Use PCDRA Exam Dumps (2023 PDF Dumps) To Have Reliable PCDRA Test Engine [Q16-Q34]

4/5 - (2 votes)

Use PCDRA Exam Dumps (2023 PDF Dumps) To Have Reliable PCDRA Test Engine

PCDRA PDF Recently Updated Questions Dumps to Improve Exam Score

NO.16 If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

Broker VM Pathfinder

Local Agent Proxy

Local Agent Installer and Content Caching

Broker VM Syslog Collector

NO.17 In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

NO.18 What is the function of WildFire for Cortex XDR?

WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.

WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.

WildFire accepts and analyses a sample to provide a verdict.

WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.

NO.19 Which Type of IOC can you define in Cortex XDR?

destination port

e-mail address

full path

App-ID

NO.20 While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

NO.21 What is the purpose of the Cortex Data Lake?

a local storage facility where your logs and alert data can be aggregated

a cloud-based storage facility where your firewall logs are stored

the interface between firewalls and the Cortex XDR agents

the workspace for your Cortex XDR agents to detonate potential malware files

NO.22 When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

Pending

It is blank

Unassigned

New

NO.23 Which license is required when deploying Cortex XDR agent on Kubernetes Clusters as a DaemonSet?

Cortex XDR Pro per TB

Host Insights

Cortex XDR Pro per Endpoint

Cortex XDR Cloud per Host

NO.24 Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

exception profiles that apply to specific endpoints

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

role-based profiles that apply to specific endpoints

NO.25 When using the “File Search and Destroy” feature, which of the following search hash type is supported?

SHA256 hash of the file

AES256 hash of the file

MD5 hash of the file

SHA1 hash of the file

NO.26 What is the standard installation disk space recommended to install a Broker VM?

1GB disk space

2GB disk space

512GB disk space

256GB disk space

NO.27 To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

causality_chain

endpoint_name

threat_event

event_type

NO.28 Which of the following policy exceptions applies to the following description?
‘An exception allowing specific PHP files’

Support exception

Local file threat examination exception

Behavioral threat protection rule exception

Process exception

NO.29 What is the outcome of creating and implementing an alert exclusion?

The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

The Cortex XDR console will hide those alerts.

The Cortex XDR agent will not create an alert for this event in the future.

The Cortex XDR console will delete those alerts and block ingestion of them in the future.

NO.30 Which of the following is NOT a precanned script provided by Palo Alto Networks?

delete_file

quarantine_file

process_kill_name

list_directories

NO.31 A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

It is true positive.

It is false positive.

It is a false negative.

It is true negative.

NO.32 Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.

Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.

Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

NO.33 In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?

Agent Proxy

Agent Installer and Content Caching

Syslog Collector

CSV Collector

NO.34 When creating a BIOC rule, which XQL query can be used?

dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

dataset = xdr_data
| filter action_process_image_name ~= “.*?.(?:pdf|docx).exe”
| fields action_process_image

dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?.(?:pdf|docx).exe”

Loading …

PCDRA Dumps Full Questions with Free PDF Questions to Pass: https://www.prepawaypdf.com/Palo-Alto-Networks/PCDRA-practice-exam-dumps.html

Pass Your Palo Alto Networks PSE-Strata Exam with Correct 140 Questions and Answers [Q43-Q66]

Use PCDRA Exam Dumps (2023 PDF Dumps) To Have Reliable PCDRA Test Engine [Q16-Q34]

admin

Leave a Reply Cancel reply

Related posts:

admin

You might also like

Leave a Reply Cancel reply