PCDRA Exam Questions

Phishing belongs which of the following MITRE ATT&CK tactics?

When creating a BIOC rule, which XQL query can be used?

Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

What license would be required for ingesting external logs from various vendors?

An attacker tries to load dynamic libraries on macOS from an unsecure location. Which Cortex XDR module can prevent this attack?

What is the purpose of the Unit 42 team?

Which Type of IOC can you define in Cortex XDR?

When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?

In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

Where would you view the WildFire report in an incident?

What does the following output tell us?

What is the standard installation disk space recommended to install a Broker VM?

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

How does Cortex XDR agent for Windows prevent ransomware attacks from compromising the file system?

What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?

In the deployment of which Broker VM applet are you required to install a strong cipher SHA256- based SSL certificate?

When is the wss (WebSocket Secure) protocol used?

With a Cortex XDR Prevent license, which objects are considered to be sensors?

Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Which statement is true for Application Exploits and Kernel Exploits?

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

Which of the following is an example of a successful exploit?

Which of the following represents the correct relation of alerts to incidents?

Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?

Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

After scan, how does file quarantine function work on an endpoint?

Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

Which profiles can the user use to configure malware protection in the Cortex XDR console?

Which module provides the best visibility to view vulnerabilities?

Which of the following is NOT a precanned script provided by Palo Alto Networks?

Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

You can star security events in which two ways? (Choose two.)

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report...

When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

What is the purpose of the Cortex Data Lake?

When creating a scheduled report which is not an option?

Which statement regarding scripts in Cortex XDR is true?

What is the function of WildFire for Cortex XDR?

What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

What is an example of an attack vector for ransomware?

What should you do to automatically convert leads into alerts after investigating a lead?

When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose two.)

Which function describes the removal of a specific file from its location on a local or removable drive to a protected folder to prevent the file from being executed?

What is the maximum number of agents one Broker VM local agent applet can support?

Which of the following represents a common sequence of cyber attack tactics?

Which Exploit Protection Module (EPM) can be used to prevent attacks based on OS function?

Which statement is correct based on the report output below?