Palo Alto Networks Certified Detection and Remediation Analyst practice questions

1. Question 1 of 25

   When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

   • APending
   • BIt is blank
   • CUnassigned
   • DNew

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   from Admin Guide: Assigned To: The user to which the incident is assigned. The assignee tracks which analyst is responsible for investigating the threat. Incidents that have not been assigned have a status of Unassigned. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents

   Adapted from community discussion by cneru1 · 2024-01-15 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. C

      cneru1

      2024-01-15

      5 upvotes

      from Admin Guide: Assigned To: The user to which the incident is assigned. The assignee tracks which analyst is responsible for investigating the threat. Incidents that have not been assigned have a status of Unassigned. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents

   2. I

      Indy_k

      2023-09-15

      4 upvotes

      C is the right answer. It's the status field that will be set to New. The assigned to field will be set to Unassigned

2. Question 2 of 25

   Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

   • ASensor Engine
   • BCausality Analysis Engine
   • CLog Stitching Engine
   • DCausality Chain Engine

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   From CXPAD: The Causality Analysis Engine determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident.

   Adapted from community discussion by 9smiles · 2023-08-31 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. 9

      9smiles

      2023-08-31

      Selected B4 upvotes

      From CXPAD: The Causality Analysis Engine determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident.

   2. D

      danups

      2024-09-09

      Selected B1 upvote

      Causality Analysis Engine: This engine analyzes relationships between different alerts and determines the most relevant artifacts. It aggregates alerts related to the same underlying event into a cohesive incident, providing a comprehensive view of the security situation. Causality Chain Engine: This engine helps in understanding the sequence and relationship between events but is more focused on the detailed timeline and chaining of related events.

   3. B

      Bsharif

      2024-04-19

      1 upvote

      B is the right answer. Check: Ref.: Ref.: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Concepts

3. Question 3 of 25

   Which type of BIOC rule is currently available in Cortex XDR?

   • AThreat Actor
   • BDiscovery
   • CNetwork
   • DDropper

   Show answer

   Correct answer: D

   How others answered

   • D75%
   • B25%

   Explanation

   D is the only correct answer. Type of BIOC rule: Collection Credential Access Dropper Evasion Execution Evasive Exfiltration File Privilege Manipulation File Type Obfuscation Infiltration Lateral Movement Other Persistence Privilege Escalation Reconnaissance Tampering

   Adapted from community discussion by im2ca · 2023-07-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. I

      im2ca

      2023-07-26

      4 upvotes

      D is the only correct answer. Type of BIOC rule: Collection Credential Access Dropper Evasion Execution Evasive Exfiltration File Privilege Manipulation File Type Obfuscation Infiltration Lateral Movement Other Persistence Privilege Escalation Reconnaissance Tampering

   2. K

      Karreldanam

      2023-06-02

      Selected D2 upvotes

      Type of BIOC rule: ● Collection ● Credential Access ● Dropper ● Evasion ● Execution ● Evasive ● Exfiltration ● File Privilege Manipulation ● File Type Obfuscation ● Infiltration ● Lateral Movement ● Other ● Persistence ● Privilege Escalation ● Reconnaissance ● Tampering

   3. D

      danups

      2024-09-09

      1 upvote

      Actually in the current version both "Dropper" and "Discovery" are valid BIOC rule types; however due to the time of creation of this exam I would guess it was designed without considering the "Discovery" type as an option, so I would go for "Dropper" (D)

   4. B

      Bsharif

      2024-04-19

      1 upvote

      Option D: Dropper is the right answer. im2ca has labeled all types of BIOC Rule. Which can be found under: Ref.: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/BIOC-Rule-Details

4. Question 4 of 25

   In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

   • AIn the Restrictions Profile, add the file name and path to the Executable Files allow list.
   • BCreate a new rule exception and use the singer as the characteristic.
   • CAdd the signer to the allow list in the malware profile.
   • DAdd the signer to the allow list under the action center page.

   Show answer

   Correct answer: C

   How others answered

   • C75%
   • A25%

   Explanation

   the correct option to prevent the Cortex XDR Agent from blocking the execution of a file based on the digital signer may vary depending on the specific version and configuration of the Cortex XDR Agent. However, based on the given options, the most appropriate choice would be: C. Add the signer to the allow list in the malware profile. By adding the digital signer to the allow list in the malware profile, you are essentially telling the Cortex XDR Agent to trust files signed by that specific signer and allow their execution without being blocked. It's worth noting that cybersecurity measures and software configurations can change over time, so it's essential to refer to the official documentation or the latest guidelines provided by the product's vendor for the most up-to-date information. Additionally, configuring security software requires careful consideration and should be performed by knowledgeable and authorized personnel to ensure the system's security.

