Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 41:

  What is the purpose of targeting software vendors in a supply-chain attack?

  A. to take advantage of a trusted software delivery method.
  B. to steal users' login credentials.
  C. to access source code.
  D. to report Zero-day vulnerabilities.
  A. to take advantage of a trusted software delivery method.

  ---

  Explanation/Reference:

  A supply chain attack is a type of cyberattack that targets a trusted third- party vendor who offers services or software vital to the supply chain. Software supply chain attacks inject malicious code into an application in order to infect all users of an app. The purpose of targeting software vendors in a supply-chain attack is to take advantage of a trusted software delivery method, such as an update or a download, that can reach a large number of potential victims. By compromising a software vendor, an attacker can bypass the security measures of the downstream organizations and gain access to their systems, data, or networks. References: What Is a Supply Chain Attack? - Definition, Examples and More | Proofpoint US What Is a Supply Chain Attack? - CrowdStrike What Is a Supply Chain Attack? | Zscaler What Is a Supply Chain Attack? Definition, Examples and Prevention

• Question 42:

  What contains a logical schema in an XQL query?

  A. Bin
  B. Array expand
  C. Field
  D. Dataset
  C. Field

  ---

  Explanation/Reference:

  A logical schema in an XQL query is a field, which is a named attribute of a dataset. A field can have a data type, such as string, integer, boolean, or array. A field can also have a modifier, such as bin or expand, that transforms the field value in the query output. A field can be used in the select, where, group by, order by, or having clauses of an XQL query. References: XQL Syntax XQL Data Types XQL Field Modifiers

• Question 43:

  What is the standard installation disk space recommended to install a Broker VM?

  A. 1GB disk space
  B. 2GB disk space
  C. 512GB disk space
  D. 256GB disk space
  D. 256GB disk space

  ---

  Explanation/Reference:

  The Broker VM for Cortex XDR is a virtual machine that serves as the central communication hub for all Cortex XDR agents deployed in your organization. It enables agents to communicate with the Cortex XDR cloud service and allows you to manage and monitor the agents' activities from a centralized location. The system requirements for the Broker VM are as follows: CPU: 4 cores RAM: 8 GB Disk space: 256 GB Network: Internet access and connectivity to all Cortex XDR agents The disk space requirement is based on the number of agents and the frequency of content updates. The Broker VM stores the content updates locally and distributes them to the agents. The disk spacealso depends on the retention period of the content updates, which can be configured in the Broker VM settings. The default retention period is 30 days. References: Broker VM for Cortex XDR PCDRA Study Guide

• Question 44:

  When using the "File Search and Destroy" feature, which of the following search hash type is supported?

  A. SHA256 hash of the file
  B. AES256 hash of the file
  C. MD5 hash of the file
  D. SHA1 hash of the file
  A. SHA256 hash of the file

  ---

  Explanation/Reference:

  The File Search and Destroy feature is a capability of Cortex XDR that allows you to search for and delete malicious or unwanted files across your endpoints. You can use this feature to quickly respond to incidents, remediate threats, and enforce compliance policies. To use the File Search andDestroy feature, you need to specify the file name and the file hash of the file you want to search for and delete. The file hash is a unique identifier of the file that is generated by a cryptographic hash function. The file hash ensures that you are targeting the exact file you want, and not a file with a similar name or a different version. The File Search and Destroy feature supports the SHA256 hash type, which is a secure hash algorithm that produces a 256-bit (32-byte) hash value. The SHA256 hash type is widely used for file integrity verification and digital signatures. The File Search and Destroy feature does not support other hash types, such as AES256, MD5, or SHA1, which are either encryption algorithms or less secure hash algorithms. Therefore, the correct answer is A, SHA256 hash of the file1234 References: File Search and Destroy What is a File Hash? SHA-2 - Wikipedia When using the "File Search and Destroy" feature, which of the following search hash type is supported?

• Question 45:

  Which search methods is supported by File Search and Destroy?

  A. File Seek and Destroy
  B. File Search and Destroy
  C. File Seek and Repair
  D. File Search and Repair
  A. File Seek and Destroy
  B. File Search and Destroy
  C. File Seek and Repair
  D. File Search and Repair

• Question 46:

  Which version of python is used in live terminal?

  A. Python 2 and 3 with standard Python libraries
  B. Python 2 and 3 with specific XDR Python libraries developed by Palo Alto Networks
  C. Python 3 with specific XDR Python libraries developed by Palo Alto Networks
  D. Python 3 with standard Python libraries
  D. Python 3 with standard Python libraries

  ---

  Explanation/Reference:

  Live terminal uses Python 3 with standard Python libraries to run Python commands and scripts on the endpoint. Live terminal does not support Python 2 or any custom or external Python libraries. Live terminal uses the Python interpreter embedded in the Cortex XDR agent, which is based on Python 3.7.4. The standard Python libraries are the modules that are included with the Python installation and provide a wide range of functionalities, such as operating system interfaces, network programming, data processing, and more. You can use the Python commands and scripts to perform advanced tasks or automation on the endpoint, such as querying system information, modifying files or registry keys, or running other applications. References: Run Python Commands and Scripts Python Standard Library

• Question 47:

  While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

  A. mark the incident as Unresolved
  B. create a BIOC rule excluding this behavior
  C. create an exception to prevent future false positives
  D. mark the incident as Resolved -False Positive
  D. mark the incident as Resolved -False Positive

  ---

  Explanation/Reference:

