nerdexam
Palo_Alto_Networks

PCDRA · Question #60

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection…

The correct answer is C. Create IOCs of the malicious files you have found to prevent their execution. To extend protection against a known Cobalt Strike attack and prevent its spread, creating Indicators of Compromise (IOCs) from the detected malicious files is the most effective immediate action.

Submitted by ravi_2018· Apr 18, 2026Investigation and Response

Question

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection is extended to all your servers?

Options

  • AEnable DLL Protection on all servers but there might be some false positives.
  • BConduct a thorough Endpoint Malware scan.
  • CCreate IOCs of the malicious files you have found to prevent their execution.
  • DEnable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    86% (25)
  • D
    7% (2)

Why each option

To extend protection against a known Cobalt Strike attack and prevent its spread, creating Indicators of Compromise (IOCs) from the detected malicious files is the most effective immediate action.

AEnable DLL Protection on all servers but there might be some false positives.

While DLL Protection is a security feature, enabling it generally might introduce false positives and is not the most targeted response to a specific known malicious file from a prevented attack.

BConduct a thorough Endpoint Malware scan.

A thorough endpoint malware scan is a reactive measure to find existing threats, not a proactive step to prevent future executions of a known-bad file.

CCreate IOCs of the malicious files you have found to prevent their execution.Correct

Creating IOCs (e.g., file hashes, process names, network connections) for the specific malicious files or behaviors identified in the prevented Cobalt Strike attack allows Cortex XDR to proactively block these known threats across all endpoints in the environment. This ensures that any server attempting to execute these specific malicious components will be prevented.

DEnable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Behavioral Threat Protection (BTP) is generally enabled by default for proactive detection, and `cytool` is a local agent utility for troubleshooting, not a method to extend configuration for BTP across all servers to specifically prevent this known attack.

Concept tested: Proactive threat prevention using IOCs

Source: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Indicator-of-Compromise-IOC-Definitions

Topics

#IOCs#Threat Prevention#Cortex XDR Response#Cobalt Strike

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCDRA Practice