   Adapted from community discussion by im2ca · 2023-07-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. I

      im2ca

      2023-07-26

      2 upvotes

      the correct option to prevent the Cortex XDR Agent from blocking the execution of a file based on the digital signer may vary depending on the specific version and configuration of the Cortex XDR Agent. However, based on the given options, the most appropriate choice would be: C. Add the signer to the allow list in the malware profile. By adding the digital signer to the allow list in the malware profile, you are essentially telling the Cortex XDR Agent to trust files signed by that specific signer and allow their execution without being blocked. It's worth noting that cybersecurity measures and software configurations can change over time, so it's essential to refer to the official documentation or the latest guidelines provided by the product's vendor for the most up-to-date information. Additionally, configuring security software requires careful consideration and should be performed by knowledgeable and authorized personnel to ensure the system's security.

   2. S

      sharkk43

      2023-10-31

      2 upvotes

      I'd say C is for 3.5 version and older and B is for newer versions: "Add a Disable Prevention Rule Cortex XDR enables you to generate granular exceptions to prevention actions defined for your endpoints. You can specify signers, command line, or processes to exclude from the prevention actions triggered by specific security modules. This may be useful when you have processes that are essential to your organization and must not be terminated. Cortex XDR still generates Alerts from the disabled rules." Checking inside my client's platform that's what I can see and we're running 3.7 currently. Info taken from here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-Disable-Prevention-Rule

   3. D

      danups

      2024-09-25

      1 upvote

      It's worth to mention that creating an allow list based on digital signer used to be available in the malware protection profile but in older versions, on the very newer versions this feature has changed and is not available on that profile anymore. There is a new feature called "Legacy Agent Exceptions" under Settings > Exceptions Configurations and you basically have to create a rule exception based on your needs such as the digital signer. So if the question is expecting an updated answer then the right choice would be "B", probably on the real exam the question is worded different.

   4. D

      danups

      2024-09-09

      Selected C1 upvote

      C is the right answer since in the malware profile you can add items to the allowed list based on the signer. A is wrong, I mean you can do it but that is not what the question is asking for lol

5. Question 5 of 25

   As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

   • ACreate Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
   • BEnable DLL Protection on all servers but there might be some false positives.
   • CCreate IOCs of the malicious files you have found to prevent their execution.
   • DEnable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Please provide a reference for your claim im2ca. I have not been able to find any supporting documentation for this. Probably you are talking about custom prevention rules, which are basically BIOC rules that you add to restriction profiles see [1], but BTP Rules are something else and their database is not available to the public [2]. [1]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule [2]: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/about-behavioral-threat-protection-btp-rules/td-p/395977

   Adapted from community discussion by 9smiles · 2024-02-29 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • live.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. 9

      9smiles

      2024-02-29

      2 upvotes

      Please provide a reference for your claim im2ca. I have not been able to find any supporting documentation for this. Probably you are talking about custom prevention rules, which are basically BIOC rules that you add to restriction profiles see [1], but BTP Rules are something else and their database is not available to the public [2]. [1]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule [2]: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/about-behavioral-threat-protection-btp-rules/td-p/395977

   2. 9

      9smiles

      2023-11-24

      2 upvotes

      About BTP rules: Prevents sophisticated attacks that leverage built-in OS executables and common administration utilities by continuously monitoring endpoint activity for malicious causality chains. You are not able to create these - only create exceptions and turn them off so A cannot be correct. C can also not be correct since IOCs lead to detections, and do not prevent the file from running. My guess would be B

   3. C

      Chiquitabandita

      2024-09-24

      1 upvote

      I had seen about 4 questions from this site, that are very similar and can't really confirm which is the best answer. I keep coming up with a similar solution would be to create a BIOC rule for this situation but that is not one of the choices, it is different from a BTP rule, which to my research does not allow creation of rules to the general public. I had wondered if they possibly got the question mistranscribed from the source. Anyone have any other sources? C looks like it could be a good choice except as, 9smiles has suggested it is detection, not prevention, and the question asks for prevention.

   4. C

      Chiquitabandita

      2024-09-26

      Selected A1 upvote

      To configure the Global Behavioral Threat Protection Rules: Define the Action mode to take when the Cortex XDR agent detects malicious causality chains: Block (default)—Block all processes and threads in the event chain up to the CGO. Report—Allow the activity but report it to Cortex XDR. Disabled—Disable the module and do not analyze or report the activity.

6. Question 6 of 25

   When creating a BIOC rule, which XQL query can be used?

   • Adataset = xdr_data | filter event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
   • Bdataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
   • Cdataset = xdr_data | filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" | fields action_process_image
   • Ddataset = xdr_data | filter event_behavior = true event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Correct answer is: B "The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule."

