Download PCDRA Dumps (2024) - Free PDF Exam Demo
Enhance your career with PCDRA PDF Dumps - True Palo Alto Networks Exam Questions
NEW QUESTION # 40
Live Terminal uses which type of protocol to communicate with the agent on the endpoint?
- A. UDP and a random port
- B. NetBIOS over TCP
- C. TCP, over port 80
- D. WebSocket
Answer: D
Explanation:
Explanation
Live Terminal uses the WebSocket protocol to communicate with the agent on the endpoint. WebSocket is a full-duplex communication protocol that enables bidirectional data exchange between a client and a server over a single TCP connection. WebSocket is designed to be implemented in web browsers and web servers, but it can be used by any client or server application. WebSocket provides a persistent connection between the Cortex XDR console and the endpoint, allowing you to execute commands and receive responses in real time.
Live Terminal uses port 443 for WebSocket communication, which is the same port used for HTTPS traffic.
References:
* Initiate a Live Terminal Session
* WebSocket
NEW QUESTION # 41
Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?
- A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.
- B. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.
- C. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.
- D. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.
Answer: A
NEW QUESTION # 42
Which type of BIOC rule is currently available in Cortex XDR?
- A. Network
- B. Threat Actor
- C. Dropper
- D. Discovery
Answer: C
NEW QUESTION # 43
What is the purpose of targeting software vendors in a supply-chain attack?
- A. to steal users' login credentials.
- B. to access source code.
- C. to report Zero-day vulnerabilities.
- D. to take advantage of a trusted software delivery method.
Answer: D
Explanation:
Explanation
A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers services or software vital to the supply chain. Software supply chain attacks inject malicious code into an application in order to infect all users of an app. The purpose of targeting software vendors in a supply-chain attack is to take advantage of a trusted software delivery method, such as an update or a download, that can reach a large number of potential victims. By compromising a software vendor, an attacker can bypass the security measures of the downstream organizations and gain access to their systems, data, or networks. References:
* What Is a Supply Chain Attack? - Definition, Examples & More | Proofpoint US
* What Is a Supply Chain Attack? - CrowdStrike
* What Is a Supply Chain Attack? | Zscaler
* What Is a Supply Chain Attack? Definition, Examples & Prevention
NEW QUESTION # 44
What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)
- A. Automatically kill the processes involved in malicious activity.
- B. Automatically block the IP addresses involved in malicious traffic.
- C. Automatically terminate the threads involved in malicious activity.
- D. Automatically close the connections involved in malicious traffic.
Answer: B,D
Explanation:
Reference:
%20threat%20protection%2C%20the,appear%20legitimate%20if%20inspected%20individually
NEW QUESTION # 45
Which two types of exception profiles you can create in Cortex XDR? (Choose two.)
- A. agent exception profiles that apply to specific endpoints
- B. exception profiles that apply to specific endpoints
- C. role-based profiles that apply to specific endpoints
- D. global exception profiles that apply to all endpoints
Answer: B,D
NEW QUESTION # 46
Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?
- A. Cortex XDR Pro per Endpoint
- B. Host Insights
- C. Cortex XDR Cloud per Host
- D. Cortex XDR Pro per TB
Answer: C
NEW QUESTION # 47
What is the standard installation disk space recommended to install a Broker VM?
- A. 512GB disk space
- B. 1GB disk space
- C. 2GB disk space
- D. 256GB disk space
Answer: A
NEW QUESTION # 48
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?
- A. Enable DLL Protection on all servers but there might be some false positives.
- B. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
- C. Create IOCs of the malicious files you have found to prevent their execution.
- D. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
Answer: B
NEW QUESTION # 49
What is the standard installation disk space recommended to install a Broker VM?
- A. 512GB disk space
- B. 1GB disk space
- C. 256GB disk space
- D. 2GB disk space
Answer: C
Explanation:
Explanation
The Broker VM for Cortex XDR is a virtual machine that serves as the central communication hub for all Cortex XDR agents deployed in your organization. It enables agents to communicate with the Cortex XDR cloud service and allows you to manage and monitor the agents' activities from a centralized location. The system requirements for the Broker VM are as follows:
* CPU: 4 cores
* RAM: 8 GB
* Disk space: 256 GB
* Network: Internet access and connectivity to all Cortex XDR agents
The disk space requirement is based on the number of agents and the frequency of content updates. The Broker VM stores the content updates locally and distributes them to the agents. The disk spacealso depends on the retention period of the content updates, which can be configured in the Broker VM settings. The default retention period is 30 days.
