Question 1 · 88 in bank
Phishing belongs which of the following MITRE ATT&CK tactics?
Show answer
Answer: D
PCDRAAssociatePalo Alto NetworksAll questions freePage 1 of 9
PCDRA practice questions 1–10
Palo Alto Networks Certified Detection and Remediation Analyst88 questions across 9 pages are complete and free, with no account or card.
Official study references
88 questions in this bank
Free access · progress saved on this device
Question 2 · 88 in bank
When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?
Show answer
Answer: C
Explanation
from Admin Guide: Assigned To: The user to which the incident is assigned. The assignee tracks which analyst is responsible for investigating the threat. Incidents that have not been assigned have a status of Unassigned. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents
Source: Adapted from community discussion — cneru1
Question 3 · 88 in bank
In incident-related widgets, how would you filter the display to only show incidents that were “starred”?
Show answer
Answer: D
Question 4 · 88 in bank
Where would you view the WildFire report in an incident?
Show answer
Answer: A
Question 5 · 88 in bank
What does the following output tell us?
Show answer
Answer: A
Question 6 · 88 in bank
Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?
Show answer
Answer: B
Explanation
From CXPAD: The Causality Analysis Engine determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident.
Source: Adapted from community discussion — 9smiles
Question 7 · 88 in bank
Which type of BIOC rule is currently available in Cortex XDR?
Show answer
Answer: D
Explanation
D is the only correct answer. Type of BIOC rule: Collection Credential Access Dropper Evasion Execution Evasive Exfiltration File Privilege Manipulation File Type Obfuscation Infiltration Lateral Movement Other Persistence Privilege Escalation Reconnaissance Tampering
Source: Adapted from community discussion — im2ca
Question 8 · 88 in bank
In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?
Show answer
Answer: C
Explanation
the correct option to prevent the Cortex XDR Agent from blocking the execution of a file based on the digital signer may vary depending on the specific version and configuration of the Cortex XDR Agent. However, based on the given options, the most appropriate choice would be: C. Add the signer to the allow list in the malware profile. By adding the digital signer to the allow list in the malware profile, you are essentially telling the Cortex XDR Agent to trust files signed by that specific signer and allow their execution without being blocked. It's worth noting that cybersecurity measures and software configurations can change over time, so it's essential to refer to the official documentation or the latest guidelines provided by the product's vendor for the most up-to-date information. Additionally, configuring security software requires careful consideration and should be performed by knowledgeable and authorized personnel to ensure the system's security.
Source: Adapted from community discussion — im2ca
Question 9 · 88 in bank
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?
Show answer
Answer: A
Explanation
Please provide a reference for your claim im2ca. I have not been able to find any supporting documentation for this. Probably you are talking about custom prevention rules, which are basically BIOC rules that you add to restriction profiles see [1], but BTP Rules are something else and their database is not available to the public [2]. [1]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule [2]: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/about-behavioral-threat-protection-btp-rules/td-p/395977
Source: Adapted from community discussion — 9smiles
References
Question 10 · 88 in bank
Which statement is true based on the following Agent Auto Upgrade widget?
Show answer
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCDRA practice, question 1. 88 questions available.
About this question bank
Version 1.0.0. How we source questions