Free PCDRA Exam Study Guide for the NEW [Mar-2024] Dumps Test Engine
PCDRA PDF Dumps Extremely Quick Way Of Preparation
NEW QUESTION # 43
Which profiles can the user use to configure malware protection in the Cortex XDR console?
- A. Malware profile
- B. Malware Detection profile
- C. Malware Protection profile
- D. Anti-Malware profile
Answer: A
NEW QUESTION # 44
Which of the following represents the correct relation of alerts to incidents?
- A. Only alerts with the same host are grouped together into one Incident in a given time frame.
- B. Every alert creates a new Incident.
- C. Alerts that occur within athree-hourtime frame are grouped together into one Incident.
- D. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.
Answer: D
NEW QUESTION # 45
When creating a BIOC rule, which XQL query can be used?
- A. dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" - B. dataset = xdr_data
| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
| fields action_process_image - C. dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" - D. dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
Answer: A
Explanation:
Explanation
A BIOC rule is a custom detection rule that uses the Cortex Query Language (XQL) to define the behavior or actions that indicate a potential threat. A BIOC rule can use the xdr_data and cloud_audit_log datasets and presets for these datasets. A BIOC rule can also use the filter stage, alter stage, and functions without any aggregations in the XQL query. The query must return a single field named action_process_image, which is the process image name of the suspicious process. The query must also include the event_type and event_sub_type fields in the filter stage to specify the type and sub-type of the event that triggers the rule.
Option B is the correct answer because it meets all the requirements for a valid BIOC rule query. It uses the xdr_data dataset, the filter stage, the event_type and event_sub_type fields, and the action_process_image_name field with a regular expression to match any process image name that ends with
.pdf.exe or .docx.exe, which are common indicators of malicious files.
Option A is incorrect because it does not include the event_type field in the filter stage, which is mandatory for a BIOC rule query.
Option C is incorrect because it does not include the event_type and event_sub_type fields in the filter stage, and it uses the fields stage, which is not supported for a BIOC rule query. It also returns the action_process_image field instead of the action_process_image_name field, which is the expected output for a BIOC rule query.
Option D is incorrect because it uses the event_behavior field, which is not supported for a BIOC rule query. It also does not include the event_type field in the filter stage, and it uses the event_sub_type field incorrectly.
The event_sub_type field should be equal to PROCESS_START, not true.
References:
* Working with BIOCs
* Cortex Query Language (XQL) Reference
NEW QUESTION # 46
How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?
- A. by utilizing decoy Files.
- B. by patching vulnerable applications.
- C. by encrypting the disk first.
- D. by retrieving the encryption key.
Answer: A
Explanation:
Explanation
Cortex XDR agent for Windows prevents ransomware attacks from compromising the file system by utilizing decoy files. Decoy files are randomly generated files that are placed in strategic locations on the endpoint, such as the user's desktop, documents, and pictures folders. These files are designed to look like valuable data that ransomware would target for encryption. When Cortex XDR agent detects that a process is attempting to access or modify a decoy file, it immediately blocks the process and alerts the administrator. This way, Cortex XDR agent can stop ransomware attacks before they can cause any damage to the real files on the endpoint.
References:
* Anti-Ransomware Protection
* PCDRA Study Guide
NEW QUESTION # 47
Which Type of IOC can you define in Cortex XDR?
- A. App-ID
- B. destination port
- C. full path
- D. e-mail address
Answer: C
Explanation:
Explanation
Cortex XDR allows you to define IOCs based on various criteria, such as file hashes, registry keys, IP addresses, domain names, and full paths. A full path IOC is a specific location of a file or folder on an endpoint, such as C:\Windows\System32\calc.exe. You can use full path IOCs to detect and respond to malicious files or folders that are located in known locations on your endpoints12.
Let's briefly discuss the other options to provide a comprehensive explanation:
A: destination port: This is not the correct answer. Destination port is not a type of IOC that you can define in Cortex XDR. Destination port is a network attribute that indicates the port number to which a packet is sent. Cortex XDR does not support defining IOCs based on destination ports, but you can use XQL queries to filter network events by destination ports3.
B: e-mail address: This is not the correct answer. E-mail address is not a type of IOC that you can define in Cortex XDR. E-mail address is an identifier that is used to send and receive e-mails. Cortex XDR does not support defining IOCs based on e-mail addresses, but you can use the Cortex XDR - IOC integration with Cortex XSOAR to ingest IOCs from various sources, including e-mail addresses4.
D: App-ID: This is not the correct answer. App-ID is not a type of IOC that you can define in Cortex XDR.