References:
* Broker VM for Cortex XDR
* PCDRA Study Guide
NEW QUESTION # 50
In incident-related widgets, how would you filter the display to only show incidents that were "starred"?
- A. Create a custom report and filter on starred incidents
- B. Click the star in the widget
- C. Create a custom XQL widget
- D. This is not currently supported
Answer: B
Explanation:
Reference:
%20you%20clear%20the%20star
NEW QUESTION # 51
What kind of the threat typically encrypts user files?
- A. supply-chain attacks
- B. SQL injection attacks
- C. Zero-day exploits
- D. ransomware
Answer: D
NEW QUESTION # 52
Which minimum Cortex XDR agent version is required for Kubernetes Cluster?
- A. Cortex XDR 6.1
- B. Cortex XDR 5.0
- C. Cortex XDR 7.4
- D. Cortex XDR 7.5
Answer: D
Explanation:
Explanation
The minimum Cortex XDR agent version required for Kubernetes Cluster is Cortex XDR 7.5. This version introduces the Cortex XDR agent for Kubernetes hosts, which provides protection and visibility for Linux hosts that run on Kubernetes clusters. The Cortex XDR agent for Kubernetes hosts supports the following features:
* Anti-malware protection
* Behavioral threat protection
* Exploit protection
* File integrity monitoring
* Network security
* Audit and remediation
* Live terminal
To install the Cortex XDR agent for Kubernetes hosts, you need to deploy the Cortex XDR agent as a DaemonSet on your Kubernetes cluster. You also need to configure the agent settings profile and the agent installer in the Cortex XDR management console. References:
* Cortex XDR Agent Release Notes: This document provides the release notes for Cortex XDR agent versions, including the new features, enhancements, and resolved issues.
* Install the Cortex XDR Agent for Kubernetes Hosts: This document explains how to install and configure the Cortex XDR agent for Kubernetes hosts using the Cortex XDR management console and the Kubernetes command-line tool.
NEW QUESTION # 53
What is the difference between presets and datasets in XQL?
- A. A dataset is a built-in orthird-partysource; presets group XDR data fields.
- B. A dataset is a Cortex data lake data source only; presets are built-in data source.
- C. A dataset is a database; presets is a field.
- D. A dataset is a third-party data source; presets are built-in data source.
Answer: A
Explanation:
Explanation
The difference between presets and datasets in XQL is that a dataset is a built-in or third-party data source, while a preset is a group of XDR data fields. A dataset is a collection of data that you can query and analyze using XQL. A dataset can be a Cortex data lake data source, such as endpoints, alerts, incidents, or network flows, or a third-party data source, such as AWS CloudTrail, Azure Activity Logs, or Google Cloud Audit Logs. A preset is a predefined set of XDR data fields that are relevant for a specific use case, such as process execution, file operations, or network activity. A preset can help you simplify and standardize your XQL queries by selecting the most important fields for youranalysis. You can use presets with any Cortex data lake data source, but not with third-party data sources. References:
* Datasets and Presets
* XQL Language Reference
NEW QUESTION # 54
What kind of malware uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim?
- A. Keylogger
- B. Ransomware
- C. Rootkit
- D. Worm
Answer: B
Explanation:
Explanation
The kind of malware that uses encryption, data theft, denial of service, and possibly harassment to take advantage of a victim is ransomware. Ransomware is a type of malware that encrypts the victim's files or blocks access to their system, and then demands a ransom for the decryption key or the restoration of access.
Ransomware can also threaten to expose or delete the victim's data if the ransom is not paid. Ransomware can cause significant damage and disruption to individuals, businesses, and organizations, and can be difficult to remove or recover from. Some examples of ransomware are CryptoLocker, WannaCry, Ryuk, and REvil.
References:
* 12 Types of Malware + Examples That You Should Know - CrowdStrike
* What is Malware? Malware Definition, Types and Protection
* 12+ Types of Malware Explained with Examples (Complete List)
NEW QUESTION # 55
In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?
- A. Create a new rule exception and use the singer as the characteristic.
- B. Add the signer to the allow list under the action center page.
- C. Add the signer to the allow list in the malware profile.
- D. In the Restrictions Profile, add the file name and path to the Executable Files allow list.
Answer: C
NEW QUESTION # 56
When creating a scheduled report which is not an option?
- A. Run daily at a certain time (selectable hours and minutes).
- B. Run monthly on a certain day and time.
- C. Run weekly on a certain day and time.
- D. Run quarterly on a certain day and time.
Answer: D
NEW QUESTION # 57
......
100% Free PCDRA Files For passing the exam Quickly: https://pdftorrent.dumpexams.com/PCDRA-vce-torrent.html