Palo Alto Networks Certified Detection and Remediation Analyst Exam Questions

Here you have the best Palo Alto Networks PCDRA practice exam questions.

Some things you may want to keep in mind about this practice exam questions:

You have 85 total questions to study from
Each page has 5 questions, making a total of 17 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on September 17, 2024

Question 1 of 85

Phishing belongs which of the following MITRE ATT&CK tactics?

A.

Initial Access, Persistence

B.

Persistence, Command and Control

C.

Reconnaissance, Persistence

D.

Reconnaissance, Initial Access

Correct Answer: D

Phishing is a technique used primarily for obtaining Initial Access by deceiving users into providing sensitive information or executing malicious content. It can also involve elements of Reconnaissance as the attackers may gather information about their targets to craft more convincing phishing attempts. Therefore, the correct MITRE ATT&CK tactics for Phishing are Reconnaissance and Initial Access.

Question 2 of 85

When creating a BIOC rule, which XQL query can be used?

A.

dataset = xdr_data

| filter event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

B.

dataset = xdr_data

| filter event_type = PROCESS and

event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

C.

dataset = xdr_data

| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

| fields action_process_image

D.

dataset = xdr_data

| filter event_behavior = true

event_sub_type = PROCESS_START and

action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

Correct Answer: B

When creating a BIOC rule, it is important to filter the event type and subtype accurately to ensure precise matching of events. The correct XQL query uses filters on both event_type and event_sub_type to narrow down the events accordingly. The given option correctly filters for PROCESS type events with a specific subtype (PROCESS_START) and checks if the action_process_image_name matches the given regular expression pattern.

Question 3 of 85

Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

A.

Security Manager Dashboard

B.

Data Ingestion Dashboard

C.

Security Admin Dashboard

D.

Incident Management Dashboard

Correct Answer: D

The most appropriate choice for an executive looking for the Mean Time to Resolution (MTTR) metric would be the Incident Management Dashboard. This dashboard focuses specifically on incident handling and resolution metrics, which includes MTTR, making it the best fit for the requirement.

Question 4 of 85

What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

A.

Automatically close the connections involved in malicious traffic.

B.

Automatically kill the processes involved in malicious activity.

C.

Automatically terminate the threads involved in malicious activity.

D.

Automatically block the IP addresses involved in malicious traffic.

Correct Answer: AB

In a Cortex XDR Windows Malware profile, 'Respond to Malicious Causality Chains' serves two key purposes. First, it can automatically close the connections involved in malicious traffic, thereby halting any ongoing malicious communication. Second, it has the capability to automatically kill the processes that are involved in the malicious activity, effectively stopping the malicious behavior at its source. These actions are crucial for neutralizing threats and preventing further damage to the system.

Question 5 of 85

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

A.

Click the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.

B.

This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.

C.

Click on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.

D.

Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.

Correct Answer: D

To save a custom XQL query to the Widget Library in a dashboard, the user should click on 'Save to Widget Library'. This action will prompt the user to give the query a name and description, ultimately linking the query to the Widget Library.