Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 21:

  Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

  A. The endpoint is disconnected or the verdict from WildFire is of a type benign.
  B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.
  C. The endpoint is disconnected or the verdict from WildFire is of a type malware.
  D. The endpoint is disconnected or the verdict from WildFire is of a type grayware.
  B. The endpoint is disconnected or the verdict from WildFire is of a type unknown.

  ---

  Explanation/Reference:

  Local Analysis is a feature of Cortex XDR that allows the agent to evaluate files locally on the endpoint, without sending them to WildFire for analysis. Local Analysis is evoked when the following conditions are met: The endpoint is disconnected from the internet or the Cortex XDR management console, and therefore cannot communicate with WildFire. The verdict from WildFire is of a type unknown, meaning that WildFire has not yet analyzed the file or has not reached a conclusive verdict. Local Analysis uses machine learning models to assess the behavior and characteristics of the file and assign it a verdict of either benign, malware, or grayware. If the verdict is malware or grayware, the agent will block the file from running and report it to the Cortex XDR management console. If the verdict is benign, the agent will allow the file to run and report it to the Cortex XDR management console. References: Local Analysis WildFire File Verdicts

• Question 22:

  When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

  A. Remediation Automation
  B. Machine Remediation
  C. Automatic Remediation
  D. Remediation Suggestions
  D. Remediation Suggestions

  ---

  Explanation/Reference:

  When investigating security events, the feature in Cortex XDR that is useful for reverting the changes on the endpoint is Remediation Suggestions. Remediation Suggestions are a feature of Cortex XDR that provide you with recommended actions to undo the effects of malicious activity on your endpoints. You can view the remediation suggestions for each alert or incident in the Cortex XDR console, and decide whether to apply them or not. Remediation Suggestions can help you restore the endpoint to its original state, remove malicious files or processes, or fix registry or system settings. Remediation Suggestions are based on the forensic data collected by the Cortex XDR agent and the analysis performed by Cortex XDR. References: Remediation Suggestions Apply Remediation Suggestions

• Question 23:

  What license would be required for ingesting external logs from various vendors?

  A. Cortex XDR Pro per Endpoint
  B. Cortex XDR Vendor Agnostic Pro
  C. Cortex XDR Pro per TB
  D. Cortex XDR Cloud per Host
  C. Cortex XDR Pro per TB

  ---

  Explanation/Reference:

  To ingest external logs from various vendors, you need a Cortex XDR Pro per TB license. This license allows you to collect and analyze logs from Palo Alto Networks and third-party sources, such as firewalls, proxies, endpoints, cloud services, and more. You can use the Log Forwarding app to forward logs from the Logging Service to an external syslog receiver. The Cortex XDR Pro per Endpoint license only supports logs from Cortex XDR agents installed on endpoints. The Cortex XDR Vendor Agnostic Pro and Cortex XDR Cloud per Host licenses do not exist. References: Features by Cortex XDR License Type Log Forwarding App for Cortex XDR Analytics SaaS Log Collection

• Question 24:

  When creating a scheduled report which is not an option?

  A. Run weekly on a certain day and time.
  B. Run quarterly on a certain day and time.
  C. Run monthly on a certain day and time.
  D. Run daily at a certain time (selectable hours and minutes).
  B. Run quarterly on a certain day and time.

  ---

  Explanation/Reference:

  When creating a scheduled report in Cortex XDR, the option to run quarterly on a certain day and time is not available. You can only schedule reports to run daily, weekly, or monthly. You can also specify the start and end dates, the time zone, and the recipients of the report. Scheduled reports are useful for generating regular reports on the security events, incidents, alerts, or endpoints in your network. You can create scheduled reports from the Reports page in the Cortex XDR console, or from the Query Center by saving a query as a report. References: Run or Schedule Reports Create a Scheduled Report

• Question 25:

  A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

  A. It is true positive.
  B. It is false positive.
  C. It is a false negative.
  D. It is true negative.
  B. It is false positive.

