Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 51:

  What is the Wildfire analysis file size limit for Windows PE files?

  A. No Limit
  B. 500MB
  C. 100MB
  D. 1GB
  C. 100MB

  ---

  Explanation/Reference:

  The Wildfire analysis file size limit for Windows PE files is 100MB. Windows PE files are executable files that run on the Windows operating system, such as .exe, .dll, .sys, or .scr files. Wildfire is a cloud-based service that analyzes files and

  URLs for malicious behavior and generates signatures and protections for them. Wildfire can analyze various file types, such as PE, APK, PDF, MS Office, and others, but each file type has a different file size limit. The file size limit

  determines the maximum size of the file that can be uploaded or forwarded to Wildfire for analysis. If the file size exceeds the limit, Wildfire will not analyze the file and will return an error message. According to the Wildfire documentation1,

  the file size limit for Windows PE files is 100MB. This means that any PE file that is larger than 100MB will not be analyzed by Wildfire. However, the firewall can still apply other security features, such as antivirus, anti-spyware, vulnerability

  protection, and file blocking, to the PE file based on the security policy settings. The firewall can also perform local analysis on the PE file using the Cortex XDR agent, which uses machine learning models to assess the file and assign it a

  verdict2.

  References:

  WildFire File Size Limits: This document provides the file size limits for different file types that can be analyzed by Wildfire.

  Local Analysis: This document explains how the Cortex XDR agent performs local analysis on files that cannot be sent to Wildfire for analysis.

• Question 52:

  What is the outcome of creating and implementing an alert exclusion?

  A. The Cortex XDR agent will allow the process that was blocked to run on the endpoint.
  B. The Cortex XDR console will hide those alerts.
  C. The Cortex XDR agent will not create an alert for this event in the future.
  D. The Cortex XDR console will delete those alerts and block ingestion of them in the future.
  B. The Cortex XDR console will hide those alerts.

  ---

  Explanation/Reference:

  The outcome of creating and implementing an alert exclusion is that the Cortex XDR console will hide those alerts that match the exclusion criteria. An alert exclusion is a policy that allows you to filter out alerts that are not relevant, false positives, or low priority, and focus on the alerts that require your attention. When you create an alert exclusion, you can specify the criteria that define which alerts you want to exclude, such as alert name, severity, source, or endpoint. After you create an alert exclusion, Cortex XDR will hide any future alerts that match the criteria, and exclude them from incidents and search query results. However, the alert exclusion does not affect the behavior of the Cortex XDR agent or the security policy on the endpoint. The Cortex XDR agent will still create an alert for the event and apply the appropriate action, such as blocking or quarantining, according to the security policy. The alert exclusion only affects the visibility of the alert on the Cortex XDR console, not the actual protection of the endpoint. Therefore, the correct answer is B, the Cortex XDR console will hide those alerts12 References: Alert Exclusions Create an Alert Exclusion Policy

• Question 53:

  In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

  A. In the Restrictions Profile, add the file name and path to the Executable Files allow list.
  B. Create a new rule exception and use the singer as the characteristic.
  C. Add the signer to the allow list in the malware profile.
  D. Add the signer to the allow list under the action center page.
  C. Add the signer to the allow list in the malware profile.

  ---

  Explanation/Reference:

  To prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer in Windows and macOS, one way to add an exception for the signer is to add the signer to the allow list in the malware profile. A malware profile is

  a profile that defines the settings and actions for malware prevention and detection on the endpoints. A malware profile allows you to specify a list of files, folders, or signers that you want to exclude from malware scanning and blocking. By

  adding the signer to the allow list in the malware profile, you can prevent the Cortex XDR Agent from blocking any file that is signed by that signer1.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  A. In the Restrictions Profile, add the file name and path to the Executable Files allow list: This is not the correct answer. Adding the file name and path to the Executable Files allow list in the Restrictions Profile will not prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. A Restrictions Profile is a profile that defines the settings and actions for restricting the execution of files or processes on the endpoints. A Restrictions Profile allows you to specify a list of executable files that you want to allow or block based on the file name and path. However, this method does not take into account the digital signer of the file, and it may not be effective if the file name or path changes2. B. Create a new rule exception and use the signer as the characteristic: This is not the correct answer. Creating a new rule exception and using the signer as the characteristic will not prevent theCortex XDR Agent from blocking execution of a file based on the digital signer. A rule exception is an exception that you can create to modify the behavior of a specific prevention rule or BIOC rule. A rule exception allows you to specify the characteristics and the actions that you want to apply to the exception, such as file hash, process name, IP address, or domain name. However, this method does not support using the signer as a characteristic, and it may not be applicable to all prevention rules or BIOC rules3.

