Palo Alto Networks PCDRA Online Practice Questions and Exam Preparation

Palo Alto Networks PCDRA Online Questions & Answers

• Question 71:

  To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

  A. causality_chain
  B. endpoint_name
  C. threat_event
  D. event_type
  D. event_type

  ---

  Explanation/Reference:

  To create a BIOC rule with XQL query, you must at a minimum filter on the event_type field in order for it to be a valid BIOC rule. The event_type field indicates the type of event that triggered the alert, such as PROCESS, FILE, REGISTRY, NETWORK, or USER_ACCOUNT. Filtering on this field helps you narrow down the scope of your query and focus on the relevant events for your use case. Other fields, such as causality_chain, endpoint_name, threat_event, are optional and can be used to further refine your query or display additional information in the alert. References: Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 9 Palo Alto Networks Cortex XDR Documentation, BIOC Rule Query Syntax

• Question 72:

  Which module provides the best visibility to view vulnerabilities?

  A. Live Terminal module
  B. Device Control Violations module
  C. Host Insights module
  D. Forensics module
  C. Host Insights module

  ---

  Explanation/Reference:

  The Host Insights module provides the best visibility to view vulnerabilities on your endpoints. The Host Insights module is an add-on feature for Cortex XDR that combines vulnerability management, application and system visibility, and a Search and Destroy feature to help you identify and contain threats. The vulnerability management feature allows you to scan your Windows endpoints for known vulnerabilities and missing patches, and view the results in the Cortex XDR console. You can also filter and sort the vulnerabilities by severity, CVSS score, CVE ID, or patch availability. The Host Insights module helps you reduce your exposure to threats and improve your security posture. References: Host Insights Vulnerability Management

• Question 73:

  Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

  A. exception profiles that apply to specific endpoints
  B. agent exception profiles that apply to specific endpoints
  C. global exception profiles that apply to all endpoints
  D. role-based profiles that apply to specific endpoints
  B. agent exception profiles that apply to specific endpoints
  C. global exception profiles that apply to all endpoints

  ---

  Explanation/Reference:

  Cortex XDR allows you to create two types of exception profiles: agent exception profiles and global exception profiles. Agent exception profiles apply to specific endpoints that are assigned to the profile. Global exception profiles apply to all endpoints in your network. You can use exception profiles to configure different types of exceptions, such as process exceptions, support exceptions, behavioral threat protection rule exceptions, local analysis rules exceptions, advanced analysis exceptions, or digital signer exceptions. Exception profiles help you fine-tune the security policies for your endpoints and reduce false positives. References: Exception Security Profiles Create an Agent Exception Profile Create a Global Exception Profile

• Question 74:

  When is the wss (WebSocket Secure) protocol used?

  A. when the Cortex XDR agent downloads new security content
  B. when the Cortex XDR agent uploads alert data
  C. when the Cortex XDR agent connects to WildFire to upload files for analysis
  D. when the Cortex XDR agent establishes a bidirectional communication channel
  D. when the Cortex XDR agent establishes a bidirectional communication channel

  ---

  Explanation/Reference:

  The WSS (WebSocket Secure) protocol is an extension of the WebSocket protocol that provides a secure communication channel over the internet. It is used to establish a persistent, full-duplex communication channel between a client (in this case, the Cortex XDR agent) and a server (such as the Cortex XDR management console or other components). The Cortex XDR agent uses the WSS protocol to establish a secure and real-time bidirectional communication channel with the Cortex XDR management console or other components in the Palo Alto Networks security ecosystem. This communication channel allows the agent to send data, such as security events, alerts, and other relevant information, to the management console, and receive commands, policy updates, and responses in return. By using the WSS protocol, the Cortex XDR agent can maintain a persistent connection with the management console, which enables timely communication of security-related information and allows for efficient incident response and remediation actions. It's important to note that the other options mentioned in the question also involve communication between the CortexXDR agent and various components, but they do not specifically mention the use of the WSS protocol. For example:

  A. The Cortex XDR agent downloading new security content typically utilizes protocols like HTTP or HTTPS.

  B. When the Cortex XDR agent uploads alert data, it may use protocols like HTTP or HTTPS to transmit the data securely.

  C. When the Cortex XDR agent connects to WildFire to upload files for analysis, it typically uses protocols like HTTP or HTTPS. Therefore, the correct answer is D, when the Cortex XDR agent establishes a bidirectional communication channel. References: Device communication protocols ?AWS IoT Core WebSocket ?Wikipedia Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) ?Palo Alto Networks [What are WebSockets? | Web Security Academy] [Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification exam practice question and answer (QandA) dump with detail explanation and reference available free, helpful to pass the Palo Alto Networks Certified Detection and Remediation Analyst PCDRA exam and earn Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification.]