  ---

  Explanation/Reference:

  A false positive is a situation where a file or activity is incorrectly identified as malicious by a security tool, when in fact it is benign or harmless. A false positive can cause unnecessary alerts, disruptions, or remediation actions, and reduce the confidence and efficiency of the security system. In this question, a file is identified as malware by the Local Analysis module, whereas WildFire verdict is Benign, assuming WildFire is accurate. This means that the Local Analysis module has made a mistake and flagged a legitimate file as malicious, while WildFire has correctly determined that the file is safe. Therefore, this is an example of a false positive. The Local Analysis module is a feature of the Cortex XDR agent that uses a static set of pattern-matching rules and a statistical model to determine if an unknown file is likely to be malware. The Local Analysis module can provide a fast and offline verdict for files that are not yet analyzed by WildFire, but it is not as accurate or comprehensive as WildFire, which uses dynamic analysis and machine learning to examine the behavior and characteristics of files in a sandbox environment. WildFire verdicts are considered more reliable and authoritative than Local Analysis verdicts, and can override them in case of a discrepancy. Therefore, if a file is identified as malware by the Local Analysis module, but as Benign by WildFire, the WildFire verdict should be trusted and the Local Analysis verdict should be disregarded123 References: False positive (security) - Wikipedia Local Analysis WildFire Overview

• Question 26:

  Which statement best describes how Behavioral Threat Protection (BTP) works?

  A. BTP injects into known vulnerable processes to detect malicious activity.
  B. BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.
  C. BTP matches EDR data with rules provided by Cortex XDR.
  D. BTP uses machine Learning to recognize malicious activity even if it is not known.
  D. BTP uses machine Learning to recognize malicious activity even if it is not known.

  ---

  Explanation/Reference:

  The statement that best describes how Behavioral Threat Protection (BTP) works is D, BTP uses machine learning to recognize malicious activity even if it is not known. BTP is a feature of Cortex XDR that allows you to define custom rules to detect and block malicious behaviors on endpoints. BTP uses machine learning to profile behavior and detect anomalies indicative of attack. BTP can recognize malicious activity based on file attributes, registry keys, processes, network connections, and other criteria, even if the activity is not associated with any known malware or threat. BTP rules are updated through content updates and can be managed from the Cortex XDR console. The other statements are incorrect for the following reasons: A is incorrect because BTP does not inject into known vulnerable processes to detect malicious activity. BTP does not rely on process injection, which is a technique used by some malware to hide or execute code within another process. BTP monitors the behavior of all processes on the endpoint, regardless of their vulnerability status, and compares them with the BTP rules. B is incorrect because BTP does not run on the Cortex XDR and distribute behavioral signatures to all agents. BTP runs on the Cortex XDR agent, which is installed on the endpoint, and analyzes the endpoint data locally. BTP does not use behavioral signatures, which are predefined patterns of malicious behavior, but rather uses machine learning to identify anomalies and deviations from normal behavior. C is incorrect because BTP does not match EDR data with rules provided by Cortex XDR. BTP is part of the EDR (Endpoint Detection and Response) capabilities of Cortex XDR, and uses the EDR data collected by the Cortex XDR agent to perform behavioral analysis. BTP does not match the EDR data with rules provided by Cortex XDR, but rather applies the BTP rules defined by the Cortex XDR administrator or the Palo Alto Networks threat research team. References: Cortex XDR Agent Administrator Guide: Behavioral Threat Protection Cortex XDR: Stop Breaches with AI-Powered Cybersecurity

• Question 27:

  What motivation do ransomware attackers have for returning access to systems once their victims have paid?

  A. There is organized crime governance among attackers that requires the return of access to remain in good standing. B. Nation-states enforce the return of system access through the use of laws and regulation.
  B. Failure to restore access to systems undermines the scheme because others will not believe their valuables would be returned.
  C. The ransomware attackers hope to trace the financial trail back and steal more from traditional banking institutions.
  C. The ransomware attackers hope to trace the financial trail back and steal more from traditional banking institutions.

