View All PCDRA Actual Exam Questions Answers and Explanations for Free Aug-2022 [Q35-Q58]

Rate this post

View All PCDRA Actual Exam Questions Answers and Explanations for Free Aug-2022

The Most In-Demand Palo Alto Networks PCDRA Pass Guaranteed Quiz

Palo Alto Networks PCDRA Exam Syllabus Topics:

Topic	Details
Topic 1	Define product modules that help identify threats Summarize the generally available references for vulnerabilities
Topic 2	Describe how to use the Broker as a proxy between the agents and XDR in the Cloud Describe details of the ingestion methods
Topic 3	Identify common investigation screens and processes Describe what actions can be performed using the live terminal
Topic 4	Outline distributing and scheduling capabilities of Cortex XDR Identify the information needed for a given audience
Topic 5	Identify the connection of analytic detection capabilities to MITRE List the options to highlight or suppress incidents
Topic 6	Describe how to use XDR to prevent supply chain attacks Categorize the types and structures of vulnerabilities
Topic 7	Characterize the differences between incidents and alerts Identify the investigation capabilities of Cortex XDR
Topic 8	Define communication options channels to and from the client Distinguish between different proxies
Topic 9	Identify the use of malware prevention modules (MPMs) Identify the profiles that must be configured for malware prevention
Topic 10	Differentiate between exploits and malware Outline ransomware threats Recognize the different types of attacks
Topic 11	Identify legitimate threats (true positives) vs. illegitimate threats (false positives) Outline incident collaboration and management using XDR

QUESTION 35
Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response –> Action Center

under the gear icon –> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

QUESTION 36
With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

QUESTION 37
In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

Create a custom XQL widget

This is not currently supported

Create a custom report and filter on starred incidents

Click the star in the widget

Reference:
%20you%20clear%20the%20star

QUESTION 38
Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

QUESTION 39
What is the purpose of targeting software vendors in a supply-chain attack?

to take advantage of a trusted software delivery method.

to steal users’ login credentials.

to access source code.

to report Zero-day vulnerabilities.

QUESTION 40
When creating a scheduled report which is not an option?

Run weekly on a certain day and time.

Run quarterly on a certain day and time.

Run monthly on a certain day and time.

Run daily at a certain time (selectable hours and minutes).

QUESTION 41
Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

QUESTION 42
You can star security events in which two ways? (Choose two.)

Create an alert-starring configuration.

Create an Incident-starring configuration.

Manually star an alert.

Manually star an Incident.

QUESTION 43
What kind of the threat typically encrypts user files?

ransomware

SQL injection attacks

Zero-day exploits

supply-chain attacks

QUESTION 44
What is the purpose of the Unit 42 team?

Unit 42 is responsible for automation and orchestration of products

Unit 42 is responsible for the configuration optimization of the Cortex XDR server

Unit 42 is responsible for threat research, malware analysis and threat hunting

Unit 42 is responsible for the rapid deployment of Cortex XDR agents

QUESTION 45
Which statement regarding scripts in Cortex XDR is true?

Any version of Python script can be run.

The level of risk is assigned to the script upon import.

Any script can be imported including Visual Basic (VB) scripts.

The script is run on the machine uploading the script to ensure that it is operational.

QUESTION 46
Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Hash Verdict Determination

Behavioral Threat Protection

Restriction Policy

Child Process Protection

Cortex XDR agent offers a complete prevention stack with cutting-edge protection for exploits, malware, ransomware, and fileless attacks. It includes the broadest set of exploit protection modules available to block the exploits that lead to malware infections. Every file is examined by an adaptiveAI-driven local analysis engine that’s always learning to counter new attack techniques. A BehavioralThreat Protection engine examines the behavior of multiple, related processes to uncover attacks as they occur. Integration with the Palo Alto Networks WildFire® malware prevention service boosts security accuracy and coverage.

QUESTION 47
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

causality_chain

endpoint_name

threat_event

event_type

QUESTION 48
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

QUESTION 49
Which statement best describes how Behavioral Threat Protection (BTP) works?

BTP injects into known vulnerable processes to detect malicious activity.

BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.

BTP matches EDR data with rules provided by Cortex XDR.

BTP uses machine Learning to recognize malicious activity even if it is not known.

QUESTION 50
An attacker tries to load dynamic libraries on macOS from an unsecure location. Which Cortex XDR module can prevent this attack?

DDL Security

Hot Patch Protection

Kernel Integrity Monitor (KIM)

Dylib Hijacking

Reference:
%20process

QUESTION 51
Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

Sensor Engine

Causality Analysis Engine

Log Stitching Engine

Causality Chain Engine

QUESTION 52
A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?

Manually remediate the problem on the endpoint in question.

Open X2go from the Cortex XDR console and delete the file via X2go.

Initiate Remediate Suggestions to automatically delete the file.

Open an NFS connection from the Cortex XDR console and delete the file.

QUESTION 53
Which Type of IOC can you define in Cortex XDR?

destination port

e-mail address

full path

App-ID

QUESTION 54
What is the standard installation disk space recommended to install a Broker VM?

1GB disk space

2GB disk space

512GB disk space

256GB disk space

QUESTION 55
Which module provides the best visibility to view vulnerabilities?

Live Terminal module

Device Control Violations module

Host Insights module

Forensics module

Host Insights, an add-on module for Cortex XDR, combines vulnerability assessment, application and system visibility, and a powerful Search and Destroy feature to help you identify and contain threats. Vulnerability Assessment provides you real-time visibility into vulnerability exposure and current patch levels across your end-points. Host inventory presents detailed information about your host applications and settings whileSearch and Destroy lets you swiftly find and eradicate threats across all endpoints. Host Insights offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breached.

QUESTION 56
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

Enable DLL Protection on all endpoints but there might be some false positives.

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.

No step is required because the malicious document is already stopped.

QUESTION 57
What license would be required for ingesting external logs from various vendors?

Cortex XDR Pro per Endpoint

Cortex XDR Vendor Agnostic Pro

Cortex XDR Pro per TB

Cortex XDR Cloud per Host

QUESTION 58
What is the outcome of creating and implementing an alert exclusion?

The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

The Cortex XDR console will hide those alerts.

The Cortex XDR agent will not create an alert for this event in the future.

The Cortex XDR console will delete those alerts and block ingestion of them in the future.

Loading …

PCDRA Free Certification Exam Material with 62 Q&As : https://www.test4cram.com/PCDRA_real-exam-dumps.html

Palo Alto Networks PCDRA Exam Syllabus Topics:

Leave a Reply Cancel reply