Question 81 · 88 in bank
How can you pivot within a row to Causality view and Timeline views for further investigate?
Show answer
Answer: C
Palo Alto Networks Certified Detection and Remediation Analyst88 questions across 9 pages are complete and free, with no account or card.
88 questions in this bank
Free access · progress saved on this device
How can you pivot within a row to Causality view and Timeline views for further investigate?
Answer: C
What motivation do ransomware attackers have for returning access to systems once their victims have paid?
Answer: A
What is the WildFire analysis file size limit for Windows PE files?
Answer: B
Which Exploit Prevention Module (EPM) provides better entropy for randomization of memory locations?
Answer: A
To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?
Answer: B
The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?
Answer: D
"for ALL endpoints" means either B or D. I've never heard of creating an inclusion before, but definitely an exception. And exclusion will only suppress alerts but still block the exe
Source: Adapted from community discussion — flummoxed_individual
What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?
Answer: C
Can you disable the ability to use the Live Terminal feature in Cortex XDR?
Answer: D
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.7/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-Agent-Manually You can permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Initiate a Live Terminal Session remote session on the endpoint, Run Scripts on an Endpoint on the endpoint, and Retrieve Files from an Endpoint from the endpoint to Cortex XDR. Disabling any of these payloads in the Config.xml file is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall your Cortex XDR agent and install a new agent with the corresponding values in the Config.xml file.
Source: Adapted from community discussion — Chiquitabandita
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCDRA practice, question 81. 88 questions available.
Version 1.0.0. How we source questions