  ---

  Explanation/Reference:

  Ransomware attackers have a motivation to return access to systems once their victims have paid because they want to maintain their reputation and credibility. If they fail to restore access to systems, they risk losing the trust of future victims who may not believe that paying the ransom will result in getting their data back. This would reduce the effectiveness and profitability of their scheme. Therefore, ransomware attackers have an incentive to honor their promises and decrypt the data after receiving the ransom. References: What is the motivation behind ransomware? | Foresite As Ransomware Attackers' Motives Change, So Should Your Defense - Forbes

• Question 28:

  Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

  A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.
  B. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.
  C. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.
  D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.
  D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

  ---

  Explanation/Reference:

  Cortex XDR Analytics is a cloud-based service that uses machine learning and artificial intelligence to detect and prevent network attacks. Cortex XDR Analytics can interfere with the attack pattern as soon as it is observed on the endpoint by

  applying protection policies that block malicious processes, files, or network connections. This way, Cortex XDR Analytics can stop the attack before it causes any damage or compromises the system. References:

  [Cortex XDR Analytics Overview]

  [Cortex XDR Analytics Protection Policies]

• Question 29:

  As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

  A. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
  B. Enable DLL Protection on all servers but there might be some false positives.
  C. Create IOCs of the malicious files you have found to prevent their execution.
  D. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
  A. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

  ---

  Explanation/Reference:

  To ensure that the same protection is extended to all your servers, you need to create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity. BTP is a feature of Cortex XDR that allows you to create custom rules that

  detect and block malicious or suspicious behaviors on your endpoints, such as file execution, process injection, network connection, or registry modification. BTP rules can use various operators, functions, and variables to define the criteria

  and the actions for the rules. By creating BTP rules that match the behaviors of the supply chain attack, you can prevent the attack from compromising your servers12.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  B. Enable DLL Protection on all servers but there might be some false positives: This is not the correct answer. Enabling DLL Protection on all servers will not ensure that the same protection is extended to all your servers. DLL Protection is a feature of Cortex XDR that allows you to block the execution of unsigned or untrusted DLL files on your endpoints. DLL Protection can help to prevent some types of attacks that use malicious DLL files, but it may not be effective against the supply chain attack that used a Trojanized DLL file that was digitally signed by a trusted vendor. DLL Protection may also cause some false positives, as it may block some legitimate DLL files that are unsigned or untrusted3. C. Create IOCs of the malicious files you have found to prevent their execution: This is not the correct answer. Creating IOCs of the malicious files you have found will not ensure that the same protection is extended to all your servers. IOCs are indicators of compromise that you can create to detect and respond to known threats on your endpoints, such as file hashes, registry keys, IP addresses, domain names, or full paths. IOCs can help to identify and block the malicious files that you have already discovered, but they may not be effective against the supply chain attack that used different variants of the malicious files with different hashes or names. IOCs may also become outdated, as the attackers may change or update their files to evade detection4.

  D. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading: This is not the correct answer. Enabling BTP with cytool will not ensure that the same protection is extended to all your servers. BTP is a feature of Cortex XDR that allows you to create custom rules that detect and block malicious or suspicious behaviors on your endpoints, such as file execution, process injection, network connection, or registry modification. BTP rules can help to prevent the attack from spreading, but they need to be created and configured in the Cortex XDR app, not with cytool. Cytool is a command-line tool that allows you to perform various operations on the Cortex XDR agent, such as installing, uninstalling, upgrading, or troubleshooting. Cytool does not have an option to enable or configure BTP rules. In conclusion, to ensure that the same protection is extended to all your servers, you need to create BTP rules to recognize and prevent the activity. By using BTP rules, you can create custom and flexible prevention rules that match the behaviors of the supply chain attack. References: Behavioral Threat Protection Create a BTP Rule DLL Protection Create an IOC Rule [Cytool]

• Question 30:

  How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

  A. by encrypting the disk first.
  B. by utilizing decoy Files.
  C. by retrieving the encryption key.
  D. by patching vulnerable applications.
  B. by utilizing decoy Files.

  ---

  Explanation/Reference:

  Cortex XDR agent for Windows prevents ransomware attacks from compromising the file system by utilizing decoy files. Decoy files are randomly generated files that are placed in strategic locations on the endpoint, such as the user's desktop, documents, and pictures folders. These files are designed to look like valuable data that ransomware would target for encryption. When Cortex XDR agent detects that a process is attempting to access or modify a decoy file, it immediately blocks the process and alerts the administrator. This way, Cortex XDR agent can stop ransomware attacks before they can cause any damage to the real files on the endpoint. References: Anti-Ransomware Protection PCDRA Study Guide