Get Prepared for Your PCDRA Exam With Actual 93 Questions [Q35-Q55]

4.3/5 - (3 votes)

Get Prepared for Your PCDRA Exam With Actual 93 Questions

Valid PCDRA Test Answers Full-length Practice Certification Exams

The PCDRA certification exam covers a range of topics, including malware analysis, threat intelligence, incident response, and network forensics. Candidates will be tested on their ability to identify and analyze threats, develop and implement remediation strategies, and utilize Palo Alto Networks products to effectively manage security incidents. Achieving this certification demonstrates a strong understanding of security best practices, as well as the ability to effectively respond to security incidents and protect critical business assets.

NO.35 What is the purpose of the Cortex Data Lake?

a local storage facility where your logs and alert data can be aggregated

a cloud-based storage facility where your firewall logs are stored

the interface between firewalls and the Cortex XDR agents

the workspace for your Cortex XDR agents to detonate potential malware files

NO.36 When is the wss (WebSocket Secure) protocol used?

when the Cortex XDR agent downloads new security content

when the Cortex XDR agent uploads alert data

when the Cortex XDR agent connects to WildFire to upload files for analysis

when the Cortex XDR agent establishes a bidirectional communication channel

NO.37 Which statement is true for Application Exploits and Kernel Exploits?

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.

NO.38 Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

NO.39 Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Hash Verdict Determination

Behavioral Threat Protection

Restriction Policy

Child Process Protection

NO.40 While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

NO.41 Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

exception profiles that apply to specific endpoints

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

role-based profiles that apply to specific endpoints

NO.42 After scan, how does file quarantine function work on an endpoint?

Quarantine takes ownership of the files and folders and prevents execution through access control.

Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

NO.43 Which module provides the best visibility to view vulnerabilities?

Live Terminal module

Device Control Violations module

Host Insights module

Forensics module

NO.44 Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response –> Action Center

under the gear icon –> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

NO.45 What should you do to automatically convert leads into alerts after investigating a lead?

Lead threats can’t be prevented in the future because they already exist in the environment.

Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Build a search query using Query Builder or XQL using a list of lOCs.

NO.46 When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

Remediation Automation

Machine Remediation

Automatic Remediation

Remediation Suggestions

NO.47 Which of the following is NOT a precanned script provided by Palo Alto Networks?

delete_file

quarantine_file

process_kill_name

list_directories

NO.48 As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

Enable DLL Protection on all endpoints but there might be some false positives.

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.

No step is required because the malicious document is already stopped.

Explanation
The correct answer is B, create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
BTP rules are a powerful feature of Cortex XDR that allow you to define custom rules to detect and block malicious behaviors on endpoints. You can use BTP rules to create indicators of compromise (IOCs) based on file attributes, registry keys, processes, network connections, and other criteria. By creating BTP rules, you can prevent the same malicious Word document from being opened by other users in your organization, even if the document has a different name or hash value. BTP rules are updated through content updates and can be managed from the Cortex XDR console.
The other options are incorrect for the following reasons:
* A is incorrect because enabling DLL Protection on all endpoints is not a specific or effective way to prevent the malicious Word document. DLL Protection is a feature of Cortex XDR that prevents the loading of unsigned or untrusted DLLs by protected processes. However, this feature does not apply to Word documents or macros, and may cause false positives or compatibility issues with legitimate applications.
* C is incorrect because relying on Cortex to share IOCs with the Cyber Threat Alliance members is not a proactive or sufficient way to prevent the malicious Word document. The Cyber Threat Alliance is a group of cybersecurity vendors that share threat intelligence and best practices to improve their products and services. However, not all vendors are members of the alliance, and not all IOCs are shared or updated in a timely manner. Therefore, you cannot assume that other users in your organization are protected by the same IOCs as Cortex XDR.
* D is incorrect because doing nothing is not a responsible or secure way to prevent the malicious Word document. Even though Cortex XDR agent prevented the attempt to open the document on one endpoint, it does not mean that the document is no longer a threat. The document may still be circulating in your network or email system, and may be opened by other users who have different agent profiles or policies. Therefore, you should take steps to identify and block the document across your organization.
References:
* Cortex XDR Agent Administrator Guide: Behavioral Threat Protection
* Cortex XDR Agent Administrator Guide: DLL Protection
* Palo Alto Networks: Cyber Threat Alliance

NO.49 While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

NO.50 What is the function of WildFire for Cortex XDR?

WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.

WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.

WildFire accepts and analyses a sample to provide a verdict.

WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.

NO.51 Which Exploit ProtectionModule (EPM) can be used to prevent attacks based on OS function?

UASLR

JIT Mitigation

Memory Limit Heap Spray Check

DLL Security

NO.52 What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automatically block the IP addresses involved in malicious traffic.

NO.53 What motivation do ransomware attackers have for returning access to systems once their victims have paid?

There is organized crime governance among attackers that requires the return of access to remain in good standing.

Nation-states enforce the return of system access through the use of laws and regulation.

Failure to restore access to systems undermines the scheme because others will not believe their valuables would be returned.

The ransomware attackers hope to trace the financial trail back and steal more from traditional banking institutions. –

NO.54 What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automatically block the IP addresses involved in malicious traffic.

NO.55 In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

To prepare for the PCDRA certification exam, candidates can take a training course offered by Palo Alto Networks or study the exam objectives and recommended resources. PCDRA exam can be taken at a Pearson VUE testing center or online with remote proctoring. Achieving the PCDRA certification demonstrates an individual’s commitment to staying up-to-date with the latest cybersecurity threats and technologies, and can enhance their career prospects in the cybersecurity field.

Accurate & Verified 2024 New PCDRA Answers As Experienced in the Actual Test!: https://www.dumpsreview.com/PCDRA-exam-dumps-review.html