• Question 75:

  Which of the following represents a common sequence of cyber-attack tactics?

  A. Actions on the objective » Reconnaissance »Weaponizationand Delivery » Exploitation » Installation » Command and Control
  B. Installation >> Reconnaissance »Weaponizationand Delivery » Exploitation » Command and Control » Actions on the objective
  C. Reconnaissance »Weaponizationand Delivery » Exploitation » Installation » Command and Control » Actions on the objective
  D. Reconnaissance >> Installation »Weaponizationand Delivery » Exploitation » Command and Control » Actions on the objective
  C. Reconnaissance »Weaponizationand Delivery » Exploitation » Installation » Command and Control » Actions on the objective

  ---

  Explanation/Reference:

  A common sequence of cyber-attack tactics is based on the Cyber Kill Chain model, which describes the stages of a cyber intrusion from the perspective of the attacker. The Cyber Kill Chain model consists of seven phases: reconnaissance,

  weaponization, delivery, exploitation, installation, command and control, and actions on the objective.

  These phases are briefly explained below:

  Reconnaissance: The attacker gathers information about the target, such as its network, systems, vulnerabilities, employees, and business operations. The attacker may use various methods, such as scanning, phishing, or searching open

  sources, to collect data that can help them plan the attack. Weaponization: The attacker creates or obtains a malicious payload, such as malware, exploit, or script, that can be used to compromise the target. The attacker may also embed the

  payload into a delivery mechanism, such as an email attachment, a web link, or a removable media.

  Delivery: The attacker sends or delivers the weaponized payload to the target, either directly or indirectly. The attacker may use various channels, such as email, web, or physical access, to reach the target's network or system. Exploitation:

  The attacker exploits a vulnerability or weakness in the target's network or system to execute the payload. The vulnerability may be technical, such as a software flaw, or human, such as a social engineering trick. Installation: The attacker

  installs or drops additional malware or tools on the target's network or system to establish a foothold and maintain persistence. The attacker may use various techniques, such as registry modification, file manipulation, or process injection, to

  hide their presence and evade detection. Command and Control: The attacker establishes a communication channel between the compromised target and a remote server or controller. The attacker may use various protocols, such as HTTP,

  DNS, or IRC, to send commands and receive data from the target.

  Actions on the objective: The attacker performs the final actions that achieve their goal, such as stealing data, destroying files, encrypting systems, or disrupting services. The attacker may also try to move laterally within the target's network

  or system to access more resources or data.

  References:

  Cyber Kill Chain: This document explains the Cyber Kill Chain model and how it can be used to analyze and respond to cyberattacks. Cyber Attack Tactics: This document provides an overview of some common cyber attack tactics and

  examples of how they are used by threat actors.

• Question 76:

  A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?

  A. Manually remediate the problem on the endpoint in question.
  B. Open X2go from the Cortex XDR console and delete the file via X2go.
  C. Initiate Remediate Suggestions to automatically delete the file.
  D. Open an NFS connection from the Cortex XDR console and delete the file.
  C. Initiate Remediate Suggestions to automatically delete the file.

  ---

  Explanation/Reference:

  The best action to delete the file on the Linux endpoint is to initiate Remediation Suggestions from the Cortex XDR console. Remediation Suggestions are a feature of Cortex XDR that provide you with recommended actions to undo the

  effects of malicious activity on your endpoints. You can view the remediation suggestions for each alert or incident in the Cortex XDR console, and decide whether to apply them or not. Remediation Suggestions can help you restore the

  endpoint to its original state, remove malicious files or processes, or fix registry or system settings. Remediation Suggestions are based on the forensic data collected by the Cortex XDR agent and the analysis performed by Cortex XDR.

  The other options are incorrect for the following reasons:

  A is incorrect because manually remediating the problem on the endpoint is not a convenient or efficient way to delete the file. Manually remediating the problem would require you to access the endpoint directly, log in as root, locate the file,

  and delete it. This would also require you to have the necessary permissions and credentials to access the endpoint, and to know the exact path and name of the file. Manually remediating the problem would also not provide you with any

  audit trail or confirmation of the deletion.

  B is incorrect because opening X2go from the Cortex XDR console is not a supported or secure way to delete the file. X2go is a third-party remote desktop software that allows you to access Linux endpoints from a graphical user interface.

  However, X2go is not integrated with Cortex XDR, and using it would require you to install and configure it on both the Cortex XDR console and the endpoint. Using X2go would also expose the endpoint to potential network attacks or

  unauthorized access, and would not provide you with any audit trail or confirmation of the deletion.