App-ID is a feature of Palo Alto Networks firewalls that identifies and controls applications on the network. Cortex XDR does not support defining IOCs based on App-IDs, but you can use the Cortex XDR Analytics app to create custom rules that use App-IDs as part of the rule logic5.
In conclusion, full path is the type of IOC that you can define in Cortex XDR. By using full path IOCs, you can enhance your detection and response capabilities and protect your endpoints from malicious files or folders.
References:
* Create an IOC Rule
* XQL Reference Guide: Network Events Schema
* Cortex XDR - IOC
* Cortex XDR Analytics App
* PCDRA: Which Type of IOC can define in Cortex XDR?
NEW QUESTION # 48
What license would be required for ingesting external logs from various vendors?
- A. Cortex XDR Pro per TB
- B. Cortex XDR Cloud per Host
- C. Cortex XDR Pro per Endpoint
- D. Cortex XDR Vendor Agnostic Pro
Answer: A
Explanation:
Explanation
To ingest external logs from various vendors, you need a Cortex XDR Pro per TB license. This license allows you to collect and analyze logs from Palo Alto Networks and third-party sources, such as firewalls, proxies, endpoints, cloud services, and more. You can use the Log Forwarding app to forward logs from the Logging Service to an external syslog receiver. The Cortex XDR Pro per Endpoint license only supports logs from Cortex XDR agents installed on endpoints. The Cortex XDR Vendor Agnostic Pro and Cortex XDR Cloud per Host licenses do not exist. References:
* Features by Cortex XDR License Type
* Log Forwarding App for Cortex XDR Analytics
* SaaS Log Collection
NEW QUESTION # 49
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?
- A. Security Admin Dashboard
- B. Security Manager Dashboard
- C. Incident Management Dashboard
- D. Data Ingestion Dashboard
Answer: C
Explanation:
Explanation
The Incident Management Dashboard provides a high-level overview of the incident response process, including the Mean Time to Resolution (MTTR) metric. This metric measures the average time it takes to resolve an incident from the moment it is created to the moment it is closed. The dashboard also shows the number of incidents by status, severity, and assigned analyst, as well as the top alerts by category, source, and destination. The Incident Management Dashboard is designed for executives and managers who want to monitor the performance and efficiency of their security teams. References: [PCDRA Study Guide], page 18.
NEW QUESTION # 50
Can you disable the ability to use the Live Terminal feature in Cortex XDR?
- A. No, it is a required feature of the agent.
- B. Yes, via the Cortex XDR console or with an installation switch.
- C. Yes, via Agent Settings Profile.
- D. No, a separate installer package without Live Terminal is required.
Answer: C
Explanation:
Explanation
The Live Terminal feature in Cortex XDR allows you to initiate a remote connection to an endpoint and perform various actions such as running commands, uploading and downloading files, and terminating processes. You can disable the ability to use the Live Terminal feature in Cortex XDR by configuring the Agent Settings Profile. The Agent Settings Profile defines the behavior and functionality of the Cortex XDR agent on the endpoint. You can create different profiles for different groups of endpoints and assign them accordingly. To disable the Live Terminal feature, you need to uncheck the Enable Live Terminal option in the Agent Settings Profile and save the changes. This will prevent the Cortex XDR agent from accepting any Live Terminal requests from the Cortex XDR management console. References:
* Live Terminal: This document explains how to use the Live Terminal feature to investigate and respond to security events on Windows endpoints.
* Agent Settings Profile: This document describes how to create and manage Agent Settings Profiles to define the behavior and functionality of the Cortex XDR agent on the endpoint.
NEW QUESTION # 51
Which statement best describes how Behavioral Threat Protection (BTP) works?
- A. BTP matches EDR data with rules provided by Cortex XDR.
- B. BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.
- C. BTP uses machine Learning to recognize malicious activity even if it is not known.
- D. BTP injects into known vulnerable processes to detect malicious activity.
Answer: C
Explanation:
Explanation
The statement that best describes how Behavioral Threat Protection (BTP) works is D, BTP uses machine learning to recognize malicious activity even if it is not known. BTP is a feature of Cortex XDR that allows you to define custom rules to detect and block malicious behaviors on endpoints. BTP uses machine learning to profile behavior and detect anomalies indicative of attack. BTP can recognize malicious activity based on file attributes, registry keys, processes, network connections, and other criteria, even if the activity is not associated with any known malware or threat. BTP rules are updated through content updates and can be managed from the Cortex XDR console.
