PCDRA Dumps Questions – Effective Way to Get Certified

If you're in the field of Paloalto Networks, you know how important it is to stay up-to-date with the latest knowledge and skills to protect your organization's networks and data. One way to do that is by obtaining Palo Alto Certifications and Accreditations, specifically the PCDRA exam. While preparing for the PCDRA exam, you might consider using PCDRA dumps to help you familiarize yourself with the exam format and content. These PCDRA exam dumps questions can be an effective way to gauge your knowledge and identify areas where you may need additional study. Study online free PCDRA exam dumps below.

Page 1 of 3

1. What motivation do ransomware attackers have for returning access to systems once their victims have paid?

There is organized crime governance among attackers that requires the return of access to remain in good standing.

Nation-states enforce the return of system access through the use of laws and regulation.

Failure to restore access to systems undermines the scheme because others will not believe their valuables would be returned.

The ransomware attackers hope to trace the financial trail back and steal more from traditional banking institutions. -

 Loading...

2. Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

NetBIOS over TCP

WebSocket

UDP and a random port

TCP, over port 80

 Loading...

3. In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer.

What is one way to add an exception for the singer?

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

 Loading...

4. Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response --> Action Center

under the gear icon --> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

 Loading...

5. Which search methods is supported by File Search and Destroy?

File Seek and Destroy

File Search and Destroy

File Seek and Repair

File Search and Repair

 Loading...

6. When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

Click the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.

This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.

Click on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.

Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.

 Loading...

7. In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

Create a custom XQL widget

This is not currently supported

Create a custom report and filter on starred incidents

Click the star in the widget

 Loading...

8. When creating a scheduled report which is not an option?

Run weekly on a certain day and time.

Run quarterly on a certain day and time.

Run monthly on a certain day and time.

Run daily at a certain time (selectable hours and minutes).

 Loading...

9. Which profiles can the user use to configure malware protection in the Cortex XDR console?

Malware Protection profile

Malware profile

Malware Detection profile

Anti-Malware profile

 Loading...

10. What kind of the threat typically encrypts user files?

ransomware

SQL injection attacks

Zero-day exploits

supply-chain attacks

 Loading...

Page 2 of 3

11. You can star security events in which two ways? (Choose two.)

Create an alert-starring configuration.

Create an Incident-starring configuration.

Manually star an alert.

Manually star an Incident.

 Loading...

12. After scan, how does file quarantine function work on an endpoint?

Quarantine takes ownership of the files and folders and prevents execution through access control.

Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XD

 Loading...

13. With a Cortex XDR Prevent license, which objects are considered to be sensors?

Syslog servers

Third-Party security devices

Cortex XDR agents

Palo Alto Networks Next-Generation Firewalls

 Loading...

14. Under which conditions is Local Analysis evoked to evaluate a file before the file is allowed to run?

The endpoint is disconnected or the verdict from WildFire is of a type benign.

The endpoint is disconnected or the verdict from WildFire is of a type unknown.

The endpoint is disconnected or the verdict from WildFire is of a type malware.

The endpoint is disconnected or the verdict from WildFire is of a type grayware.

 Loading...

15. What license would be required for ingesting external logs from various vendors?

Cortex XDR Pro per Endpoint

Cortex XDR Vendor Agnostic Pro

Cortex XDR Pro per TB

Cortex XDR Cloud per Host

 Loading...

16. Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three-hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

 Loading...

17. The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign.

Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?

Create an individual alert exclusion.

Create a global inclusion.

Create an endpoint-specific exception.

Create a global exception.

 Loading...

18. Which module provides the best visibility to view vulnerabilities?

Live Terminal module

Device Control Violations module

Host Insights module

Forensics module

 Loading...

19. Which version of python is used in live terminal?

Python 2 and 3 with standard Python libraries

Python 2 and 3 with specific XDR Python libraries developed by Palo Alto Networks

Python 3 with specific XDR Python libraries developed by Palo Alto Networks

Python 3 with standard Python libraries

 Loading...

20. What should you do to automatically convert leads into alerts after investigating a lead?

Lead threats can't be prevented in the future because they already exist in the environment.

Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Build a search query using Query Builder or XQL using a list of lOCs.

 Loading...

Page 3 of 3

21. Which of the following is an example of a successful exploit?

connecting unknown media to an endpoint that copied malware due to Autorun.

a user executing code which takes advantage of a vulnerability on a local service.

identifying vulnerable services on a server.

executing a process executable for well-known and signed software.

 Loading...

22. When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

Assign incidents to an analyst in bulk.

Change the status of multiple incidents.

Investigate several Incidents at once.

Delete the selected Incidents.

 Loading...

23. Which statement is true based on the following Agent Auto Upgrade widget?

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than In Progress status.

 Loading...

24. As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it.

What steps can you take to ensure that the same protection is extended to all your servers?

Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.

Enable DLL Protection on all servers but there might be some false positives.

Create IOCs of the malicious files you have found to prevent their execution.

Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

 Loading...

25. A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate.

Which statement is correct for the incident?

It is true positive.

It is false positive.

It is a false negative.

It is true negative.

 Loading...

26. What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

Netflow Collector

Syslog Collector

DB Collector

Pathfinder

 Loading...

27. What is the maximum number of agents one Broker VM local agent applet can support?

5,000

10,000

15,000

20,000

 Loading...

28. What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automatically block the IP addresses involved in malicious traffic.

 Loading...

 Loading...