  D is incorrect because opening an NFS connection from the Cortex XDR console is not a feasible or reliable way to delete the file. NFS is a network file system protocol that allows you to access files on remote servers as if they were local.

  However, NFS is not integrated with Cortex XDR, and using it would require you to set up and maintain an NFS server and client on both the Cortex XDR console and the endpoint. Using NFS would also depend on the network availability

  and performance, and would not provide you with any audit trail or confirmation of the deletion.

  References:

  Remediation Suggestions

  Apply Remediation Suggestions

• Question 77:

  Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

  A. in the macOS Malware Protection Profile to indicate allowed signers
  B. in the Linux Malware Protection Profile to indicate allowed Java libraries
  C. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles
  D. in the Windows Malware Protection Profile to indicate allowed executables
  D. in the Windows Malware Protection Profile to indicate allowed executables

  ---

  Explanation/Reference:

  Cortex XDR Malware Protection Profiles allow you to configure the malware prevention settings for Windows, Linux, and macOS endpoints. You can use SHA256 hash values in the Windows Malware Protection Profile to indicate allowed executables that you want to exclude from malware scanning. This can help you reduce false positives and improve performance by skipping the scanning of known benign files. You can add up to 1000 SHA256 hash values per profile. You cannot use SHA256 hash values in the Linux or macOS Malware Protection Profiles, but you can use other criteria such as file path, file name, or signer to exclude files from scanning. References: Malware Protection Profiles Configure a Windows Malware Protection Profile PCDRA Study Guide

• Question 78:

  Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

  A. a hierarchical database that stores settings for the operating system and for applications
  B. a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the "swap"
  C. a central system, available via the internet, for registering officially licensed versions of software to prove ownership
  D. a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system
  A. a hierarchical database that stores settings for the operating system and for applications

  ---

  Explanation/Reference:

  The Windows Registry is a hierarchical database that stores settings for the operating system and for applications that run on Windows. The registry contains information, settings, options, and other values for programs and hardware installed on all versions of Microsoft Windows operating systems. The registry is organized into five main sections, called hives, each of which contains keys, subkeys, and values. The Cortex XDR agent uses the registry to store its configuration, status, and logs, as well as to monitor and control the endpoint's security features. The Cortex XDR agent also allows you to run scripts that can read, write, or delete registry keys and values on the endpoint. References : Windows Registry - Wikipedia Registry Operations

• Question 79:

  When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?

  A. Pending
  B. It is blank
  C. Unassigned
  D. New
  C. Unassigned

  ---

  Explanation/Reference:

  The "assigned to" field value of a new incident that was just reported to Cortex is "Unassigned". This means that the incident has not been assigned to any analyst or group yet, and it is waiting for someone to take ownership of it. The "assigned to" field is one of the default fields that are displayed in the incident layout, and it can be used to filter and sort incidents in the incident list. The "assigned to" field can be changed manually by an analyst, or automatically by a playbook or a rule12. Let's briefly discuss the other options to provide a comprehensive explanation:

  A. Pending: This is not the correct answer. Pending is not a valid value for the "assigned to" field. Pending is a possible value for the "status" field, which indicates the current state of the incident. The status field can have values such as

  "New", "Active", "Done", "Closed", or "Pending"3.

  B. It is blank: This is not the correct answer. The "assigned to" field is never blank for any incident. It always has a default value of "Unassigned" for new incidents, unless a playbook or a rule assigns it to a specific analyst or group12. D. New:

  This is not the correct answer. New is not a valid value for the "assigned to" field. New is a possible value for the "status" field, which indicates the current state of the incident. The status field can have values such as "New", "Active", "Done",

  "Closed", or "Pending"3.

  In conclusion, the "assigned to" field value of a new incident that was just reported to Cortex is "Unassigned". This field can be used to manage the ownership and responsibility of incidents, and it can be changed manually or automatically.

  References:

  Cortex XDR Pro Admin Guide: Manage Incidents

  Cortex XDR Pro Admin Guide: Assign Incidents

  Cortex XDR Pro Admin Guide: Update Incident Status

• Question 80:

  What should you do to automatically convert leads into alerts after investigating a lead?

  A. Lead threats can't be prevented in the future because they already exist in the environment.
  B. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
  C. Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
  D. Build a search query using Query Builder or XQL using a list of lOCs.
  B. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

  ---

  Explanation/Reference:

  To automatically convert leads into alerts after investigating a lead, you should create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting. IOC rules are used to detect

  known threats based on indicators of compromise (IOCs) such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can prevent future occurrences of the same threats and generate alerts for them.

  References:

  PCDRA Study Guide, page 25

  Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2 Cortex XDR Documentation, section "Create IOC Rules"