PCDRA practice questions 41–50

1. Question 41 · 88 in bank

   Which module provides the best visibility to view vulnerabilities?

   • ALive Terminal module
   • BDevice Control Violations module
   • CHost Insights module
   • DForensics module

   Show answer

   Answer: C

   Next question

2. Question 42 · 88 in bank

   Which of the following is NOT a precanned script provided by Palo Alto Networks?

   • Adelete_file
   • Bquarantine_file
   • Cprocess_kill_name
   • Dlist_directories

   Show answer

   Answer: B

   Next question

3. Question 43 · 88 in bank

   Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

   • ANetBIOS over TCP
   • BWebSocket
   • CUDP and a random port
   • DTCP, over port 80

   Show answer

   Answer: B

   Next question

4. Question 44 · 88 in bank

   Select 2

   You can star security events in which two ways? (Choose two.)

   • ACreate an alert-starring configuration.
   • BCreate an Incident-starring configuration.
   • CManually star an alert.
   • DManually star an Incident.

   Show answer

   Answer: AD

   Explanation

   I am confused here, the documentation says to create an incident starring configuration, but in the configuration setting it says "Create New Alert Starring Configuration"

   Source: Adapted from community discussion — _tips

   Next question

5. Question 45 · 88 in bank

   When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

   • AClick the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.
   • BThis isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.
   • CClick on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.
   • DClick on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.

   Show answer

   Answer: D

   Next question

6. Question 46 · 88 in bank

   Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

   • AFind the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
   • BFrom the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
   • CFind the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
   • DIn the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

   Show answer

   Answer: D

   Explanation

   I say B based on: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-IOC-or-BIOC-Rule-Exception "If you want to create a rule to take action on specific behaviors but also want to exclude one or more indicators from the rule, you can create an IOC or BIOC rule exception. An indicator can include the SHA256 hash of a process, process name, process path, vendor name, user name, causality group owner (CGO) full path, or process command-line arguments. For more information about these indicators, see Rules. For each exception, you also specify the rule scope to which the exception applies." "Select Settings → Exception Configuration → IOC/BIOC Suppression Rules. Click + New Exception. Specify a Rule Name and an optional Description. etc."

   Source: Adapted from community discussion — sharkk43

   Next question

7. Question 47 · 88 in bank

   As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

   • AEnable DLL Protection on all endpoints but there might be some false positives.
   • BCreate Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
   • CNo step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.
   • DNo step is required because the malicious document is already stopped.

   Show answer

   Answer: D

   Next question

8. Question 48 · 88 in bank

   When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

   • ARemediation Automation
   • BMachine Remediation
   • CAutomatic Remediation
   • DRemediation Suggestions

   Show answer

   Answer: D

   Next question

9. Question 49 · 88 in bank

   What is the purpose of the Cortex Data Lake?

   • Aa local storage facility where your logs and alert data can be aggregated
   • Ba cloud-based storage facility where your firewall logs are stored
   • Cthe interface between firewalls and the Cortex XDR agents
   • Dthe workspace for your Cortex XDR agents to detonate potential malware files

   Show answer

   Answer: B

   Next question

10. Question 50 · 88 in bank

    When creating a scheduled report which is not an option?

    • ARun weekly on a certain day and time.
    • BRun quarterly on a certain day and time.
    • CRun monthly on a certain day and time.
    • DRun daily at a certain time (selectable hours and minutes).

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCDRA practice, question 41. 88 questions available.