Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 61:

  How can you pivot within a row to Causality view and Timeline views for further investigate?

  A. Using the Open Card Only
  B. Using the Open Card and Open Timeline actions respectively
  C. You can't pivot within a row to Causality view and Timeline views
  D. Using Open Timeline Actions Only
  B. Using the Open Card and Open Timeline actions respectively

  ---

  Explanation/Reference:

  To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row,

  showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These

  actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident.

  References:

  Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View

  PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1:

  Investigate alerts using the Causality view and Timeline view

• Question 62:

  What is the difference between presets and datasets in XQL?

  A. A dataset is a Cortex data lake data source only; presets are built-in data source.
  B. A dataset is a built-in orthird-partysource; presets group XDR data fields.
  C. A dataset is a database; presets is a field.
  D. A dataset is a third-party data source; presets are built-in data source.
  B. A dataset is a built-in orthird-partysource; presets group XDR data fields.

  ---

  Explanation/Reference:

  The difference between presets and datasets in XQL is that a dataset is a built-in or third-party data source, while a preset is a group of XDR data fields. A dataset is a collection of data that you can query and analyze using XQL. A dataset can be a Cortex data lake data source, such as endpoints, alerts, incidents, or network flows, or a third- party data source, such as AWS CloudTrail, Azure Activity Logs, or Google Cloud Audit Logs. A preset is a predefined set of XDR data fields that are relevant for a specific use case, such as process execution, file operations, or network activity. A preset can help you simplify and standardize your XQL queries by selecting the most important fields for youranalysis. You can use presets with any Cortex data lake data source, but not with third-party data sources. References: Datasets and Presets XQL Language Reference

• Question 63:

  The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?

  A. Create an individual alert exclusion.
  B. Create a global inclusion.
  C. Create an endpoint-specific exception.
  D. Create a global exception.
  D. Create a global exception.

  ---

  Explanation/Reference:

  A global exception is a rule that allows you to exclude specific files, processes, or behaviors from being blocked or detected by Cortex XDR. A global exception applies to all endpoints in your organization that are protected by Cortex XDR.

  Creating a global exception for a vitally important piece of software that is known to be benign would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization.

  To create a global exception, you need to follow these steps:

  In the Cortex XDR management console, go to Policy Management > Exceptions and click Add Exception.

  Select the Global Exception option and click Next. Enter a name and description for the exception and click Next. Select the type of exception you want to create, such as file, process, or behavior, and click Next.

  Specify the criteria for the exception, such as file name, hash, path, process name, command line, or behavior name, and click Next.

  Review the summary of the exception and click Finish.

  References:

  Create Global Exceptions: This document explains how to create global exceptions to exclude specific files, processes, or behaviors from being blocked or detected by Cortex XDR.

  Exceptions Overview: This document provides an overview of exceptions and how they can be used to fine-tune the Cortex XDR security policy.

• Question 64:

  Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

  A. NetBIOS over TCP
  B. WebSocket
  C. UDP and a random port
  D. TCP, over port 80
  B. WebSocket

  ---

  Explanation/Reference:

  Live Terminal uses the WebSocket protocol to communicate with the agent on the endpoint. WebSocket is a full-duplex communication protocol that enables bidirectional data exchange between a client and a server over a single TCP

  connection. WebSocket is designed to be implemented in web browsers and web servers, but it can be used by any client or server application. WebSocket provides a persistent connection between the Cortex XDR console and the endpoint,

  allowing you to execute commands and receive responses in real time. Live Terminal uses port 443 for WebSocket communication, which is the same port used for HTTPS traffic.

  References:

  Initiate a Live Terminal Session

  WebSocket

• Question 65:

  Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

  A. Hash Verdict Determination
  B. Behavioral Threat Protection
  C. Restriction Policy
  D. Child Process Protection
  A. Hash Verdict Determination

  ---

  Explanation/Reference:

  The first protection module that is checked in the Cortex XDR Windows agent malware protection flow is the Hash Verdict Determination. This module compares the hash of the executable file that is about to run on the endpoint with a list of known malicious hashes stored in the Cortex XDR cloud. If the hash matches a malicious hash, the agent blocks the execution and generates an alert. If the hash does not match a malicious hash, the agent proceeds to the next protection module, which is the Restriction Policy1. The Hash Verdict Determination module is the first line of defense against malware, as it can quickly and efficiently prevent known threats from running on the endpoint. However, this module cannot protect against unknown or zero-day threats, which have no known hash signature. Therefore, the Cortex XDR agent relies on other protection modules, such as Behavioral Threat Protection, Child Process Protection, and Exploit Protection, to detect and block malicious behaviors and exploits that may occur during the execution of the file1. References: Palo Alto Networks Cortex XDR Documentation, File Analysis and Protection Flow

• Question 66:

  Can you disable the ability to use the Live Terminal feature in Cortex XDR?