The other statements are incorrect for the following reasons:
* A is incorrect because BTP does not inject into known vulnerable processes to detect malicious activity.
BTP does not rely on process injection, which is a technique used by some malware to hide or execute code within another process. BTP monitors the behavior of all processes on the endpoint, regardless of their vulnerability status, and compares them with the BTP rules.
* B is incorrect because BTP does not run on the Cortex XDR and distribute behavioral signatures to all agents. BTP runs on the Cortex XDR agent, which is installed on the endpoint, and analyzes the endpoint data locally. BTP does not use behavioral signatures, which are predefined patterns of malicious behavior, but rather uses machine learning to identify anomalies and deviations from normal behavior.
* C is incorrect because BTP does not match EDR data with rules provided by Cortex XDR. BTP is part of the EDR (Endpoint Detection and Response) capabilities of Cortex XDR, and uses the EDR data collected by the Cortex XDR agent to perform behavioral analysis. BTP does not match the EDR data with rules provided by Cortex XDR, but rather applies the BTP rules defined by the Cortex XDR administrator or the Palo Alto Networks threat research team.
References:
* Cortex XDR Agent Administrator Guide: Behavioral Threat Protection
* Cortex XDR: Stop Breaches with AI-Powered Cybersecurity
NEW QUESTION # 52
What is the purpose of the Unit 42 team?
- A. Unit 42 is responsible for automation and orchestration of products
- B. Unit 42 is responsible for the rapid deployment of Cortex XDR agents
- C. Unit 42 is responsible for the configuration optimization of the Cortex XDR server
- D. Unit 42 is responsible for threat research, malware analysis and threat hunting
Answer: D
Explanation:
Explanation
Unit 42 is the threat intelligence and response team of Palo Alto Networks. The purpose of Unit 42 is to collect and analyze the most up-to-date threat intelligence and apply it to respond to cyberattacks. Unit 42 is composed of world-renowned threat researchers, incident responders and security consultants who help organizations proactively manage cyber risk. Unit 42 is responsible for threat research, malware analysis and threat hunting, among other activities12.
Let's briefly discuss the other options to provide a comprehensive explanation:
A: Unit 42 is not responsible for automation and orchestration of products. Automation and orchestration are capabilities that are provided by Palo Alto Networks products such as Cortex XSOAR, which is a security orchestration, automation and response platform that helps security teams automate tasks, coordinate actions and manage incidents3.
B; Unit 42 is not responsible for the configuration optimization of the Cortex XDR server. The Cortex XDR server is the cloud-based platform that provides detection and response capabilities across network, endpoint and cloud data sources. The configuration optimization of the Cortex XDR server is the responsibility of the Cortex XDR administrators, who can use the Cortex XDR app to manage the settings and policies of the Cortex XDR server4.
C: Unit 42 is not responsible for the rapid deployment of Cortex XDR agents. The Cortex XDR agents are the software components that are installed on endpoints to provide protection and visibility. The rapid deployment of Cortex XDR agents is the responsibility of the Cortex XDR administrators, who can use various methods such as group policy objects, scripts, or third-party tools to deploy the Cortex XDR agents to multiple endpoints5.
In conclusion, Unit 42 is the threat intelligence and response team of Palo Alto Networks that is responsible for threat research, malware analysis and threat hunting. By leveraging the expertise and insights of Unit 42, organizations can enhance their security posture and protect against the latest cyberthreats.
References:
* About Unit 42: Our Mission and Team
* Unit 42: Threat Intelligence & Response
* Cortex XSOAR
* Cortex XDR Pro Admin Guide: Manage Cortex XDR Settings and Policies
* Cortex XDR Pro Admin Guide: Deploy Cortex XDR Agents
NEW QUESTION # 53
What is the purpose of the Unit 42 team?
- A. Unit 42 is responsible for automation and orchestration of products
- B. Unit 42 is responsible for the rapid deployment of Cortex XDR agents
- C. Unit 42 is responsible for the configuration optimization of the Cortex XDR server
- D. Unit 42 is responsible for threat research, malware analysis and threat hunting
Answer: D
NEW QUESTION # 54
In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?
