Instant Download PCDRA Dumps Q&As Provide PDF&Test Engine [Q10-Q33]

QUESTION 10
A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?

Manually remediate the problem on the endpoint in question.

Open X2go from the Cortex XDR console and delete the file via X2go.

Initiate Remediate Suggestions to automatically delete the file.

Open an NFS connection from the Cortex XDR console and delete the file.

QUESTION 11
Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Hash Verdict Determination

Behavioral Threat Protection

Restriction Policy

Child Process Protection

QUESTION 12
Which statement is true for Application Exploits and Kernel Exploits?

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.

QUESTION 13
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

Security Manager Dashboard

Data Ingestion Dashboard

Security Admin Dashboard

Incident Management Dashboard

QUESTION 14
Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

a hierarchical database that stores settings for the operating system and for applications

a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the “swap”

a central system, available via the internet, for registering officially licensed versions of software to prove ownership

a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system

QUESTION 15
What is the purpose of the Cortex Data Lake?

a local storage facility where your logs and alert data can be aggregated

a cloud-based storage facility where your firewall logs are stored

the interface between firewalls and the Cortex XDR agents

the workspace for your Cortex XDR agents to detonate potential malware files

QUESTION 16
What is the purpose of the Unit 42 team?

Unit 42 is responsible for automation and orchestration of products

Unit 42 is responsible for the configuration optimization of the Cortex XDR server

Unit 42 is responsible for threat research, malware analysis and threat hunting

Unit 42 is responsible for the rapid deployment of Cortex XDR agents

QUESTION 17
When is the wss (WebSocket Secure) protocol used?

when the Cortex XDR agent downloads new security content

when the Cortex XDR agent uploads alert data

when the Cortex XDR agent connects to WildFire to upload files for analysis

when the Cortex XDR agent establishes a bidirectional communication channel

QUESTION 18
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

Enable DLL Protection on all endpoints but there might be some false positives.

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.

No step is required because the malicious document is already stopped.

QUESTION 19
In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Agent Proxy

Agent Installer and Content Caching

Syslog Collector

CSV Collector

QUESTION 20
You can star security events in which two ways? (Choose two.)

Create an alert-starring configuration.

Create an Incident-starring configuration.

Manually star an alert.

Manually star an Incident.

QUESTION 21
How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

by encrypting the disk first.

by utilizing decoy Files.

by retrieving the encryption key.

by patching vulnerable applications.

QUESTION 22
Which statement regarding scripts in Cortex XDR is true?

Any version of Python script can be run.

The level of risk is assigned to the script upon import.

Any script can be imported including Visual Basic (VB) scripts.

The script is run on the machine uploading the script to ensure that it is operational.

QUESTION 23
Which module provides the best visibility to view vulnerabilities?

Live Terminal module

Device Control Violations module

Host Insights module

Forensics module

QUESTION 24
With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

QUESTION 25
Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

in the macOS Malware Protection Profile to indicate allowed signers

in the Linux Malware Protection Profile to indicate allowed Java libraries

SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

in the Windows Malware Protection Profile to indicate allowed executables

QUESTION 26
Which profiles can the user use to configure malware protection in the Cortex XDR console?

Malware Protection profile

Malware profile

Malware Detection profile

Anti-Malware profile

QUESTION 27
What is the function of WildFire for Cortex XDR?

WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.

WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.

WildFire accepts and analyses a sample to provide a verdict.

WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.

QUESTION 28
When creating a BIOC rule, which XQL query can be used?

dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

dataset = xdr_data
| filter action_process_image_name ~= “.*?.(?:pdf|docx).exe”
| fields action_process_image

dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

QUESTION 29
Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

QUESTION 30
Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response –> Action Center

under the gear icon –> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

QUESTION 31
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

QUESTION 32
What is the outcome of creating and implementing an alert exclusion?

The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

The Cortex XDR console will hide those alerts.

The Cortex XDR agent will not create an alert for this event in the future.

The Cortex XDR console will delete those alerts and block ingestion of them in the future.

QUESTION 33
What is the standard installation disk space recommended to install a Broker VM?

1GB disk space

2GB disk space

512GB disk space

256GB disk space

Leave a comment Cancel reply