   Adapted from community discussion by 9smiles · 2023-11-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. N

      nobody165456131354

      2024-07-12

      Selected B2 upvotes

      Correct answer is: B A: missing event_type C: wrong action_process_image D: wrong event_behaviour

   2. 9

      9smiles

      2023-11-26

      2 upvotes

      Correct answer is: B "The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule."

7. Question 7 of 25

   What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

   • ANetflow Collector
   • BSyslog Collector
   • CDB Collector
   • DPathfinder

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Correct answer: C From the PCDRA Study Guide: 7.5.2 Describe how to use the Broker to ingest third-party alerts ... To ingest data, you must set up the Syslog Collector applet on a broker VM within your network.

   Adapted from community discussion by 9smiles · 2023-11-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion3

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. D

      Davina07

      2023-12-14

      4 upvotes

      I think B: "To ingest data, you must set up the Syslog Collector applet on a broker VM within your network."

   2. 9

      9smiles

      2023-11-24

      2 upvotes

      Correct answer: C From the PCDRA Study Guide: 7.5.2 Describe how to use the Broker to ingest third-party alerts ... To ingest data, you must set up the Syslog Collector applet on a broker VM within your network.

   3. X

      XuannnnOAO

      2024-05-09

      1 upvote

      B is correct~ https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/External-Data-Ingestion-Vendor-Support

8. Question 8 of 25

   In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

   • AAgent Proxy
   • BAgent Installer and Content Caching
   • CSyslog Collector
   • DCSV Collector

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Correct answer: B From the Cortex XDR Pro Administrators Guide (CXPAG): Agent Installer and Content Caching: Requires you upload a strong cipher SHA256-based SSL certificates when you setup the Broker VM.

   Adapted from community discussion by 9smiles · 2023-05-24 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion2

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. 9

      9smiles

      2023-05-24

      5 upvotes

      Correct answer: B From the Cortex XDR Pro Administrators Guide (CXPAG): Agent Installer and Content Caching: Requires you upload a strong cipher SHA256-based SSL certificates when you setup the Broker VM.

   2. D

      danups

      2024-09-09

      Selected A1 upvote

      Agent Proxy: This component acts as an intermediary between the Cortex XDR agents and the Cortex XDR cloud. It requires a strong cipher SHA256-based SSL certificate to secure the communication between the agents and the proxy, ensuring the integrity and confidentiality of the data transmitted to the Cortex XDR Instance in the Cloud.

9. Question 9 of 25

   If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

   • ABroker VM Pathfinder
   • BLocal Agent Proxy
   • CLocal Agent Installer and Content Caching
   • DBroker VM Syslog Collector

   Show answer

   Correct answer: B

   How others answered

   • B83%
   • C17%

   Explanation

   B. Cortex XDR in restricted networks where endpoints do not have a direct connection to the internet, setup the Broker VM to act as a proxy

   Adapted from community discussion by b1gd1g · 2023-06-24 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

   1. B

      b1gd1g

      2023-06-24

      6 upvotes

      B. Cortex XDR in restricted networks where endpoints do not have a direct connection to the internet, setup the Broker VM to act as a proxy

   2. B

      Blahziblah

      2023-11-13

      Selected B2 upvotes

      I believe the answer is B. Here is the admin guide, see the second bullet: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Activate-the-Local-Agent-Settings Caching just means it will cache the data, but if it doesn't have the data it will try to go get it. This won't work in an isolated network so C isn't correct.

   3. A

      abd1234

      2024-06-19

      Selected B1 upvote

      Sorry I mistakenly selected C, ıt should be B. To deploy Cortex XDR in restricted networks where endpoints do not have a direct connection to the internet, setup the Broker VM to act as a proxy that routes all the traffic between the Cortex XDR management server and XDR agents/XDR Collectors via a centralized and controlled access point

   4. A

      abd1234

      2024-06-19

      Selected B1 upvote

      https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Activate-the-Local-Agent-Settings

10. Question 10 of 25

    Select 2

    When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

    • AAssign incidents to an analyst in bulk.
    • BChange the status of multiple incidents.
    • CInvestigate several Incidents at once.
    • DDelete the selected Incidents.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    Explanation

    A, B https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents Check box to select one or more incidents on which to perform the following actions. - Assign incidents to an analyst in bulk - Change the status of multiple incidents - Change the severity of multiple incidents

    Adapted from community discussion by MatchaLatte · 2024-03-19 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. M

       MatchaLatte

       2024-03-19

       Selected A, B2 upvotes

       A, B https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents Check box to select one or more incidents on which to perform the following actions. - Assign incidents to an analyst in bulk - Change the status of multiple incidents - Change the severity of multiple incidents

    2. N

       ninya69

       2023-11-11

       1 upvote

       A, B - You can change status/severity/assignee for all incidents as well as star/merge the incidents.

