Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 11:

  An attacker tries to load dynamic libraries on macOS from an unsecure location. Which Cortex XDR module can prevent this attack?

  A. DDL Security
  B. Hot Patch Protection
  C. Kernel Integrity Monitor (KIM)
  D. Dylib Hijacking
  D. Dylib Hijacking

  ---

  Explanation/Reference:

  The correct answer is D. Dylib Hijacking. Dylib Hijacking, also known as Dynamic Library Hijacking, is a technique used by attackers to load malicious dynamic libraries on macOS from an unsecure location. This technique takes advantage of the way macOS searches for dynamic libraries to load when an application is executed. To prevent such attacks, Palo Alto Networks offers the Dylib Hijacking prevention capability as part of their Cortex XDR platform. This capability is designed to detect and block attempts to load dynamic libraries from unauthorized or unsecure locations1. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. DDL Security: This is not the correct answer. DDL Security is not specifically designed to prevent dynamic library loading attacks on macOS. DDL Security is focused on protecting against DLL (Dynamic Link Library) hijacking on Windows systems2. B. Hot Patch Protection: Hot Patch Protection is not directly related to preventing dynamic library loading attacks. It is a security feature that protects against runtime patching or modification of code in memory, often used by advanced attackers to bypass security measures3. While Hot Patch Protection is a valuable security feature, it is not directly relevant to the scenario described.

  C. Kernel Integrity Monitor (KIM): Kernel Integrity Monitor is also not the correct answer. KIM is a module in Cortex XDR that focuses on monitoring and protecting the integrity of the macOS kernel. It detects and prevents unauthorized modifications to critical kernel components4. While KIM plays an essential role in overall macOS security, it does not specifically address the prevention of dynamic library loading attacks. In conclusion, Dylib Hijacking is the Cortex XDR module that specifically addresses the prevention of attackers loading dynamic libraries from unsecure locations on macOS. By leveraging this module, organizations can enhance their security posture and protect against this specific attack vector. References: Endpoint Protection Modules DDL Security Hot Patch Protection Kernel Integrity Monitor

• Question 12:

  In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?

  A. Salesforce
  B. Jira
  C. Service Now
  D. Slack
  D. Slack

  ---

  Explanation/Reference:

  Cortex XDR allows you to schedule reports and forward them to Slack, a cloud-based collaboration platform. You can configure the Slack channel, frequency, and recipients of the scheduled reports. You can also view the report history and

  status in the Cortex XDR management console. References:

  Scheduled Queries: This document explains how to create, edit, and manage scheduled queries and reports in Cortex XDR.

  Forward Scheduled Reports to Slack: This document provides the steps to configure Slack integration and forward scheduled reports to a Slack channel.

• Question 13:

  Which statement is correct based on the report output below?

  

  A. Host Inventory Data Collection is enabled.
  B. 3,297 total incidents have been detected.
  C. Forensic inventory data collection is enabled.
  D. 133 agents have full disk encryption.
  C. Forensic inventory data collection is enabled.

  ---

  Explanation/Reference:

  The report output shows the number of endpoints that have forensic inventory data collection enabled, which is a feature of Cortex XDR that allows the collection of detailed information about the endpoint's hardware, software, and network configuration. This feature helps analysts to investigate and respond to incidents more effectively by providing a comprehensive view of the endpoint's state and activity. Forensic inventory data collection can be enabled or disabled per policy in Cortex XDR. References : Forensic Inventory Data Collection Cortex XDR 3: Getting Started with Endpoint Protection

• Question 14:

  In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

  A. Create a custom XQL widget
  B. This is not currently supported
  C. Create a custom report and filter on starred incidents
  D. Click the star in the widget
  D. Click the star in the widget

  ---

  Explanation/Reference:

  To filter the display to only show incidents that were "starred", you need to click the star in the widget. This will apply a filter that shows only the incidents that contain a starred alert, which is an alert that matches a specific condition that you define in the incident starring configuration. You can use the incident starring feature to prioritize and focus on the most important or relevant incidents in your environment1. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Create a custom XQL widget: This is not the correct answer. Creating a custom XQL widget is not necessary to filter the display to only show starred incidents. A custom XQL widget is a widget that you create by using the XQL query language to define the data source and the visualization type. You can use custom XQL widgets to create your own dashboards or reports, but they are not required for filtering incidents by stars2. B. This is not currently supported: This is not the correct answer. Filtering the display to only show starred incidents is currently supported by Cortex XDR. You can use the star icon in the widget to apply this filter, or you can use the Filter Builder to create a custom filter based on the Starred field1.

