Pass Your PCDRA Exam Easily – Real PCDRA Practice Dump Updated Jul 15, 2022 [Q20-Q41]

4/5 - (1 vote)

Pass Your PCDRA Exam Easily – Real PCDRA Practice Dump Updated Jul 15, 2022

2022 Realistic Verified Free Palo Alto Networks PCDRA Exam Questions

Palo Alto Networks PCDRA Exam Syllabus Topics:

Topic	Details
Topic 1	Outline how Cortex XDR ingests other non-Palo Alto Networks data sources Describe how to use the Broker to activate Pathfinder
Topic 2	Characterize the differences between incidents and alerts Identify the investigation capabilities of Cortex XDR
Topic 3	Characterize the differences between application protection and kernel protection Characterize the differences between malware and exploits
Topic 4	Identify common investigation screens and processes Describe what actions can be performed using the live terminal
Topic 5	Outline distributing and scheduling capabilities of Cortex XDR Identify the information needed for a given audience
Topic 6	Describe how to use the Broker as a proxy between the agents and XDR in the Cloud Describe details of the ingestion methods
Topic 7	Identify legitimate threats (true positives) vs. illegitimate threats (false positives) Outline incident collaboration and management using XDR
Topic 8	Distinguish between automatic vs. manual remediations Describe how to fix false positives Describe basic remediation

QUESTION 20
Which of the following is NOT a precanned script provided by Palo Alto Networks?

delete_file

quarantine_file

process_kill_name

list_directories

QUESTION 21
Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

in the macOS Malware Protection Profile to indicate allowed signers

in the Linux Malware Protection Profile to indicate allowed Java libraries

SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

in the Windows Malware Protection Profile to indicate allowed executables

QUESTION 22
Which profiles can the user use to configure malware protection in the Cortex XDR console?

Malware Protection profile

Malware profile

Malware Detection profile

Anti-Malware profile

QUESTION 23
Which of the following policy exceptions applies to the following description?
‘An exception allowing specific PHP files’

Support exception

Local file threat examination exception

Behavioral threat protection rule exception

Process exception

QUESTION 24
You can star security events in which two ways? (Choose two.)

Create an alert-starring configuration.

Create an Incident-starring configuration.

Manually star an alert.

Manually star an Incident.

QUESTION 25
Which statement is true based on the following Agent Auto Upgrade widget?

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than In Progress status.

QUESTION 26
Which type of BIOC rule is currently available in Cortex XDR?

Threat Actor

Discovery

Network

Dropper

QUESTION 27
Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

a hierarchical database that stores settings for the operating system and for applications

a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the “swap”

a central system, available via the internet, for registering officially licensed versions of software to prove ownership

a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system

QUESTION 28
Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

exception profiles that apply to specific endpoints

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

role-based profiles that apply to specific endpoints

QUESTION 29
A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

It is true positive.

It is false positive.

It is a false negative.

It is true negative.

QUESTION 30
Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

QUESTION 31
In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

Create a custom XQL widget

This is not currently supported

Create a custom report and filter on starred incidents

Click the star in the widget

Reference:
%20you%20clear%20the%20star

QUESTION 32
Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Hash Verdict Determination

Behavioral Threat Protection

Restriction Policy

Child Process Protection

Cortex XDR agent offers a complete prevention stack with cutting-edge protection for exploits, malware, ransomware, and fileless attacks. It includes the broadest set of exploit protection modules available to block the exploits that lead to malware infections. Every file is examined by an adaptiveAI-driven local analysis engine that’s always learning to counter new attack techniques. A BehavioralThreat Protection engine examines the behavior of multiple, related processes to uncover attacks as they occur. Integration with the Palo Alto Networks WildFire® malware prevention service boosts security accuracy and coverage.

QUESTION 33
When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

Pending

It is blank

Unassigned

New

QUESTION 34
With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

QUESTION 35
Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Cortex XDR Pro per TB

Host Insights

Cortex XDR Pro per Endpoint

Cortex XDR Cloud per Host

QUESTION 36
When is the wss (WebSocket Secure) protocol used?

when the Cortex XDR agent downloads new security content

when the Cortex XDR agent uploads alert data

when the Cortex XDR agent connects to WildFire to upload files for analysis

when the Cortex XDR agent establishes a bidirectional communication channel

QUESTION 37
Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

NetBIOS over TCP

WebSocket

UDP and a random port

TCP, over port 80

QUESTION 38
Which statement is true for Application Exploits and Kernel Exploits?

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.

QUESTION 39
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

Enable DLL Protection on all endpoints but there might be some false positives.

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.

No step is required because the malicious document is already stopped.

QUESTION 40
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

Security Manager Dashboard

Data Ingestion Dashboard

Security Admin Dashboard

Incident Management Dashboard

QUESTION 41
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

Enable DLL Protection on all servers but there might be some false positives.

Create IOCs of the malicious files you have found to prevent their execution.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Loading …