  D. Add the signer to the allow list under the action center page: This is not the correct answer. Adding the signer to the allow list under the action center page will not prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. The action center page is a page that allows you to create and manage actions that you can perform on your endpoints, such as isolating, scanning, collecting files, or executing scripts. The action center page does not have an option to add a signer to the allow list, and it is not related to the malware prevention or detection functionality4. In conclusion, to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer in Windows and macOS, one way to add an exception for the signer is to add the signer to the allow list in the malware profile. By using this method, you can exclude the files that are signed by the trusted signer from the malware scanning and blocking. References: Add a New Malware Security Profile Add a New Restrictions Security Profile Create a Rule Exception Action Center

• Question 54:

  What is an example of an attack vector for ransomware?

  A. Performing DNS queries for suspicious domains
  B. Performing SSL Decryption on an endpoint
  C. Phishing emails containing malicious attachments
  D. A URL filtering feature enabled on a firewall
  C. Phishing emails containing malicious attachments

  ---

  Explanation/Reference:

  An example of an attack vector for ransomware is phishing emails containing malicious attachments. Phishing is a technique that involves sending fraudulent emails that appear to come from alegitimate source, such as a bank, a company, or a government agency. The emails typically contain a malicious attachment, such as a PDF document, a ZIP archive, or a Microsoft Office document, that contains ransomware or a ransomware downloader. When the recipient opens or downloads the attachment, the ransomware is executed and encrypts the files or data on the victim's system. The attacker then demands a ransom for the decryption key, usually in cryptocurrency. Phishing emails are one of the most common and effective ways of delivering ransomware, as they can bypass security measures such as firewalls, antivirus software, or URL filtering. Phishing emails can also exploit the human factor, as they can trick the recipient into opening the attachment by using social engineering techniques, such as impersonating a trusted sender, creating a sense of urgency, or appealing to curiosity or greed. Phishing emails can also target specific individuals or organizations, such as executives, employees, or customers, in a technique called spear phishing, which increases the chances of success. According to various sources, phishing emails are the main vector of ransomware attacks, accounting for more than 90% of all ransomware infections12. Some of the most notorious ransomware campaigns, such as CryptoLocker, Locky, and WannaCry, have used phishing emails as their primary delivery method3 . Therefore, it is essential to educate users on how to recognize and avoid phishing emails, as well as to implement security solutions that can detect and block malicious attachments. References: Top 7 Ransomware Attack Vectors and How to Avoid Becoming a Victim - Bitsight What Is the Main Vector of Ransomware Attacks? A Definitive Guide CryptoLocker Ransomware Information Guide and FAQ [Locky Ransomware Information, Help Guide, and FAQ] [WannaCry ransomware attack]

• Question 55:

  Phishing belongstowhich of the following MITRE ATTandCK tactics?

  A. Initial Access, Persistence
  B. Persistence, Command and Control
  C. Reconnaissance, Persistence
  D. Reconnaissance, Initial Access
  D. Reconnaissance, Initial Access

  ---

  Explanation/Reference:

  Phishing is a technique that belongs to two MITRE ATTandCK tactics: Reconnaissance and Initial Access. Reconnaissance is the process of gathering information about a target before launching an attack. Phishing for information is a sub- technique of Reconnaissance that involves sending phishing messages to elicit sensitive information that can be used during targeting. Initial Access is the process of gaining a foothold in a network or system. Phishing is a sub-technique of Initial Access that involves sending phishing messages to execute malicious code on victim systems. Phishing can be used for both Reconnaissance and Initial Access depending on the objective and content of the phishing message. References: Phishing, Technique T1566 - Enterprise | MITRE ATTandCK?1 Phishing for Information, Technique T1598 - Enterprise | MITRE ATTandCK?2 Phishing for information, Part 2: Tactics and techniques 3 PHISHING AND THE MITREATTandCK FRAMEWORK - EnterpriseTalk 4 Initial Access, Tactic TA0001 - Enterprise | MITRE ATTandCK?5

• Question 56:

  Which type of BIOC rule is currently available in Cortex XDR?