11. Question 11 of 25

    Which statement is true for Application Exploits and Kernel Exploits?

    • AThe ultimate goal of any exploit is to reach the application.
    • BKernel exploits are easier to prevent then application exploits.
    • CThe ultimate goal of any exploit is to reach the kernel.
    • DApplication exploits leverage kernel vulnerability.

    Show answer

    Correct answer: C

    How others answered

    • C71%
    • A29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    It's clearly stated in Beacon > Cortex XDR 3: Getting Started with Endpoint Protection > Cortex XDR 3: Exploit Protection > Application Exploit Prevention > Application Exploits and Kernel Exploits https://beacon.paloaltonetworks.com/uploads/resource_courses/targets/2394329/original/index.html?_courseId=905962#/page/612c6346db387a0de433778d

    Adapted from community discussion by 0707bc6 · 2024-04-10 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. 0

       0707bc6

       2024-04-10

       Selected C3 upvotes

       It's clearly stated in Beacon > Cortex XDR 3: Getting Started with Endpoint Protection > Cortex XDR 3: Exploit Protection > Application Exploit Prevention > Application Exploits and Kernel Exploits https://beacon.paloaltonetworks.com/uploads/resource_courses/targets/2394329/original/index.html?_courseId=905962#/page/612c6346db387a0de433778d

    2. B

       besik

       2024-03-05

       Selected C2 upvotes

       The attacker's ultimate goal is to reach the kernel because if he reaches the kernel, he can do anything he wants and to execute something he will not need privileged access. There are many mitigation techniques with Application Exploits but not many for the kernel.

    3. _

       _tips

       2023-09-22

       2 upvotes

       Regarding to this page https://www.csoonline.com/article/571799/exploit-chains-explained-how-and-why-attackers-target-multiple-vulnerabilities.html “The goal with exploit chain attacks is to gain kernel/root/system level access to compromise a system in order to execute an attack,” he answer is C

    4. D

       danups

       2024-09-10

       Selected C1 upvote

       Kernel exploits are harder to prevent and is their ultimate goal for further control of an endpoint.

12. Question 12 of 25

    Which of the following is an example of a successful exploit?

    • Aconnecting unknown media to an endpoint that copied malware due to Autorun.
    • Ba user executing code which takes advantage of a vulnerability on a local service.
    • Cidentifying vulnerable services on a server.
    • Dexecuting a process executable for well-known and signed software.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    From documentation : "An exploit is a piece of code or a program that takes advantage of a weakness (aka vulnerability) in an application or system." https://www.paloaltonetworks.com/cyberpedia/malware-vs-exploits

    Adapted from community discussion by Flky · 2023-09-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. F

       Flky

       2023-09-21

       Selected B2 upvotes

       From documentation : "An exploit is a piece of code or a program that takes advantage of a weakness (aka vulnerability) in an application or system." https://www.paloaltonetworks.com/cyberpedia/malware-vs-exploits

    2. S

       SR_RS

       2023-08-16

       2 upvotes

       should be B. identifying a vulnerability is not a successful exploit. executing code to take advantage of the vulnerability should be a successful exploit. unless i am reading it wrongly

    3. C

       Chiquitabandita

       2024-03-22

       Selected B1 upvote

       b seems like best answer but A is not a good thing either, A at least did not get executed, only uploaded.

    4. S

       SR_RS

       2023-08-16

       1 upvote

       unless we see it differently. executing a code that take advantage of a vulnerability (does not mean it will be successful) but able to identify vulnerabilities in a SERVER (mean that a bad actor manages to get past security)

13. Question 13 of 25

    Select 2

    What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

    • AAutomatically close the connections involved in malicious traffic.
    • BAutomatically kill the processes involved in malicious activity.
    • CAutomatically terminate the threads involved in malicious activity.
    • DAutomatically block the IP addresses involved in malicious traffic.

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    (Windows only) Respond to Malicious Causality Chains. When the Cortex XDR agent identifies a remote network connection that attempts to perform malicious activity—such as encrypting endpoint files—the agent can automatically block the IP address to close all existing communication and block new connections from this IP address to the endpoint. When Cortex XDRblocks an IP address per endpoint, that address remains blocked throughout all agent profiles and policies, including any host-firewall policy rules. You can view the list of all blocked IP addresses per endpoint from the Action Center, as well as unblock them to re-enable communication as appropriate.

    Adapted from community discussion by Karreldanam · 2023-06-02 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • live.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. K

       Karreldanam

       2023-06-02

       Selected A, D3 upvotes

       (Windows only) Respond to Malicious Causality Chains. When the Cortex XDR agent identifies a remote network connection that attempts to perform malicious activity—such as encrypting endpoint files—the agent can automatically block the IP address to close all existing communication and block new connections from this IP address to the endpoint. When Cortex XDRblocks an IP address per endpoint, that address remains blocked throughout all agent profiles and policies, including any host-firewall policy rules. You can view the list of all blocked IP addresses per endpoint from the Action Center, as well as unblock them to re-enable communication as appropriate.