- A. Syslog Collector
- B. Agent Installer and Content Caching
- C. CSV Collector
- D. Agent Proxy
Answer: B
Explanation:
Explanation
The Agent Installer and Content Caching applet of the Broker VM is used to download and cache the Cortex XDR agent installation packages and content updates from Palo Alto Networks servers. This applet also acts as a proxy server for the Cortex XDR agents to communicate with the Cortex Data Lake and the Cortex XDR management console. To ensure secure communication between the Broker VM and the Cortex XDR agents, you are required to install a strong cipher SHA256-based SSL certificate on the Broker VM. The SSL certificate must have a common name or subject alternative name that matches the Broker VM FQDN or IP address. The SSL certificate must also be trusted by the Cortex XDR agents, either by using a certificate signed by a public CA or by manually installing the certificate on the endpoints. References:
* Agent Installer and Content Caching
* Install an SSL Certificate on the Broker VM
NEW QUESTION # 55
In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?
- A. Add the signer to the allow list under the action center page.
- B. Create a new rule exception and use the singer as the characteristic.
- C. Add the signer to the allow list in the malware profile.
- D. In the Restrictions Profile, add the file name and path to the Executable Files allow list.
Answer: C
NEW QUESTION # 56
What is the outcome of creating and implementing an alert exclusion?
- A. The Cortex XDR agent will not create an alert for this event in the future.
- B. The Cortex XDR agent will allow the process that was blocked to run on the endpoint.
- C. The Cortex XDR console will hide those alerts.
- D. The Cortex XDR console will delete those alerts and block ingestion of them in the future.
Answer: C
NEW QUESTION # 57
A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?
- A. It is true positive.
- B. It is true negative.
- C. It is false positive.
- D. It is a false negative.
Answer: C
NEW QUESTION # 58
What is the standard installation disk space recommended to install a Broker VM?
- A. 2GB disk space
- B. 512GB disk space
- C. 256GB disk space
- D. 1GB disk space
Answer: C
Explanation:
Explanation
The Broker VM for Cortex XDR is a virtual machine that serves as the central communication hub for all Cortex XDR agents deployed in your organization. It enables agents to communicate with the Cortex XDR cloud service and allows you to manage and monitor the agents' activities from a centralized location. The system requirements for the Broker VM are as follows:
* CPU: 4 cores
* RAM: 8 GB
* Disk space: 256 GB
* Network: Internet access and connectivity to all Cortex XDR agents
The disk space requirement is based on the number of agents and the frequency of content updates. The Broker VM stores the content updates locally and distributes them to the agents. The disk spacealso depends on the retention period of the content updates, which can be configured in the Broker VM settings. The default retention period is 30 days.
References:
* Broker VM for Cortex XDR
* PCDRA Study Guide
NEW QUESTION # 59
A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?
- A. Open X2go from the Cortex XDR console and delete the file via X2go.
- B. Manually remediate the problem on the endpoint in question.
- C. Open an NFS connection from the Cortex XDR console and delete the file.
- D. Initiate Remediate Suggestions to automatically delete the file.
Answer: D
Explanation:
Explanation
The best action to delete the file on the Linux endpoint is to initiate Remediation Suggestions from the Cortex XDR console. Remediation Suggestions are a feature of Cortex XDR that provide you with recommended actions to undo the effects of malicious activity on your endpoints. You can view the remediation suggestions for each alert or incident in the Cortex XDR console, and decide whether to apply them or not. Remediation Suggestions can help you restore the endpoint to its original state, remove malicious files or processes, or fix registry or system settings. Remediation Suggestions are based on the forensic data collected by the Cortex XDR agent and the analysis performed by Cortex XDR.
The other options are incorrect for the following reasons:
* A is incorrect because manually remediating the problem on the endpoint is not a convenient or efficient way to delete the file. Manually remediating the problem would require you to access the endpoint directly, log in as root, locate the file, and delete it. This would also require you to have the necessary permissions and credentials to access the endpoint, and to know the exact path and name of the file.
Manually remediating the problem would also not provide you with any audit trail or confirmation of the deletion.
* B is incorrect because opening X2go from the Cortex XDR console is not a supported or secure way to delete the file. X2go is a third-party remote desktop software that allows you to access Linux endpoints from a graphical user interface. However, X2go is not integrated with Cortex XDR, and using it would require you to install and configure it on both the Cortex XDR console and the endpoint. Using X2go would also expose the endpoint to potential network attacks or unauthorized access, and would not provide you with any audit trail or confirmation of the deletion.
* D is incorrect because opening an NFS connection from the Cortex XDR console is not a feasible or reliable way to delete the file. NFS is a network file system protocol that allows you to access files on remote servers as if they were local. However, NFS is not integrated with Cortex XDR, and using it would require you to set up and maintain an NFS server and client on both the Cortex XDR console and the endpoint. Using NFS would also depend on the network availability and performance, and would not provide you with any audit trail or confirmation of the deletion.