  A. Threat Actor
  B. Discovery
  C. Network
  D. Dropper
  B. Discovery

  ---

  Explanation/Reference:

  The type of BIOC rule that is currently available in Cortex XDR is Discovery. A Discovery BIOC rule is a rule that detects suspicious or malicious behavior on endpoints based on the Cortex XDR data. A Discovery BIOC rule can use various

  event types, such as file, injection, load image, network, process, registry, or user, to define the criteria for the rule. A Discovery BIOC rule can also use operators, functions, and variables to create complex logic and conditions for the rule. A

  Discovery BIOC rule can generate alerts when the rule is triggered, and these alerts can be grouped into incidents for further investigation and response12.

  Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Threat Actor: This is not the correct answer. Threat Actor is not a type of BIOC rule that is currently available in Cortex XDR. Threat Actor is a term that refers to an individual or a group that is responsible for a cyberattack or a threat campaign. Cortex XDR does not support creating BIOC rules based on threat actors, but it can provide threat intelligence and context from various sources, such as Unit 42, AutoFocus, or Cortex XSOAR3. C. Network: This is not the correct answer. Network is not a type of BIOC rule that is currently available in Cortex XDR. Network is an event type that can be used in a Discovery BIOC rule to define the criteria based on network attributes, such as source IP, destination IP, source port, destination port, protocol, or domain. Network is not a standalone type of BIOC rule, but a part of the Discovery BIOC rule2. D. Dropper: This is not the correct answer. Dropper is not a type of BIOC rule that is currently available in Cortex XDR. Dropper is a term that refers to a type of malware that is designed to download and install other malicious files or programs on a compromised system. Cortex XDR does not support creating BIOC rules based on droppers, but it can detect and prevent droppers using various methods, such as behavioral threat protection, exploit prevention, or WildFire analysis4. In conclusion, the type of BIOC rule that is currently available in Cortex XDR is Discovery. By using Discovery BIOC rules, you can create custom detection rules that match your specific use cases and scenarios. References: Create a BIOC Rule BIOC Rule Event Types Threat Intelligence and Context Malware Prevention

• Question 57:

  What is the purpose of the Unit 42 team?

  A. Unit 42 is responsible for automation and orchestration of products
  B. Unit 42 is responsible for the configuration optimization of the Cortex XDR server
  C. Unit 42 is responsible for threat research, malware analysis and threat hunting
  D. Unit 42 is responsible for the rapid deployment of Cortex XDR agents
  C. Unit 42 is responsible for threat research, malware analysis and threat hunting

  ---

  Explanation/Reference:

  Unit 42 is the threat intelligence and response team of Palo Alto Networks. The purpose of Unit 42 is to collect and analyze the most up-to-date threat intelligence and apply it to respond to cyberattacks. Unit 42 is composed of world-renowned threat researchers, incident responders and security consultants who help organizations proactively manage cyber risk. Unit 42 is responsible for threat research, malware analysis and threat hunting, among other activities12. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Unit 42 is not responsible for automation and orchestration of products. Automation and orchestration are capabilities that are provided by Palo Alto Networks products such as Cortex XSOAR, which is a security orchestration, automation and response platform that helps security teams automate tasks, coordinate actions and manage incidents3. B. Unit 42 is not responsible for the configuration optimization of the Cortex XDR server. The Cortex XDR server is the cloud-based platform that provides detection and response capabilities across network, endpoint and cloud data sources. The configuration optimization of the Cortex XDR server is the responsibility of the Cortex XDR administrators, who can use the Cortex XDR app to manage the settings and policies of the Cortex XDR server4.

  C. Unit 42 is not responsible for the rapid deployment of Cortex XDR agents. The Cortex XDR agents are the software components that are installed on endpoints to provide protection and visibility. The rapid deployment of Cortex XDR agents is the responsibility of the Cortex XDR administrators, who can use various methods such as group policy objects, scripts, or third-party tools to deploy the Cortex XDR agents to multiple endpoints5. In conclusion, Unit 42 is the threat intelligence and response team of Palo Alto Networks that is responsible for threat research, malware analysis and threat hunting. By leveraging the expertise and insights of Unit 42, organizations can enhance their security posture and protect against the latest cyberthreats. References: About Unit 42: Our Mission and Team Unit 42: Threat Intelligence and Response Cortex XSOAR Cortex XDR Pro Admin Guide: Manage Cortex XDR Settings and Policies Cortex XDR Pro Admin Guide: Deploy Cortex XDR Agents

• Question 58:

  What does the following output tell us?

  

  A. There is one low severity incident.
  B. Host shpapy_win10 had the most vulnerabilities.
  C. There is one informational severity alert.
  D. This is an actual output of the Top 10 hosts with the most malware.
  D. This is an actual output of the Top 10 hosts with the most malware.