  C. Create a custom report and filter on starred incidents: This is not the correct answer. Creating a custom report and filtering on starred incidents is not the only way to filter the display to only show starred incidents. A custom report is a report that you create by using the Report Builder to define the data source, the layout, and the schedule. You can use custom reports to generate and share periodic reports on your Cortex XDR data, but they are not the only option for filtering incidents by stars3. In conclusion, clicking the star in the widget is the simplest and easiest way to filter the display to only show incidents that were "starred". By using this feature, you can quickly identify and focus on the most critical or relevant incidents in your environment. References: Filter Incidents by Stars Create a Custom XQL Widget Create a Custom Report

• Question 15:

  What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

  A. Automatically close the connections involved in malicious traffic.
  B. Automatically kill the processes involved in malicious activity.
  C. Automatically terminate the threads involved in malicious activity.
  D. Automatically block the IP addresses involved in malicious traffic.
  B. Automatically kill the processes involved in malicious activity.
  D. Automatically block the IP addresses involved in malicious traffic.

  ---

  Explanation/Reference:

  The "Respond to Malicious Causality Chains" feature in a Cortex XDR Windows Malware profile allows the agent to take automatic actions against network connections and processes that are involved in malicious activity on the endpoint.

  The feature has two modes: Block IP Address and Kill Process1. The two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile are:

  Automatically kill the processes involved in malicious activity. This can help to stop the malware from spreading or doing any further damage. Automatically block the IP addresses involved in malicious traffic. This can help to prevent the

  malware from communicating with its command and control server or other malicious hosts.

  The other two options, automatically close the connections involved in malicious traffic and automatically terminate the threads involved in malicious activity, are not specific to "Respond to Malicious Causality Chains". They are general

  security measures that the agent can perform regardless of the feature.

  References:

  Cortex XDR Agent Security Profiles

  Cortex XDR Agent 7.5 Release Notes

  PCDRA: What are purposes of "Respond to Malicious Causality Chains" in ...

• Question 16:

  Which of the following paths will successfully activate Remediation Suggestions?

  A. Incident View > Actions > Remediation Suggestions
  B. Causality View > Actions > Remediation Suggestions
  C. Alerts Table > Right-click on a process node > Remediation Suggestions
  D. Alerts Table > Right-click on an alert > Remediation Suggestions
  B. Causality View > Actions > Remediation Suggestions

  ---

  Explanation/Reference:

  Remediation Suggestions is a feature of Cortex XDR that provides you with recommended actions to remediate the root cause and impact of an incident. Remediation Suggestions are based on the analysis of the causality chain, the behavior

  of the malicious files or processes, and the best practices for incident response. Remediation Suggestions can help you to quickly and effectively contain and resolve an incident, as well as prevent future recurrence.

  To activate Remediation Suggestions, you need to follow these steps:

  In the Cortex XDR management console, go to Incidents and select an incident that you want to remediate.

  Click Causality View to see the graphical representation of the causality chain of the incident.

  Click Actions and select Remediation Suggestions. This will open a new window that shows the suggested actions for each node in the causality chain. Review the suggested actions and select the ones that you want to apply. You can also

  edit or delete the suggested actions, or add your own custom actions. Click Apply to execute the selected actions on the affected endpoints. You can also schedule the actions to run at a later time or date.

  References:

  Remediate Changes from Malicious Activity: This document explains how to use Remediation Suggestions to remediate the root cause and impact of an incident. Causality View: This document describes how to use Causality View to

  investigate the causality chain of an incident.

• Question 17:

  Which of the following is an example of a successful exploit?

  A. connecting unknown media to an endpoint that copied malware due to Autorun.
  B. a user executing code which takes advantage of a vulnerability on a local service.
  C. identifying vulnerable services on a server.
  D. executing a process executable for well-known and signed software.
  B. a user executing code which takes advantage of a vulnerability on a local service.