References:
* Remediation Suggestions
* Apply Remediation Suggestions
NEW QUESTION # 60
What is the standard installation disk space recommended to install a Broker VM?
- A. 2GB disk space
- B. 1GB disk space
- C. 512GB disk space
- D. 256GB disk space
Answer: C
NEW QUESTION # 61
Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?
- A. Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
- B. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.
- C. Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
- D. From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
Answer: B
Explanation:
Explanation
To add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint, you need to use the Action Center in Cortex XDR. The Action Center allows you to create and manage actions that apply to endpoints, such as adding files or processes to the allow list or block list, isolating or unisolating endpoints, or initiating live terminal sessions. To add a file hash to the allow list, you need to choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it. This will prevent the Malware profile from scanning or blocking the file on the endpoints that match the scope of the action. References: Cortex XDR 3: Responding to Attacks1, Action Center2
NEW QUESTION # 62
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?
- A. Security Admin Dashboard
- B. Incident Management Dashboard
- C. Security Manager Dashboard
- D. Data Ingestion Dashboard
Answer: C
NEW QUESTION # 63
What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?
- A. Pathfinder
- B. DB Collector
- C. Syslog Collector
- D. Netflow Collector
Answer: C
Explanation:
Explanation
The Broker VM is a virtual machine that acts as a data broker between third-party data sources and the Cortex Data Lake. It can ingest different types of data, such as syslog, netflow, database, and pathfinder. The Syslog Collector functionality of the Broker VM allows it to receive syslog messages from third-party devices, such as firewalls, routers, switches, and servers, and forward them to the Cortex Data Lake. The Syslog Collector can be configured to filter, parse, and enrich the syslog messages before sending them to the Cortex Data Lake. The Syslog Collector can also be used to ingest logs from third-party firewall vendors, such as Cisco, Fortinet, and Check Point, to the Cortex Data Lake. This enables Cortex XDR to analyze the firewall logs and provide visibility and threat detection across the network perimeter. References:
* Cortex XDR Data Broker VM
* Syslog Collector
* Supported Third-Party Firewall Vendors
NEW QUESTION # 64
Which module provides the best visibility to view vulnerabilities?
- A. Device Control Violations module
- B. Live Terminal module
- C. Host Insights module
- D. Forensics module
Answer: C
Explanation:
Explanation
The Host Insights module provides the best visibility to view vulnerabilities on your endpoints. The Host Insights module is an add-on feature for Cortex XDR that combines vulnerability management, application and system visibility, and a Search and Destroy feature to help you identify and contain threats. The vulnerability management feature allows you to scan your Windows endpoints for known vulnerabilities and missing patches, and view the results in the Cortex XDR console. You can also filter and sort the vulnerabilities by severity, CVSS score, CVE ID, or patch availability. The Host Insights module helps you reduce your exposure to threats and improve your security posture. References:
* Host Insights
* Vulnerability Management
NEW QUESTION # 65
Where would you view the WildFire report in an incident?
- A. under Response --> Action Center
- B. under the gear icon --> Agent Audit Logs
- C. on the HUB page at apps.paloaltonetworks.com
- D. next to relevant Key Artifacts in the incidents details page
Answer: A
NEW QUESTION # 66
Which statement is true for Application Exploits and Kernel Exploits?
- A. The ultimate goal of any exploit is to reach the kernel.
- B. The ultimate goal of any exploit is to reach the application.
- C. Kernel exploits are easier to prevent then application exploits.
- D. Application exploits leverage kernel vulnerability.
Answer: A
Explanation:
Explanation
The ultimate goal of any exploit is to reach the kernel, which is the core component of the operating system that has the highest level of privileges and access to the hardware resources. Application exploits are attacks that target vulnerabilities in specific applications, such as web browsers, email clients, or office suites. Kernel exploits are attacks that target vulnerabilities in the kernel itself, such as memory corruption, privilege escalation, or code execution. Kernel exploits are more difficult to prevent and detect than application exploits, because they can bypass security mechanisms and hide their presence from the user and the system.
References:
* Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) Study Guide, page 8
* Palo Alto Networks Cortex XDR Documentation, Exploit Protection Overview
NEW QUESTION # 67
......
Enhance your career with PCDRA PDF Dumps - True Palo Alto Networks Exam Questions: https://www.itpassleader.com/Palo-Alto-Networks/PCDRA-dumps-pass-exam.html
Download PCDRA Dumps (2024) - Free PDF Exam Demo: https://drive.google.com/open?id=1liH5oK45G-R0FX45FwK5SfQ9tGtPm3Jv