Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 31:

  Which statement is true for Application Exploits and Kernel Exploits?

  A. The ultimate goal of any exploit is to reach the application.
  B. Kernel exploits are easier to prevent then application exploits.
  C. The ultimate goal of any exploit is to reach the kernel.
  D. Application exploits leverage kernel vulnerability.
  C. The ultimate goal of any exploit is to reach the kernel.

  ---

  Explanation/Reference:

  The ultimate goal of any exploit is to reach the kernel, which is the core component of the operating system that has the highest level of privileges and access to the hardware resources. Application exploits are attacks that target vulnerabilities in specific applications, such as web browsers, email clients, or office suites. Kernel exploits are attacks that target vulnerabilities in the kernel itself, such as memory corruption, privilege escalation, or code execution. Kernel exploits are more difficult to prevent and detect than application exploits, because they can bypass security mechanisms and hide their presence from the user and the system. References: Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 8 Palo Alto Networks Cortex XDR Documentation, Exploit Protection Overview

• Question 32:

  With a Cortex XDR Prevent license, which objects are considered to be sensors?

  A. Syslog servers
  B. Third-Party security devices
  C. Cortex XDR agents
  D. Palo Alto Networks Next-Generation Firewalls
  C. Cortex XDR agents

  ---

  Explanation/Reference:

  The objects that are considered to be sensors with a Cortex XDR Prevent license are Cortex XDR agents and Palo Alto Networks Next-Generation Firewalls. These are the two sources of data that Cortex XDR can collect and analyze for threat detection and response. Cortex XDR agents are software components that run on endpoints, such as Windows, Linux, and Mac devices, and provide protection against malware, exploits, and fileless attacks. Cortex XDR agents also collect and send endpoint data, such as process activity, network traffic, registry changes, and user actions, to the Cortex Data Lake for analysis and correlation. Palo Alto Networks Next-Generation Firewalls are network security devices that provide visibility and control over network traffic, and enforce security policies based on applications, users, and content. Next-Generation Firewalls also collect and send network data, such as firewall logs, DNS logs, HTTP headers, and WildFire verdicts, to the Cortex Data Lake for analysis and correlation. By integrating data from both Cortex XDR agents and Next-Generation Firewalls, Cortex XDR can provide a comprehensive view of the attack surface and detect threats across the network and endpoint layers. References: Cortex XDR Prevent License Cortex XDR Agent Features Next-Generation Firewall Features

• Question 33:

  Which statement is true based on the following Agent Auto Upgrade widget?

  

  A. There are a total of 689 Up To Date agents.
  B. Agent Auto Upgrade was enabled but not on all endpoints.
  C. Agent Auto Upgrade has not been enabled.
  D. There are more agents in Pending status than In Progress status.
  B. Agent Auto Upgrade was enabled but not on all endpoints.

  ---

  Explanation/Reference:

  The Agent Auto Upgrade widget shows the status of the agent auto upgrade feature on the endpoints. The widget displays the number of agents that are up to date, in progress, pending, failed, and not configured. In this case, the widget shows that there are 450 agents that are up to date, 78 in progress, 15 pending, 18 failed, and 128 not configured. This means that the agent auto upgrade feature was enabled but not on all endpoints. References: Cortex XDR Agent Auto Upgrade PCDRA Study Guide

• Question 34:

  As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

  A. Enable DLL Protection on all endpoints but there might be some false positives.
  B. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
  C. No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.
  D. No step is required because the malicious document is already stopped.
  B. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

  ---

  Explanation/Reference:

  The correct answer is B, create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity. BTP rules are a powerful feature of Cortex XDR that allow you to define custom rules to detect and block malicious behaviors on endpoints. You can use BTP rules to create indicators of compromise (IOCs) based on file attributes, registry keys, processes, network connections, and other criteria. By creating BTP rules, you can prevent the same malicious Word document from being opened by other users in your organization, even if the document has a different name or hash value. BTP rules are updated through content updates and can be managed from the Cortex XDR console. The other options are incorrect for the following reasons: A is incorrect because enabling DLL Protection on all endpoints is not a specific or effective way to prevent the malicious Word document. DLL Protection is a feature of Cortex XDR that prevents the loading of unsigned or untrusted DLLs by protected processes. However, this feature does not apply to Word documents or macros, and may cause false positives or compatibility issues with legitimate applications. C is incorrect because relying on Cortex to share IOCs with the Cyber Threat Alliance members is not a proactive or sufficient way to prevent the malicious Word document. The Cyber Threat Alliance is a group of cybersecurity vendors that share threat intelligence and best practices to improve their products and services. However, not all vendors are members of the alliance, and not all IOCs are shared or updated in a timely manner. Therefore, you cannot assume that other users in your organization are protected by the same IOCs as Cortex XDR. D is incorrect because doing nothing is not a responsible or secure way to prevent the malicious Word document. Even though Cortex XDR agent prevented the attempt to open the document on one endpoint, it does not mean that the document is no longer a threat. The document may still be circulating in your network or email system, and may be opened by other users who have different agent profiles or policies. Therefore, you should take steps to identify and block the document across your organization. References: Cortex XDR Agent Administrator Guide: Behavioral Threat Protection Cortex XDR Agent Administrator Guide: DLL Protection Palo Alto Networks: Cyber Threat Alliance

• Question 35:

  What kind of the threat typically encrypts user files?

