Palo Alto Networks Certified Detection and Remediation Analyst88 questions across 9 pages are complete and free, with no account or card.
88 questions in this bank
Free access · progress saved on this device
Which statement regarding scripts in Cortex XDR is true?
Answer: B
I think B. A is wrong for sure, you need at least Python 3.7 to run scripts on your endpoint directly. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Run-Scripts-on-an-Endpoint
Source: Adapted from community discussion — Davina07
What is the function of WildFire for Cortex XDR?
Answer: C
A Linux endpoint with a Cortex XDR Pro per Endpoint license and Enhanced Endpoint Data enabled has reported malicious activity, resulting in the creation of a file that you wish to delete. Which action could you take to delete the file?
Answer: C
I think the answer is C. See this overview from Palo Alto: https://youtu.be/HBzxmSjHYt4?si=JqjrLZkLTXBeqXpp&t=452. Here he talks about deleting a file through the Remediation Suggestions.
Source: Adapted from community discussion — Blahziblah
Which of the following best defines the Windows Registry as used by the Cortex XDR agent?
Answer: A
Which statement best describes how Behavioral Threat Protection (BTP) works?
Answer: C
The answer should be C. See the following documention by Palo Alto: 1) "BTP prevents sophisticated attacks that leverage built-in OS executables and common administration utilities by continuously monitoring endpoint activity for malicious causality chains" 2) "Palo Alto Networks researchers define the causality chains that are malicious and distribute those chains as behavioral threat rules. When the Cortex XDR agent detects a match to a behavioral threat protection rule, the Cortex XDR agent carries out the configured action (default is Block)." 1) https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection-Capabilities 2) https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-a-New-Malware-Security-Profile
Source: Adapted from community discussion — Lukinator
What license would be required for ingesting external logs from various vendors?
Answer: C
From CXPAG: Ingesting logs and data requires a Cortex XDR Pro per GB license. They have now changed the name of the license to "Pro per GB license" instead of TB.
Source: Adapted from community discussion — 9smiles
Which of the following paths will successfully activate Remediation Suggestions?
Answer: B
Should be B. "You can initiate a remediation suggestions analysis from either of the following places: In the Incident View, navigate to Actions → Remediation Suggestions." https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Remediate-Changes-from-Malicious-Activity#:~:text=In%20the%20Incident%20View%2C%20navigate%20to%20Actions%20%E2%86%92%20Remediation%20Suggestions.
Source: Adapted from community discussion — kareem101
In Cortex XDR management console scheduled reports can be forwarded to which of the following applications/services?
Answer: B
Which type of IOC can you define in Cortex XDR?
Answer: B
What is an example of an attack vector for ransomware?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCDRA practice, question 51. 88 questions available.
Version 1.0.0. How we source questions