    2. S

       sharkk43

       2023-10-31

       Selected A, D3 upvotes

       I say it's A and D because of what I'm just reading off the official course in the section "Respond to Malicious Causality Chains". It goes like this: "When the Cortex XDR agent detects a malicious activity, the Respond to Malicious Causality Chains module inspects the network connections opened by the processes involved in the attack to identify malicious IP addresses." To me that's A nd D not A and C.

    3. S

       sharkk43

       2023-10-31

       3 upvotes

       Forgot to add the second part: "If such network connections are found, this protection module can automatically close all the network connections and block new connection requests from these IP addresses."

    4. N

       news088

       2023-11-02

       2 upvotes

       selected answer AD https://live.paloaltonetworks.com/t5/community-blogs/cortex-xdr-agent-7-3-new-features/ba-p/383329

14. Question 14 of 25

    Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

    • AHash Verdict Determination
    • BBehavioral Threat Protection
    • CRestriction Policy
    • DChild Process Protection

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Phase 1: Evaluation of Child Process Protection Policy When a user attempts to run an executable, the operating system attempts to run the executable as a process. If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.

    Adapted from community discussion by SpTester · 2024-07-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. S

       SpTester

       2024-07-11

       Selected D3 upvotes

       Phase 1: Evaluation of Child Process Protection Policy When a user attempts to run an executable, the operating system attempts to run the executable as a process. If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.

    2. E

       escar

       2023-11-12

       Selected D3 upvotes

       should be - Evaluation of Child Process Protection Policy https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/File-Analysis-and-Protection-Flow

    3. C

       Chiquitabandita

       2024-09-22

       Selected D2 upvotes

       saw this in admin guide https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/File-Analysis-and-Protection-Flow

    4. E

       examlog

       2024-05-07

       1 upvote

       Correct Answer D. Child Process Protection https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/File-Analysis-and-Protection-Flow If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.

15. Question 15 of 25

    Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

    • ACortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.
    • BCortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.
    • CCortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.
    • DCortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • B50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    If you go here: https://www.paloaltonetworks.com/services/education/palo-alto-networks-certified-detection-and-remediation-analyst And then go to Sample questions (specifically here: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-sample-questions.pdf), there's 7 questions, one of them being: Which statement is valid regarding the Cortex XDR Analytics module? A. It interferes with an attack pattern as soon as it is observed on the endpoint. B. It does not interfere with any portion of the attack pattern on the endpoint. C. It does not need to interfere with any portion of the pattern to prevent the attack. D. It interferes with the attack pattern as soon as it is observed on the firewall. Palo Alto says the answer here is B. Therefore, for this question on ExamTopics I'd say the answer is B as well.

    Adapted from community discussion by sharkk43 · 2024-05-01 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. S

       sharkk43

       2024-05-01

       8 upvotes

       If you go here: https://www.paloaltonetworks.com/services/education/palo-alto-networks-certified-detection-and-remediation-analyst And then go to Sample questions (specifically here: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-sample-questions.pdf), there's 7 questions, one of them being: Which statement is valid regarding the Cortex XDR Analytics module? A. It interferes with an attack pattern as soon as it is observed on the endpoint. B. It does not interfere with any portion of the attack pattern on the endpoint. C. It does not need to interfere with any portion of the pattern to prevent the attack. D. It interferes with the attack pattern as soon as it is observed on the firewall. Palo Alto says the answer here is B. Therefore, for this question on ExamTopics I'd say the answer is B as well.

    2. S

       SpTester

       2024-07-11

       Selected D2 upvotes

       Coverage of MITRE Attack Tactics: Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack is neutralized. The Cortex XDR Analytics Engine retrieves logs from the Cortex XDR tenant to create a baseline so that it can raise alerts when abnormal activity occurs. This analysis is highly sophisticated and performed on more than a thousand dimensions of data. Internally, Cortex XDR organizes its analytics activity into algorithms called detectors. Each detector is responsible for raising an alert when suspicious behavior is detected. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts So I vote D. It enables the possibility but not to do anything on the Firewall itself.

    3. _

       _tips

       2024-03-20

       2 upvotes

       The question is talking about Network Attacks, so I think, it is talking about Firewalls, https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts The Cortex XDR app uses its Analytics Engine to examine logs and data retrieved from your sensors on the Cortex XDR tenants to build an activity baseline, and recognize abnormal activity when it occurs. The Analytics Engine accesses your logs as they are streamed to the Cortex XDR tenant, including any Firewall data, and analyzes the data as soon as it arrives. Cortex XDR raises an Analytics alert when the Analytics Engine determines an anomaly. I guess the answer is A.

