PCDRA practice questions 21–30

1. Question 21 · 88 in bank

   What kind of the threat typically encrypts user files?

   • Aransomware
   • BSQL injection attacks
   • CZero-day exploits
   • Dsupply-chain attacks

   Show answer

   Answer: A

   Next question

2. Question 22 · 88 in bank

   When using the “File Search and Destroy” feature, which of the following search hash type is supported?

   • ASHA256 hash of the file
   • BAES256 hash of the file
   • CMD5 hash of the file
   • DSHA1 hash of the file

   Show answer

   Answer: A

   Explanation

   https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Search-and-Destroy-Malicious-Files Search File section To search by hash, enter the file SHA256 value. When you search by hash, you can also search for deleted instances of this file on the endpoint.

   Source: Adapted from community discussion — _tips

   Next question

3. Question 23 · 88 in bank

   Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

   • ASecurity Manager Dashboard
   • BData Ingestion Dashboard
   • CSecurity Admin Dashboard
   • DIncident Management Dashboard

   Show answer

   Answer: C

   Next question

4. Question 24 · 88 in bank

   If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

   • ABroker VM Pathfinder
   • BLocal Agent Proxy
   • CLocal Agent Installer and Content Caching
   • DBroker VM Syslog Collector

   Show answer

   Answer: B

   Explanation

   B. Cortex XDR in restricted networks where endpoints do not have a direct connection to the internet, setup the Broker VM to act as a proxy

   Source: Adapted from community discussion — b1gd1g

   Next question

5. Question 25 · 88 in bank

   What is by far the most common tactic used by ransomware to shut down a victim’s operation?

   • Apreventing the victim from being able to access APIs to cripple infrastructure
   • Bdenying traffic out of the victims network until payment is received
   • Crestricting access to administrative accounts to the victim
   • Dencrypting certain files to prevent access by the victim

   Show answer

   Answer: D

   Next question

6. Question 26 · 88 in bank

   Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.

   • AExfiltration, Command and Control, Collection
   • BExfiltration, Command and Control, Privilege Escalation
   • CExfiltration, Command and Control, Impact
   • DExfiltration, Command and Control, Lateral Movement

   Show answer

   Answer: D

   Next question

7. Question 27 · 88 in bank

   Select 2

   When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

   • AAssign incidents to an analyst in bulk.
   • BChange the status of multiple incidents.
   • CInvestigate several Incidents at once.
   • DDelete the selected Incidents.

   Show answer

   Answer: AB

   Explanation

   A, B https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Incidents Check box to select one or more incidents on which to perform the following actions. - Assign incidents to an analyst in bulk - Change the status of multiple incidents - Change the severity of multiple incidents

   Source: Adapted from community discussion — MatchaLatte

   Next question

8. Question 28 · 88 in bank

   A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

   • AIt is true positive.
   • BIt is false positive.
   • CIt is a false negative.
   • DIt is true negative.

   Show answer

   Answer: B

   Next question

9. Question 29 · 88 in bank

   What is the outcome of creating and implementing an alert exclusion?

   • AThe Cortex XDR agent will allow the process that was blocked to run on the endpoint.
   • BThe Cortex XDR console will hide those alerts.
   • CThe Cortex XDR agent will not create an alert for this event in the future.
   • DThe Cortex XDR console will delete those alerts and block ingestion of them in the future.

   Show answer

   Answer: B

   Next question

10. Question 30 · 88 in bank

    Which statement is true for Application Exploits and Kernel Exploits?

    • AThe ultimate goal of any exploit is to reach the application.
    • BKernel exploits are easier to prevent then application exploits.
    • CThe ultimate goal of any exploit is to reach the kernel.
    • DApplication exploits leverage kernel vulnerability.

    Show answer

    Answer: C

    Explanation

    It's clearly stated in Beacon > Cortex XDR 3: Getting Started with Endpoint Protection > Cortex XDR 3: Exploit Protection > Application Exploit Prevention > Application Exploits and Kernel Exploits https://beacon.paloaltonetworks.com/uploads/resource_courses/targets/2394329/original/index.html?_courseId=905962#/page/612c6346db387a0de433778d

    Source: Adapted from community discussion — 0707bc6

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDRA practice, question 21. 88 questions available.