[2023] PCDRA PDF Questions – Perfect Prospect To Go With ActualCollection Practice Exam [Q21-Q44]

4/5 - (1 vote)

[2023] PCDRA PDF Questions – Perfect Prospect To Go With ActualCollection Practice Exam

Palo Alto Networks PCDRA Pdf Questions – Outstanding Practice To your Exam

Have a look at the requirements to take the Palo Alto Networks PCDRA Certification Exam

According to the PCDRA Dumps For taking the Palo Alto Networks PCDRA Certification Exam the individual must have an understanding of topics like network security, computer forensics, architecture, investigation, remediation, threat hunting, reporting, etc.

Get to know about the topics of the Palo Alto Networks PCDRA Certification Exam

The topics of the Palo Alto Networks PCDRA Certification Exam defined in the PCDRA Dumps is given as follows:

Investigation: 20%
Threats and Attacks: 10%
Architecture: 15%
Reporting: 10%

QUESTION 21
Which type of BIOC rule is currently available in Cortex XDR?

Threat Actor

Discovery

Network

Dropper

QUESTION 22
Which module provides the best visibility to view vulnerabilities?

Device Control Violations module

Live Terminal module

Host Insights module

Forensics module

QUESTION 23
A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?

Manually remediate the problem on the endpoint in question.

Open X2go from the Cortex XDR console and delete the file via X2go.

Initiate Remediate Suggestions to automatically delete the file.

Open an NFS connection from the Cortex XDR console and delete the file.

QUESTION 24
You can star security events in which two ways? (Choose two.)

Create an alert-starring configuration.

Create an Incident-starring configuration.

Manually star an alert.

Manually star an Incident.

QUESTION 25
An attacker tries to load dynamic libraries on macOS from an unsecure location. Which Cortex XDR module can prevent this attack?

DDL Security

Hot Patch Protection

Kernel Integrity Monitor (KIM)

Dylib Hijacking

Reference:
%20process

QUESTION 26
With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

QUESTION 27
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

Security Manager Dashboard

Data Ingestion Dashboard

Security Admin Dashboard

Incident Management Dashboard

QUESTION 28
Which profiles can the user use to configure malware protection in the Cortex XDR console?

Malware Protection profile

Malware profile

Malware Detection profile

Anti-Malware profile

QUESTION 29
Which statement regarding scripts in Cortex XDR is true?

Any version of Python script can be run.

The level of risk is assigned to the script upon import.

Any script can be imported including Visual Basic (VB) scripts.

The script is run on the machine uploading the script to ensure that it is operational.

QUESTION 30
If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

Broker VM Pathfinder

Local Agent Proxy

Local Agent Installer and Content Caching

Broker VM Syslog Collector

QUESTION 31
What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automatically block the IP addresses involved in malicious traffic.

Reference:
%20threat%20protection%2C%20the,appear%20legitimate%20if%20inspected%20individually

QUESTION 32
Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

QUESTION 33
What does the following output tell us?

There is one low severity incident.

Host shpapy_win10 had the most vulnerabilities.

There is one informational severity alert.

This is an actual output of the Top 10 hosts with the most malware.

QUESTION 34
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

Enable DLL Protection on all servers but there might be some false positives.

Create IOCs of the malicious files you have found to prevent their execution.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

QUESTION 35
Which of the following is NOT a precanned script provided by Palo Alto Networks?

delete_file

quarantine_file

process_kill_name

list_directories

QUESTION 36
After scan, how does file quarantine function work on an endpoint?

Quarantine takes ownership of the files and folders and prevents execution through access control.

Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

QUESTION 37
In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Agent Proxy

Agent Installer and Content Caching

Syslog Collector

CSV Collector

QUESTION 38
Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response –> Action Center

under the gear icon –> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

QUESTION 39
When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

Pending

It is blank

Unassigned

New

QUESTION 40
How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

by encrypting the disk first.

by utilizing decoy Files.

by retrieving the encryption key.

by patching vulnerable applications.

QUESTION 41
Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

Sensor Engine

Causality Analysis Engine

Log Stitching Engine

Causality Chain Engine

QUESTION 42
Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

a hierarchical database that stores settings for the operating system and for applications

a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the “swap”

a central system, available via the internet, for registering officially licensed versions of software to prove ownership

a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system

QUESTION 43
Which statement best describes how Behavioral Threat Protection (BTP) works?

BTP injects into known vulnerable processes to detect malicious activity.

BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.

BTP matches EDR data with rules provided by Cortex XDR.

BTP uses machine Learning to recognize malicious activity even if it is not known.

QUESTION 44
Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.

Exfiltration, Command and Control, Collection

Exfiltration, Command and Control, Privilege Escalation

Exfiltration, Command and Control, Impact

Exfiltration, Command and Control, Lateral Movement

Loading …

Online Questions – Outstanding Practice To your PCDRA Exam: https://www.actualcollection.com/PCDRA-exam-questions.html

Have a look at the requirements to take the Palo Alto Networks PCDRA Certification Exam

Get to know about the topics of the Palo Alto Networks PCDRA Certification Exam

Leave a comment Cancel reply