Palo Alto Networks Palo Alto Networks Certification PCDRA Questions & Answers

• Question 31:

  When using the "File Search and Destroy" feature, which of the following search hash type is supported?

  A. SHA256 hash of the file

  B. AES256 hash of the file

  C. MD5 hash of the file

  D. SHA1 hash of the file

  Correct Answer: A

• Question 32:

  If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

  A. Broker VM Pathfinder

  B. Local Agent Proxy

  C. Local Agent Installer and Content Caching

  D. Broker VM Syslog Collector

  Correct Answer: C

• Question 33:

  What is by far the most common tactic used by ransomware to shut down a victim's operation?

  A. preventing the victim from being able to access APIs to cripple infrastructure

  B. denying traffic out of the victims network until payment is received

  C. restricting access to administrative accounts to the victim

  D. encrypting certain files to prevent access by the victim

  Correct Answer: D

• Question 34:

  How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

  A. by encrypting the disk first.

  B. by utilizing decoy Files.

  C. by retrieving the encryption key.

  D. by patching vulnerable applications.

  Correct Answer: B

• Question 35:

  What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

  A. Netflow Collector

  B. Syslog Collector

  C. DB Collector

  D. Pathfinder

  Correct Answer: B

• Question 36:

  In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

  A. Agent Proxy

  B. Agent Installer and Content Caching

  C. Syslog Collector

  D. CSV Collector

  Correct Answer: B

• Question 37:

  When is the wss (WebSocket Secure) protocol used?

  A. when the Cortex XDR agent downloads new security content

  B. when the Cortex XDR agent uploads alert data

  C. when the Cortex XDR agent connects to WildFire to upload files for analysis

  D. when the Cortex XDR agent establishes a bidirectional communication channel

  Correct Answer: D

• Question 38:

  With a Cortex XDR Prevent license, which objects are considered to be sensors?

  A. Syslog servers

  B. Third-Party security devices

  C. Cortex XDR agents

  D. Palo Alto Networks Next-Generation Firewalls

  Correct Answer: C

• Question 39:

  What is the standard installation disk space recommended to install a Broker VM?

  A. 1GB disk space

  B. 2GB disk space

  C. 512GB disk space

  D. 256GB disk space

  Correct Answer: C

• Question 40:

  Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

  A. in the macOS Malware Protection Profile to indicate allowed signers

  B. in the Linux Malware Protection Profile to indicate allowed Java libraries

  C. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

  D. in the Windows Malware Protection Profile to indicate allowed executables

  Correct Answer: D