    4. D

       darylmaeb24

       2024-05-20

       2 upvotes

       BIOC Analytics is just a detection alert. Unless you have set a custom BIOC Prevention rules. My answer would be B.

16. Question 16 of 25

    After scan, how does file quarantine function work on an endpoint?

    • AQuarantine takes ownership of the files and folders and prevents execution through access control.
    • BQuarantine disables the network adapters and locks down access preventing any communications with the endpoint.
    • CQuarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.
    • DQuarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    "it moves the file from the location on a local or removable drive to a local quarantine folder (%PROGRAMDATA%\Cyvera\Quarantine) where it isolates the file." in admin guide link

    Adapted from community discussion by Chiquitabandita · 2024-09-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. B

       Bradl

       2024-06-05

       2 upvotes

       When the agent detects malware on a Windows endpoint, you can take additional precautions to quarantine the file. When the agent quarantines malware, it moves the file from the location on a local or removable drive to a local quarantine folder (%PROGRAMDATA%\Cyvera\Quarantine) where it isolates the file. This prevents the file from attempting to run again from the same path or causing any harm to your endpoints.

    2. C

       Chiquitabandita

       2024-09-22

       Selected C2 upvotes

       "it moves the file from the location on a local or removable drive to a local quarantine folder (%PROGRAMDATA%\Cyvera\Quarantine) where it isolates the file." in admin guide link

    3. P

       PaloGuy

       2024-01-14

       2 upvotes

       https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Quarantined-Files

    4. D

       deyabeel22

       2024-05-01

       1 upvote

       C. Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

17. Question 17 of 25

    Which profiles can the user use to configure malware protection in the Cortex XDR console?

    • AMalware Protection profile
    • BMalware profile
    • CMalware Detection profile
    • DAnti-Malware profile

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection this seems to be a bit nit picky on the wording in this question. but in the link it does reference the profile as malware protection profile so A is my answer.

    Adapted from community discussion by Chiquitabandita · 2024-03-23 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. C

       Chiquitabandita

       2024-03-23

       Selected A2 upvotes

       https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection this seems to be a bit nit picky on the wording in this question. but in the link it does reference the profile as malware protection profile so A is my answer.

    2. F

       flummoxed_individual

       2024-07-28

       Selected A1 upvote

       Agree with Chiquitabandita about the annoying wording of the question. I am looking at the Profiles tab right now and it is labeled as "Malware Prevention" so I guess "Protection" is close enough...

18. Question 18 of 25

    Select 2

    You can star security events in which two ways? (Choose two.)

    • ACreate an alert-starring configuration.
    • BCreate an Incident-starring configuration.
    • CManually star an alert.
    • DManually star an Incident.

    Show answer

    Correct answer: A, D

    How others answered

    • AD50%
    • BD50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I am confused here, the documentation says to create an incident starring configuration, but in the configuration setting it says "Create New Alert Starring Configuration"

    Adapted from community discussion by _tips · 2023-09-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. _

       _tips

       2023-09-22

       2 upvotes

       I am confused here, the documentation says to create an incident starring configuration, but in the configuration setting it says "Create New Alert Starring Configuration"

    2. D

       danups

       2024-09-10

       Selected A, D1 upvote

       You can manually star an INCIDENT but you also can add an starring ALERT configuration. I checked the Cortex XDR to double check, and "AD" are the right choices.

    3. _

       _tips

       2023-09-18

       1 upvote

       You can manually star an incident after reviewing it, or you can create an incident starring configuration that automatically categorizes and stars incidents when a related alert contains the specific attributes that you decide are important. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Manage-Incident-Starring

    4. D

       danups

       2024-09-24

       1 upvote

       Odd enough the fact that the documentation says you can create an incident starring configuration, but the Cortex XDR Console says "Alert starring configuration", I'd change the answer to "BD" just because that's what the documentation says about it and the exam has probably been created from that.

19. Question 19 of 25

    Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

    • AFind the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
    • BFrom the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
    • CFind the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
    • DIn the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    I say B based on: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-IOC-or-BIOC-Rule-Exception "If you want to create a rule to take action on specific behaviors but also want to exclude one or more indicators from the rule, you can create an IOC or BIOC rule exception. An indicator can include the SHA256 hash of a process, process name, process path, vendor name, user name, causality group owner (CGO) full path, or process command-line arguments. For more information about these indicators, see Rules. For each exception, you also specify the rule scope to which the exception applies." "Select Settings → Exception Configuration → IOC/BIOC Suppression Rules. Click + New Exception. Specify a Rule Name and an optional Description. etc."