  A. Yes, via the Cortex XDR console or with an installation switch.
  B. No, a separate installer package without Live Terminal is required.
  C. No, it is a required feature of the agent.
  D. Yes, via Agent Settings Profile.
  D. Yes, via Agent Settings Profile.

  ---

  Explanation/Reference:

  The Live Terminal feature in Cortex XDR allows you to initiate a remote connection to an endpoint and perform various actions such as running commands, uploading and downloading files, and terminating processes. You can disable the ability to use the Live Terminal feature in Cortex XDR by configuring the Agent Settings Profile. The Agent Settings Profile defines the behavior and functionality of the Cortex XDR agent on the endpoint. You can create different profiles for different groups of endpoints and assign them accordingly. To disable the Live Terminal feature, you need to uncheck the Enable Live Terminal option in the Agent Settings Profile and save the changes. This will prevent the Cortex XDR agent from accepting any Live Terminal requests from the Cortex XDR management console. References: Live Terminal: This document explains how to use the Live Terminal feature to investigate and respond to security events on Windows endpoints. Agent Settings Profile: This document describes how to create and manage Agent Settings Profiles to define the behavior and functionality of the Cortex XDR agent on the endpoint.

• Question 67:

  Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATTandCKTM techniques.

  A. Exfiltration, Command and Control, Collection
  B. Exfiltration, Command and Control, Privilege Escalation
  C. Exfiltration, Command and Control, Impact
  D. Exfiltration, Command and Control, Lateral Movement
  D. Exfiltration, Command and Control, Lateral Movement

  ---

  Explanation/Reference:

  Cortex XDR Analytics is a feature of Cortex XDR that leverages machine learning and behavioral analytics to detect and alert on malicious activity across the network and endpoint layers. Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATTandCKTM techniques: Exfiltration, Command and Control, Lateral Movement, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, and Collection. However, among the options given in the question, the correct answer is D, Exfiltration, Command and Control, Lateral Movement. These are three of the most critical techniques that indicate an advanced and persistent threat (APT) in the environment. Exfiltration refers to the technique of transferring data or information from the compromised system or network to an external location controlled by the adversary. Command and Control refers to the technique of communicating with the compromised system or network to provide instructions, receive data, or update malware. Lateral Movement refers to the technique of moving from one system or network to another within the same environment, usually to gain access to more resources or data. Cortex XDR Analytics can alert on these techniques by analyzing various data sources, such as network traffic, firewall logs, endpoint events, and threat intelligence, and applying behavioral models, anomaly detection, and correlation rules. Cortex XDR Analytics can also map the alerts to the corresponding MITRE ATTandCKTM techniques and provide additional context and visibility into the attack chain1234 References: Cortex XDR Analytics MITRE ATTandCKTM Cortex XDR Analytics MITRE ATTandCKTM Techniques Cortex XDR Analytics Alert Categories

• Question 68:

  In the Cortex XDR console, from which two pages are you able to manually perform the agent upgrade action? (Choose two.)

  A. Asset Management
  B. Agent Installations
  C. Action Center
  D. Endpoint Administration
  A. Asset Management
  D. Endpoint Administration

  ---

  Explanation/Reference:

  To manually upgrade the Cortex XDR agents, you can use the Asset Management page or the Endpoint Administration page in the Cortex XDR console. On the Asset Management page, you can select one or more endpoints and click Actions > Upgrade Agent. On the Endpoint Administration page, you can select one or more agent versions and click Upgrade. You can also schedule automatic agent upgrades using the Agent Installations page. References: Asset Management Endpoint Administration Agent Installations

• Question 69:

  After scan, how does file quarantine function work on an endpoint?

  A. Quarantine takes ownership of the files and folders and prevents execution through access control.
  B. Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.
  C. Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.
  D. Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.
  C. Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

  ---

  Explanation/Reference:

  Quarantine is a feature of Cortex XDR that allows you to isolate a malicious file from its original location and prevent it from being executed. Quarantine works by moving the file to a protected folder on the endpoint and changing its permissions and attributes. Quarantine can be applied to files detected by periodic scans or by behavioral threat protection (BTP) rules. Quarantine is only supported for portable executable (PE) and dynamic link library (DLL) files. Quarantine does not affect the network connectivity or the communication of the endpoint with Cortex XDR. References: Quarantine Malicious Files Manage Quarantined Files

• Question 70:

  Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

  A. Security Manager Dashboard
  B. Data Ingestion Dashboard
  C. Security Admin Dashboard D. Incident Management Dashboard
  D

  ---

  Explanation/Reference:

  The Incident Management Dashboard provides a high-level overview of the incident response process, including the Mean Time to Resolution (MTTR) metric. This metric measures the average time it takes to resolve an incident from the moment it is created to the moment it is closed. The dashboard also shows the number of incidents by status, severity, and assigned analyst, as well as the top alerts by category, source, and destination. The Incident Management Dashboard is designed for executives and managers who want to monitor the performance and efficiency of their security teams. References: [PCDRA Study Guide], page 18.