  If all alerts contained in a Cortex XDR incident have exclusions, the Cortex XDR console will automatically mark the incident as Resolved ?False Positive. This means that the incident was not a real threat, but a benign or legitimate activity that triggered an alert. By marking the incident as Resolved?False Positive, the Cortex XDR console removes the incident from the list of unresolved incidents and does not count it towards the incident statistics. This helps the analyst to focus on the true positive incidents that require further investigation and response1. An exclusion is a rule that hides an alert from the Cortex XDR console, based on certain criteria, such as the alert source, type, severity, or description. An exclusion does not change the security policy or prevent the alert from firing, it only suppresses the alert from the console. An exclusion is useful when the analyst wants to reduce the noise of false positive alerts that are not relevant or important2. An exception, on the other hand, is a rule that overrides the security policy and allows or blocks a process or file from running on an endpoint, based on certain attributes, such as the file hash, path, name, or signer. An exception is useful when the analyst wants to prevent false negative alerts that are caused by malicious or unwanted files or processes that are not detected by the security policy3. A BIOC rule is a rule that creates an alert based on a custom XQL query that defines a specific behavior of interest or concern. A BIOC rule is useful when the analyst wants to detect and alert on anomalous or suspicious activities that are not covered by the default Cortex XDR rules4. References: Palo Alto Networks Cortex XDR Documentation, Resolve an Incident1 Palo Alto Networks Cortex XDR Documentation, Alert Exclusions2 Palo Alto Networks Cortex XDR Documentation, Exceptions3 Palo Alto Networks Cortex XDR Documentation, BIOC Rules4

• Question 48:

  Which of the following represents the correct relation of alerts to incidents?

  A. Only alerts with the same host are grouped together into one Incident in a given time frame.
  B. Alerts that occur within athree-hourtime frame are grouped together into one Incident.
  C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.
  D. Every alert creates a new Incident.
  C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

  ---

  Explanation/Reference:

  The correct relation of alerts to incidents is that alerts with same causality chains that occur within a given time frame are grouped together into an incident. A causality chain is a sequence of events that are related to the same malicious activity, such as a malware infection, a lateral movement, or a data exfiltration. Cortex XDR uses a set of rules that take into account different attributes of the alerts, such as the alert source, type, and time period, to determine if they belong to the same causality chain. By grouping related alerts into incidents, Cortex XDR reduces the number of individual events to review and provides a complete picture of the attack with rich investigative details1. Option A is incorrect, because alerts with the same host are not necessarily grouped together into one incident in a given time frame. Alerts with the same host may belong to different causality chains, or may be unrelated to any malicious activity. For example, if a host has a malware infection and a network anomaly, these alerts may not be grouped into the same incident, unless they are part of the same attack. Option B is incorrect, because alerts that occur within a three hour time frame are not always grouped together into one incident. The time frame is not the only criterion for grouping alerts into incidents. Alerts that occur within a three hour time frame may belong to different causality chains, or may be unrelated to any malicious activity. For example, if a host has a file download and a registry modification within a three hour time frame, these alerts may not be grouped into the same incident, unless they are part of the same attack. Option D is incorrect, because every alert does not create a new incident. Creating a new incident for every alert would result in alert fatigue and inefficient investigations. Cortex XDR aims to reduce the number of incidents by grouping related alerts into one incident, based on their causality chains and other attributes. References: Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 9 Palo Alto Networks Cortex XDR Documentation, Incident Management Overview2 Cortex XDR: Stop Breaches with AI-Powered Cybersecurity1

• Question 49:

  What is by far the most common tactic used by ransomware to shut down a victim's operation?

  A. preventing the victim from being able to access APIs to cripple infrastructure
  B. denying traffic out of the victims network until payment is received
  C. restricting access to administrative accounts to the victim
  D. encrypting certain files to prevent access by the victim
  D. encrypting certain files to prevent access by the victim

  ---

  Explanation/Reference:

  Ransomware is a type of malicious software, or malware, that encrypts certain files or data on the victim's system or network and prevents them from accessing their data until they pay a ransom. This is by far the most common tactic used by ransomware to shut down a victim's operation, as it can cause costly disruptions, data loss, and reputational damage. Ransomware can affect individual users, businesses, and organizations of all kinds. Ransomware can spread through various methods, such as phishing emails, malicious attachments, compromised websites, or network vulnerabilities. Some ransomware variants can also self-propagate and infect other devices or networks. Ransomware authors typically demand payment in cryptocurrency or other untraceable methods, and may threaten to delete or expose the encrypted data if the ransom is not paid within a certain time frame. However, paying the ransom does not guarantee that the files will be decrypted or that the attackers will not target the victim again. Therefore, the best way to protect against ransomware is to prevent infection in the first place, and to have a backup of the data in case of an attack1234 References: What is Ransomware? | How to Protect Against Ransomware in 2023 Ransomware - Wikipedia What is ransomware? | Ransomware meaning | Cloudflare [What Is Ransomware? | Ransomware.org] [Ransomware -- FBI]

• Question 50:

  What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?

  A. Ransomware
  B. Worm
  C. Keylogger
  D. Rootkit
  A. Ransomware

  ---

  Explanation/Reference:

  The kind of malware that uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim is ransomware. Ransomware is a type of malware that encrypts the victim's files or blocks access to their system,

  and then demands a ransom for the decryption key or the restoration of access. Ransomware can also threaten to expose or delete the victim's data if the ransom is not paid. Ransomware can cause significant damage and disruption to

  individuals, businesses, and organizations, and can be difficult to remove or recover from. Some examples of ransomware are CryptoLocker, WannaCry, Ryuk, and REvil.

  References:

  12 Types of Malware + Examples That You Should Know - CrowdStrike What is Malware? Malware Definition, Types and Protection 12+ Types of Malware Explained with Examples (Complete List)