    Adapted from community discussion by sharkk43 · 2024-04-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. S

       sharkk43

       2024-04-30

       3 upvotes

       I say B based on: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-IOC-or-BIOC-Rule-Exception "If you want to create a rule to take action on specific behaviors but also want to exclude one or more indicators from the rule, you can create an IOC or BIOC rule exception. An indicator can include the SHA256 hash of a process, process name, process path, vendor name, user name, causality group owner (CGO) full path, or process command-line arguments. For more information about these indicators, see Rules. For each exception, you also specify the rule scope to which the exception applies." "Select Settings → Exception Configuration → IOC/BIOC Suppression Rules. Click + New Exception. Specify a Rule Name and an optional Description. etc."

    2. D

       deyabeel22

       2024-05-01

       3 upvotes

       D: Investigate Files: You can manage file execution on your endpoints by using file hashes that are included in your allow and block lists. If you trust a certain file and know it to be benign, you can add the file hash to the allow list and allow it to be executed on all your endpoints regardless of the WildFire or local analysis verdict. Similarly, if you want to always block a file from running on any of your endpoints, you can add the associated hash to the block list.

    3. _

       _tips

       2024-03-20

       Selected D2 upvotes

       2.3.3 Outline malware protection flow https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-study-guide.pdf Hash exception - A hash exception enables you to override the verdict for a specific file without affecting the settings in your Malware Security profile. The Hash Exception policy is evaluated first and takes precedence over all other methods to determine the hash verdict. The exception does not allow Hash value

    4. Z

       Zubair2131

       2024-09-16

       1 upvote

       It's B as its only asking create an exception for Windows Endpoint.Can't be D as it will create exeption for all endpoint regardless of the Platform Type.

20. Question 20 of 25

    A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?

    • AManually remediate the problem on the endpoint in question.
    • BOpen X2go from the Cortex XDR console and delete the file via X2go.
    • CInitiate Remediate Suggestions to automatically delete the file.
    • DOpen an NFS connection from the Cortex XDR console and delete the file.

    Show answer

    Correct answer: C

    How others answered

    • C67%
    • A33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think the answer is C. See this overview from Palo Alto: https://youtu.be/HBzxmSjHYt4?si=JqjrLZkLTXBeqXpp&t=452. Here he talks about deleting a file through the Remediation Suggestions.

    Adapted from community discussion by Blahziblah · 2023-11-14 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. B

       Blahziblah

       2023-11-14

       Selected C3 upvotes

       I think the answer is C. See this overview from Palo Alto: https://youtu.be/HBzxmSjHYt4?si=JqjrLZkLTXBeqXpp&t=452. Here he talks about deleting a file through the Remediation Suggestions.

    2. C

       Chiquitabandita

       2024-03-24

       Selected C1 upvote

       yes remediation suggestions lets you delete the file, the keyword in C "automatically" is problematic for me. it is the best choice out of these though.

    3. B

       BS166

       2024-04-29

       1 upvote

       @ Blahziblah Please check your referred video. I think "A" is the right option.

21. Question 21 of 25

    What license would be required for ingesting external logs from various vendors?

    • ACortex XDR Pro per Endpoint
    • BCortex XDR Vendor Agnostic Pro
    • CCortex XDR Pro per TB
    • DCortex XDR Cloud per Host

    Show answer

    Correct answer: C

    How others answered

    • C50%
    • B50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    From CXPAG: Ingesting logs and data requires a Cortex XDR Pro per GB license. They have now changed the name of the license to "Pro per GB license" instead of TB.

    Adapted from community discussion by 9smiles · 2023-08-30 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. C

       Chiquitabandita

       2024-03-18

       Selected C1 upvote

       LICENSE TYPE: Ingesting Logs and Data from external sources requires a Cortex XDR Pro per GB license. To receive Syslog data from an external source, you must fi rst set up the Syslog Collector applet on a Broker VM within your network.

    2. 9

       9smiles

       2023-08-30

       2 upvotes

       From CXPAG: Ingesting logs and data requires a Cortex XDR Pro per GB license. They have now changed the name of the license to "Pro per GB license" instead of TB.

22. Question 22 of 25

    Which of the following paths will successfully activate Remediation Suggestions?

    • AAlerts Table > Right-click on a process node > Remediation Suggestions
    • BIncident View > Actions > Remediation Suggestions
    • CCausality View > Actions > Remediation Suggestions
    • DAlerts Table > Right-click on an alert > Remediation Suggestions

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Should be B. "You can initiate a remediation suggestions analysis from either of the following places: In the Incident View, navigate to Actions → Remediation Suggestions." https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Remediate-Changes-from-Malicious-Activity#:~:text=In%20the%20Incident%20View%2C%20navigate%20to%20Actions%20%E2%86%92%20Remediation%20Suggestions.