  A. ransomware
  B. SQL injection attacks
  C. Zero-day exploits
  D. supply-chain attacks
  A. ransomware

  ---

  Explanation/Reference:

  Ransomware is a type of malicious software, or malware, that encrypts user files and prevents them from accessing their data until they pay a ransom. Ransomware can affect individual users, businesses, and organizations of all kinds. Ransomware attacks can cause costly disruptions, data loss, and reputational damage. Ransomware can spread through various methods, such as phishing emails, malicious attachments, compromised websites, or network vulnerabilities. Some ransomware variants can also self-propagate and infect other devices or networks. Ransomware authors typically demand payment in cryptocurrency or other untraceable methods, and may threaten to delete or expose the encrypted data if the ransom is not paid within a certain time frame. However, paying the ransom does not guarantee that the files will be decrypted or that the attackers will not target the victim again. Therefore, the best way to protect against ransomware is to prevent infection in the first place, and to have a backup of the data in case of an attack123456 References: What is Ransomware? | How to Protect Against Ransomware in 2023 Ransomware - Wikipedia What is ransomware? | Ransomware meaning | Cloudflare What Is Ransomware? | Ransomware.org Ransomware -- FBI

• Question 36:

  Which of the following policy exceptions applies to the following description?

  `An exception allowing specific PHP files'

  A. Support exception
  B. Local file threat examination exception
  C. Behavioral threat protection rule exception
  D. Process exception
  B. Local file threat examination exception

  ---

  Explanation/Reference:

  The policy exception that applies to the following description is B, local file threat examination exception. A local file threat examination exception is an exception that allows you to exclude specific files or folders from being scanned by the Cortex XDR agent for malware or threats. You can use this exception to prevent false positives, performance issues, or compatibility problems with legitimate files or applications. You can define the local file threat examination exception by file name, file path, file hash, or digital signer. For example, you can create a local file threat examination exception for specific PHP files by entering their file names or paths in the exception configuration. References: Local File Threat Examination Exceptions Create a Local File Threat Examination Exception

• Question 37:

  In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

  A. Agent Proxy
  B. Agent Installer and Content Caching
  C. Syslog Collector
  D. CSV Collector
  B. Agent Installer and Content Caching

  ---

  Explanation/Reference:

  The Agent Installer and Content Caching applet of the Broker VM is used to download and cache the Cortex XDR agent installation packages and content updates from Palo Alto Networks servers. This applet also acts as a proxy server for the Cortex XDR agents to communicate with the Cortex Data Lake and the Cortex XDR management console. To ensure secure communication between the Broker VM and the Cortex XDR agents, you are required to install a strong cipher SHA256-based SSL certificate on the Broker VM. The SSL certificate must have a common name or subject alternative name that matches the Broker VM FQDN or IP address. The SSL certificate must also be trusted by the Cortex XDR agents, either by using a certificate signed by a public CA or by manually installing the certificate on the endpoints. References: Agent Installer and Content Caching Install an SSL Certificate on the Broker VM

• Question 38:

  Which type of IOC can you define in Cortex XDR?

  A. Destination IP Address
  B. Source IP Address
  C. Source port
  D. Destination IPAddress: Destination
  A. Destination IP Address

  ---

  Explanation/Reference:

  Cortex XDR allows you to define IOC rules based on various types of indicators of compromise (IOC) that you can use to detect and respond to threats in your network. One of the types of IOC that you can define in Cortex XDR is destination IP address, which is the IP address of the remote host that a local endpoint is communicating with. You can use this type of IOC to identify malicious network activity, such as connections to command and control servers, phishing sites, or malware distribution hosts. You can also specify the direction of the network traffic (inbound or outbound) and the protocol (TCP or UDP) for the destination IP address IOC. References: Cortex XDR documentation portal Is there a possibility to create an IOC list to employ it in a query? Cortex XDR Datasheet

• Question 39:

  Which Exploit ProtectionModule (EPM) can be used to prevent attacks based on OS function?

  A. UASLR
  B. JIT Mitigation
  C. Memory Limit Heap Spray Check
  D. DLL Security
  B. JIT Mitigation

  ---

  Explanation/Reference:

  JIT Mitigation is an Exploit Protection Module (EPM) that can be used to prevent attacks based on OS function. JIT Mitigation protects against exploits that use the Just-In-Time (JIT) compiler of the OS to execute malicious code. JIT Mitigation monitors the memory pages that are allocated by the JIT compiler and blocks any attempts to execute code from those pages. This prevents attackers from using the JIT compiler as a way to bypass other security mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). References: Palo Alto Networks. (2023). PCDRA Study Guide. PDF file. Retrieved from https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/ education/pcdra-study-guide.pdf Palo Alto Networks. (2021). Exploit Protection Modules. Web page. Retrieved from https://docs.paloaltonetworks.com/traps/6-0/traps-endpoint-security-manager- admin/traps-endpoint-security-policies/exploit-protection-modules.html

• Question 40:

  When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

  A. Click the three dots on the widget and then choose "Save" and this will link the query to the Widget Library.
  B. This isn't supported, you have to exit the dashboard and go into the Widget Library first to create it.
  C. Click on "Save to Action Center" in the dashboard and you will be prompted to give the query a name and description.
  D. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.
  D. Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.

  ---

  Explanation/Reference:

  To save a custom XQL query to the Widget Library, you need to click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description. This will allow you to reuse the query in other dashboards or reports. You cannot save a query to the Widget Library by clicking the three dots on the widget, as this will only give you options to edit, delete, or clone the widget. You also cannot save a query to the Action Center, as this is a different feature that allows you to create alerts or remediation actions based on the query results. You do not have to exit the dashboard and go into the Widget Library first to create a query, as you can do it directly from the dashboard. References: Cortex XDR Pro Admin Guide: Save a Custom Query to the Widget Library Cortex XDR Pro Admin Guide: Create a Dashboard