistent connection with the management console, which enables timely communication of security-related information and allows for efficient incident response and remediation actions. It's important to note that the other options mentioned in the question also involve communication between the CortexXDR agent and various components, but they do not specifically mention the use of the WSS protocol. For example:

  A. The Cortex XDR agent downloading new security content typically utilizes protocols like HTTP or HTTPS.

  B. When the Cortex XDR agent uploads alert data, it may use protocols like HTTP or HTTPS to transmit the data securely.

  C. When the Cortex XDR agent connects to WildFire to upload files for analysis, it typically uses protocols like HTTP or HTTPS. Therefore, the correct answer is D, when the Cortex XDR agent establishes a bidirectional communication channel. References: Device communication protocols ?AWS IoT Core WebSocket ?Wikipedia Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) ?Palo Alto Networks [What are WebSockets? | Web Security Academy] [Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification exam practice question and answer (QandA) dump with detail explanation and reference available free, helpful to pass the Palo Alto Networks Certified Detection and Remediation Analyst PCDRA exam and earn Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification.]

• Question 17:

  Which statement is correct based on the report output below?

  

  A. Host Inventory Data Collection is enabled.

  B. 3,297 total incidents have been detected.

  C. Forensic inventory data collection is enabled.

  D. 133 agents have full disk encryption.

  Correct Answer: C

  Explanation: The report output shows the number of endpoints that have forensic inventory data collection enabled, which is a feature of Cortex XDR that allows the collection of detailed information about the endpoint's hardware, software, and network configuration. This feature helps analysts to investigate and respond to incidents more effectively by providing a comprehensive view of the endpoint's state and activity. Forensic inventory data collection can be enabled or disabled per policy in Cortex XDR. References : Forensic Inventory Data Collection Cortex XDR 3: Getting Started with Endpoint Protection

• Question 18:

  Which of the following is an example of a successful exploit?

  A. connecting unknown media to an endpoint that copied malware due to Autorun.

  B. a user executing code which takes advantage of a vulnerability on a local service.

  C. identifying vulnerable services on a server.

  D. executing a process executable for well-known and signed software.

  Correct Answer: B

  Explanation: A successful exploit is a piece of software or code that takes advantage of a vulnerability and executes malicious actions on the target system. A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by an attacker. A successful exploit is one that achieves its intended goal, such as gaining unauthorized access, executing arbitrary code, escalating privileges, or compromising data. In the given options, only B is an example of a successful exploit, because it involves a user executing code that exploits a vulnerability on a local service, such as a web server, a database, or a network protocol. This could allow the attacker to gain control over the service, access sensitive information, or perform other malicious actions. Option A is not a successful exploit, because it involves connecting unknown media to an endpoint that copied malware due to Autorun. Autorun is a feature that automatically runs a program or script when a removable media, such as a USB drive, is inserted into a computer. This feature can be abused by malware authors to spread their malicious code, but it is not an exploit in itself. The malware still needs to exploit a vulnerability on the endpoint to execute its payload and cause damage. Option C is not a successful exploit, because it involves identifying vulnerable services on a server. This is a step in the reconnaissance phase of an attack, where the attacker scans the target system for potential vulnerabilities that can be exploited. However, this does not mean that the attacker has successfully exploited any of the vulnerabilities, or that the vulnerabilities are even exploitable. Option D is not a successful exploit, because it involves executing a process executable for well-known and signed software. This is a legitimate action that does not exploit any vulnerability or cause any harm. Well-known and signed software are programs that are widely used and trusted, and have a digital signature that verifies their authenticity and integrity. Executing such software does not pose a security risk, unless the software itself is malicious or compromised. References: Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 8 What Is an Exploit? Definition, Types, and Prevention Measures(https://heimdalsecurity.com/blog/what-is-an-exploit/) Exploit Definition and Meaning - Merriam-Webster(https://www.merriam- webster.com/dictionary/exploit)

• Question 19:

  What contains a logical schema in an XQL query?

  A. Bin

  B. Array expand

  C. Field

  D. Dataset

  Correct Answer: C

  Explanation: A logical schema in an XQL query is a field, which is a named attribute of a dataset. A field can have a data type, such as string, integer, boolean, or array. A field can also have a modifier, such as bin or expand, that transforms the field value in the query output. A field can be used in the select, where, group by, order by, or having clauses of an XQL query. References: XQL Syntax XQL Data Types XQL Field Modifiers

• Question 20:

  Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

  A. exception profiles that apply to specific endpoints

  B. agent exception profiles that apply to specific endpoints

  C. global exception profiles that apply to all endpoints

  D. role-based profiles that apply to specific endpoints

  Correct Answer: BC

  Explanation: Cortex XDR allows you to create two types of exception profiles: agent exception profiles and global exception profiles. Agent exception profiles apply to specific endpoints that are assigned to the profile. Global exception profiles apply to all endpoints in your network. You can use exception profiles to configure different types of exceptions, such as process exceptions, support exceptions, behavioral threat protection rule exceptions, local analysis rules exceptions, advanced analysis exceptions, or digital signer exceptions. Exception profiles help you fine-tune the security policies for your endpoints and reduce false positives. References: Exception Security Profiles Create an Agent Exception Profile Create a Global Exception Profile