  ---

  Explanation/Reference:

  A successful exploit is a piece of software or code that takes advantage of a vulnerability and executes malicious actions on the target system. A vulnerability is a weakness or flaw in a software or hardware component that can be exploited by an attacker. A successful exploit is one that achieves its intended goal, such as gaining unauthorized access, executing arbitrary code, escalating privileges, or compromising data. In the given options, only B is an example of a successful exploit, because it involves a user executing code that exploits a vulnerability on a local service, such as a web server, a database, or a network protocol. This could allow the attacker to gain control over the service, access sensitive information, or perform other malicious actions. Option A is not a successful exploit, because it involves connecting unknown media to an endpoint that copied malware due to Autorun. Autorun is a feature that automatically runs a program or script when a removable media, such as a USB drive, is inserted into a computer. This feature can be abused by malware authors to spread their malicious code, but it is not an exploit in itself. The malware still needs to exploit a vulnerability on the endpoint to execute its payload and cause damage. Option C is not a successful exploit, because it involves identifying vulnerable services on a server. This is a step in the reconnaissance phase of an attack, where the attacker scans the target system for potential vulnerabilities that can be exploited. However, this does not mean that the attacker has successfully exploited any of the vulnerabilities, or that the vulnerabilities are even exploitable. Option D is not a successful exploit, because it involves executing a process executable for well-known and signed software. This is a legitimate action that does not exploit any vulnerability or cause any harm. Well-known and signed software are programs that are widely used and trusted, and have a digital signature that verifies their authenticity and integrity. Executing such software does not pose a security risk, unless the software itself is malicious or compromised. References: Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 8 What Is an Exploit? Definition, Types, and Prevention Measures(https://heimdalsecurity.com/blog/what-is-an-exploit/) Exploit Definition and Meaning - Merriam-Webster(https://www.merriam- webster.com/dictionary/exploit)

• Question 18:

  Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

  A. Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
  B. From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
  C. Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
  D. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.
  D. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

  ---

  Explanation/Reference:

  To add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint, you need to use the Action Center in Cortex XDR. The Action Center allows you to create and manage actions that apply to endpoints, such as adding files or processes to the allow list or block list, isolating or unisolating endpoints, or initiating live terminal sessions. To add a file hash to the allow list, you need to choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it. This will prevent the Malware profile from scanning or blocking the file on the endpoints that match the scope of the action. References: Cortex XDR 3: Responding to Attacks1, Action Center2

• Question 19:

  Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?

  A. Memory Limit Heap spray check
  B. UASLR
  C. JIT Mitigation
  D. DLL Security
  B. UASLR

  ---

  Explanation/Reference:

  UASLR stands for User Address Space Layout Randomization, which is a feature of Exploit Prevention Module (EPM) that provides better entropy for randomization of memory locations. UASLR adds entropy to the base address of the executable image and the heap, making it harder for attackers to predict the memory layout of a process. UASLR is enabled by default for all processes, but can be disabled or customized for specific applications using the EPM policy settings. References: Exploit Prevention Module (EPM) entropy randomization memory locations Exploit protection reference

• Question 20:

  Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

  A. Cortex XDR Pro per TB
  B. Host Insights
  C. Cortex XDR Pro per Endpoint
  D. Cortex XDR Cloud per Host
  D. Cortex XDR Cloud per Host

  ---

  Explanation/Reference:

  When deploying Cortex XDR agent on Kubernetes clusters as a DaemonSet, the license required is Cortex XDR Cloud per Host. This license allows you to protect and monitor your cloud workloads, such as Kubernetes clusters, containers, and serverless functions, using Cortex XDR. With Cortex XDR Cloud per Host license, you can deploy Cortex XDR agents as DaemonSets on your Kubernetes clusters, which ensures that every node in the cluster runs a copy of the agent. The Cortex XDR agent collects and sends data from the Kubernetes cluster, such as pod events, container logs, and network traffic, to the Cortex Data Lake for analysis and correlation. Cortex XDR can then detect and respond to threats across your cloud environment, and provide visibility and context into your cloud workloads. The Cortex XDR Cloud per Host license is based on the number of hosts that run the Cortex XDR agent, regardless of the number of containers or functions on each host. A host is defined as a virtual machine, a physical server, or a Kubernetes node that runs the Cortex XDR agent. You can read more about the Cortex XDR Cloud per Host license and how to deploy Cortex XDR agent on Kubernetes clusters here1 and here2. References: Cortex XDR Cloud per Host License Deploy Cortex XDR Agent on Kubernetes Clusters as a DaemonSet