  ---

  Explanation/Reference:

  The output shows the top 10 hosts with the most malware in the last 30 days, based on the Cortex XDR data. The output is sorted by the number of incidents, with the host with the most incidents at the top. The output also shows the number of alerts, the number of endpoints, and the percentage of endpoints for each host. The output is generated by using the ACC (Application Command Center) feature of Cortex XDR, which provides a graphical representation of the network activity and threat landscape. The ACC allows you to view and analyze various widgets, such as the Top 10 hosts with the most malware, the Top 10 applications by bandwidth, the Top 10 threats by count, and more . References: Use the ACC to Analyze Network Activity Top 10 Hosts with the Most Malware

• Question 59:

  Where would you view the WildFire report in an incident?

  A. next to relevant Key Artifacts in the incidents details page
  B. under Response --> Action Center
  C. under the gear icon --> Agent Audit Logs
  D. on the HUB page at apps.paloaltonetworks.com
  A. next to relevant Key Artifacts in the incidents details page

  ---

  Explanation/Reference:

  To view the WildFire report in an incident, you need to go to the incident details page and look for the relevant key artifacts that are related to the WildFire analysis. A key artifact is a piece of evidence that is associated with an alert or an incident, such as a file hash, a registry key, an IP address,a domain name, or a full path. If a key artifact is related to a WildFire analysis, you will see a WildFire icon next to it, indicating that there is a WildFire report available for that artifact. You can click on the WildFire icon to view the report, which will show you the detailed information about the artifact, such as the verdict, the behavior, the severity, the signatures, and the screenshots12. Let's briefly discuss the other options to provide a comprehensive explanation:

  B. under Response --> Action Center: This is not the correct answer. The Action Center is a feature that allows you to create and manage actions that you can perform on your endpoints, such as isolating, scanning, collecting files, or executing scripts. The Action Center does not show you the WildFire reports for the incidents, but it can help you to remediate the incidents by applying the appropriate actions3. C. under the gear icon --> Agent Audit Logs: This is not the correct answer. The Agent Audit Logs are logs that show you the activities and events that occurred on the Cortex XDR agents, such as installation, upgrade, connection, policy update, or prevention. The Agent Audit Logs do not show you the WildFire reports for the incidents, but they can help you to troubleshoot the agent issues or verify the agent status4. D. on the HUB page at apps.paloaltonetworks.com: This is not the correct answer. The HUB page is a web portal that allows you to access and manage your Palo Alto Networks applications, such as Cortex XDR, Cortex XSOAR, Prisma Cloud, or AutoFocus. The HUB page does not show you the WildFire reports for the incidents, but it can help you to navigate to the different applications or view the notifications and alerts5. In conclusion, to view the WildFire report in an incident, you need to go to the incident details page and look for the relevant key artifacts that are related to the WildFire analysis. By viewing the WildFire report, you can gain more insights and context about the incident and the artifact. References: View Incident Details View WildFire Reports Action Center Agent Audit Logs HUB

• Question 60:

  What types of actions you can execute with live terminal session?

  A. Manage Network configurations, Quarantine Files, Run PowerShell scripts
  B. Manage Processes, Manage Files, Run Operating System Commands, Run Ruby Commands and Scripts
  C. Apply patches, Reboot System, send notification for end user, Run Python Commands and Scripts
  D. Manage Processes, Manage Files, Run Operating System Commands, Run Python Commands and Scripts
  D. Manage Processes, Manage Files, Run Operating System Commands, Run Python Commands and Scripts

  ---

  Explanation/Reference:

  Live terminal session is a feature of Cortex XDR that allows you to remotely access and control endpoints from the Cortex XDR console. With live terminal session, you can execute various actions on the endpoints, such as: Manage Processes: You can view, start, or kill processes on the endpoint, and monitor their CPU and memory usage. Manage Files: You can view, create, delete, or move files and folders on the endpoint, and upload or download files to or from the endpoint. Run Operating System Commands: You can run commands on the endpoint using the native command-line interface of the operating system, such as cmd.exe for Windows, bash for Linux, or zsh for macOS. Run Python Commands and Scripts: You can run Python commands and scripts on the endpoint using the Python interpreter embedded in the Cortex XDR agent. You can use the Python commands and scripts to perform advanced tasks or automation on the endpoint. References: Initiate a Live Terminal Session Manage Processes Manage Files Run Operating System Commands Run Python Commands and Scripts