    Adapted from community discussion by kareem101 · 2023-11-19 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. K

       kareem101

       2023-11-19

       Selected B3 upvotes

       Should be B. "You can initiate a remediation suggestions analysis from either of the following places: In the Incident View, navigate to Actions → Remediation Suggestions." https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Remediate-Changes-from-Malicious-Activity#:~:text=In%20the%20Incident%20View%2C%20navigate%20to%20Actions%20%E2%86%92%20Remediation%20Suggestions.

    2. C

       Chiquitabandita

       2024-03-24

       Selected B2 upvotes

       Steps to navigate remediation suggestions: Step 1: Initiate a remediation analysis. You caninitiate a remediation suggestions analysis from either of the following places: ● IntheIncident View, navigate to Actions > Remediation Suggestions.

    3. D

       darylmaeb24

       2023-11-24

       2 upvotes

       But C is also a Correct one. :D Either through Causality and Incidents, you can perform Remediation Suggestions

    4. D

       darylmaeb24

       2023-11-24

       2 upvotes

       This should be B. Incidents > click the 3 dots > Remediation Suggestions

23. Question 23 of 25

    Which minimum Cortex XDR agent version is required for Kubernetes Cluster?

    • ACortex XDR 7.4
    • BCortex XDR 5.0
    • CCortex XDR 7.5
    • DCortex XDR 6.1

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    I agree with the links below. second link states it is a requirement. also both of these versions are listed as EoL, fyi

    Adapted from community discussion by Chiquitabandita · 2024-09-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. C

       Chiquitabandita

       2024-09-24

       Selected C3 upvotes

       I agree with the links below. second link states it is a requirement. also both of these versions are listed as EoL, fyi

    2. I

       ivanlean55

       2024-07-15

       2 upvotes

       Right Answer C. Compare between 7.4 and 7.5 Agent Administrator Guide, you'll find the difference https://docs-cortex.paloaltonetworks.com/v/u/Cortex-XDR-Agent-Administrator-Guide-7.4 https://docs-cortex.paloaltonetworks.com/v/u/Cortex-XDR-Agent-Administrator-Guide-7.5

24. Question 24 of 25

    What is the difference between presets and datasets in XQL?

    • AA dataset is a Cortex data lake data source only; presets are built-in data source.
    • BA dataset is a database; presets is a field.
    • CA dataset is a built-in or third party source; presets group XDR data fields.
    • DA dataset is a third-party data source; presets are built-in data source.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets Datasets - The standard, built-in data source that is available in every Cortex XDR instance is the xdr_data dataset.This dataset is comprised of both raw EDR events reported by the Cortex XDR agent, and of logs from different sources such as third-party logs. Presets - Presets offer groupings of xdr_data fields that are useful for analyzing specific areas of network and endpoint activity.

    Adapted from community discussion by MatchaLatte · 2024-03-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. M

       MatchaLatte

       2024-03-22

       Selected C2 upvotes

       C https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/Datasets-and-Presets Datasets - The standard, built-in data source that is available in every Cortex XDR instance is the xdr_data dataset.This dataset is comprised of both raw EDR events reported by the Cortex XDR agent, and of logs from different sources such as third-party logs. Presets - Presets offer groupings of xdr_data fields that are useful for analyzing specific areas of network and endpoint activity.

    2. D

       danups

       2024-09-12

       1 upvote

       I agree with "C" as the answer. Datasets can contain Cortex XDR data but also third-party data; presets are predefined configurations that help to simplify and standardize the process of creating reports and/or visualizations based on the data source (dataset)

    3. 7

       7e078ca

       2024-02-01

       1 upvote

       Use preset to use a pre-defined datasets in which data is stored from console description Answer: D

25. Question 25 of 25

    Can you disable the ability to use the Live Terminal feature in Cortex XDR?

    • AYes, via Agent Settings Profile.
    • BNo, it is a required feature of the agent.
    • CNo, a separate installer package without Live Terminal is required.
    • DYes, via the Cortex XDR console or with an installation switch.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.

    Adapted from community discussion by Chiquitabandita · 2024-03-24 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCDRA or CertExamHQ.

    1. C

       Chiquitabandita

       2024-03-24

       Selected D2 upvotes

       https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.

    2. D

       danups

       2024-09-12

       Selected D1 upvote

       If you want to prevent Cortex XSIAM from initiating Live Terminal remote sessions on an endpoint running the Cortex XDR agent, you can disable this capability during agent installation or later on through Cortex XSIAM Endpoint Administration.

    3. F

       flummoxed_individual

       2024-07-29

       Selected D1 upvote

       D is also the most logical answer. A would mean the user could disable it which defeats the purpose

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDRA practice, question 1 of 25