Paloalto Networks PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Online Training

Question #1

Phishing belongs to which of the following MITRE ATT&CK tactics?

A . Initial Access, Persistence
B . Persistence, Command and Control
C . Reconnaissance, Persistence
D . Reconnaissance, Initial Access

Reveal Solution Hide Solution

Question #2

When creating a BIOC rule, which XQL query can be used?

A . dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?.(?:pdf|docx).exe"
B . dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?.(?:pdf|docx).exe"
C . dataset = xdr_data
| filter action_process_image_name ~= ".*?.(?:pdf|docx).exe"
| fields action_process_image
D . dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?.(?:pdf|docx).exe"

Reveal Solution Hide Solution

Question #3

Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

A . Security Manager Dashboard
B . Data Ingestion Dashboard
C . Security Admin Dashboard
D . Incident Management Dashboard

Reveal Solution Hide Solution

Question #4

What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

A . Automatically close the connections involved in malicious traffic.
B . Automatically kill the processes involved in malicious activity.
C . Automatically terminate the threads involved in malicious activity.
D . Automatically block the IP addresses involved in malicious traffic.

Reveal Solution Hide Solution

Question #5

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

A . Click the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.
B . This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.
C . Click on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.
D . Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.

Reveal Solution Hide Solution

Question #6

What license would be required for ingesting external logs from various vendors?

A . Cortex XDR Pro per Endpoint
B . Cortex XDR Vendor Agnostic Pro
C . Cortex XDR Pro per TB
D . Cortex XDR Cloud per Host

Reveal Solution Hide Solution

Question #7

An attacker tries to load dynamic libraries on macOS from an unsecure location.

Which Cortex XDR module can prevent this attack?

A . DDL Security
B . Hot Patch Protection
C . Kernel Integrity Monitor (KIM)
D . Dylib Hijacking

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

The correct answer is

D. Dylib Hijacking. Dylib Hijacking, also known as Dynamic Library Hijacking, is a technique used by attackers to load malicious dynamic libraries on macOS from an unsecure location. This technique takes advantage of the way macOS searches for dynamic libraries to load when an application is executed. To prevent such attacks, Palo Alto Networks offers the Dylib Hijacking prevention capability as part of their Cortex XDR platform. This capability is designed to detect and block attempts to load dynamic libraries from unauthorized or unsecure locations1.

Let’s briefly discuss the other options to provide a comprehensive explanation:

A) DDL Security: This is not the correct answer. DDL Security is not specifically designed to prevent dynamic library loading attacks on macOS. DDL Security is focused on protecting against DLL (Dynamic Link Library) hijacking on Windows systems2.

B) Hot Patch Protection: Hot Patch Protection is not directly related to preventing dynamic library loading attacks. It is a security feature that protects against runtime patching or modification of code in memory, often used by advanced attackers to bypass security measures3. While Hot Patch Protection is a valuable security feature, it is not directly relevant to the scenario described.

C) Kernel Integrity Monitor (KIM): Kernel Integrity Monitor is also not the correct answer. KIM is a module in Cortex XDR that focuses on monitoring and protecting the integrity of the macOS kernel. It detects and prevents unauthorized modifications to critical kernel components4. While KIM plays an essential role in overall macOS security, it does not specifically address the prevention of dynamic library loading attacks.

In conclusion, Dylib Hijacking is the Cortex XDR module that specifically addresses the prevention of attackers loading dynamic libraries from unsecure locations on macOS. By leveraging this module, organizations can enhance their security posture and protect against this specific attack vector.

Reference: Endpoint Protection Modules DDL Security

Hot Patch Protection Kernel Integrity Monitor

Question #8

What is the purpose of the Unit 42 team?

A . Unit 42 is responsible for automation and orchestration of products
B . Unit 42 is responsible for the configuration optimization of the Cortex XDR server
C . Unit 42 is responsible for threat research, malware analysis and threat hunting
D . Unit 42 is responsible for the rapid deployment of Cortex XDR agents

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Unit 42 is the threat intelligence and response team of Palo Alto Networks. The purpose of Unit 42 is to collect and analyze the most up-to-date threat intelligence and apply it to respond to cyberattacks. Unit 42 is composed of world-renowned threat researchers, incident responders and security consultants who help organizations proactively manage cyber risk. Unit 42 is responsible for threat research, malware analysis and threat hunting, among other activities12. Let’s briefly discuss the other options to provide a comprehensive explanation:

A) Unit 42 is not responsible for automation and orchestration of products. Automation and orchestration are capabilities that are provided by Palo Alto Networks products such as Cortex XSOAR, which is a security orchestration, automation and response platform that helps security teams automate tasks, coordinate actions and manage incidents3.

B) Unit 42 is not responsible for the configuration optimization of the Cortex XDR server. The Cortex XDR server is the cloud-based platform that provides detection and response capabilities across network, endpoint and cloud data sources. The configuration optimization of the Cortex XDR server is the responsibility of the Cortex XDR administrators, who can use the Cortex XDR app to manage the settings and policies of the Cortex XDR server4.

C) Unit 42 is not responsible for the rapid deployment of Cortex XDR agents. The Cortex XDR agents are the software components that are installed on endpoints to provide protection and visibility. The rapid deployment of Cortex XDR agents is the responsibility of the Cortex XDR administrators, who can use various methods such as group policy objects, scripts, or third-party tools to deploy the Cortex XDR agents to multiple endpoints5.

In conclusion, Unit 42 is the threat intelligence and response team of Palo Alto Networks that is responsible for threat research, malware analysis and threat hunting. By leveraging the expertise and insights of Unit 42, organizations can enhance their security posture and protect against the latest cyberthreats.

Reference: About Unit 42: Our Mission and Team

Unit 42: Threat Intelligence & Response Cortex XSOAR

Cortex XDR Pro Admin Guide: Manage Cortex XDR Settings and Policies

Cortex XDR Pro Admin Guide: Deploy Cortex XDR Agents

Question #9

Which Type of IOC can you define in Cortex XDR?

A . destination port
B . e-mail address
C . full path
D . App-ID

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Cortex XDR allows you to define IOCs based on various criteria, such as file hashes, registry keys, IP addresses, domain names, and full paths. A full path IOC is a specific location of a file or folder on an endpoint, such as C:WindowsSystem32calc.exe. You can use full path IOCs to detect and respond to malicious files or folders that are located in known locations on your endpoints12.

Let’s briefly discuss the other options to provide a comprehensive explanation:

A) destination port: This is not the correct answer. Destination port is not a type of IOC that you can define in Cortex XDR. Destination port is a network attribute that indicates the port number to which a packet is sent. Cortex XDR does not support defining IOCs based on destination ports, but you can use XQL queries to filter network events by destination ports3.

B) e-mail address: This is not the correct answer. E-mail address is not a type of IOC that you can define in Cortex XDR. E-mail address is an identifier that is used to send and receive e-mails. Cortex XDR does not support defining IOCs based on e-mail addresses, but you can use the Cortex XDR – IOC integration with Cortex XSOAR to ingest IOCs from various sources, including e-mail addresses4.

D) App-ID: This is not the correct answer. App-ID is not a type of IOC that you can define in Cortex XDR. App-ID is a feature of Palo Alto Networks firewalls that identifies and controls applications on the network. Cortex XDR does not support defining IOCs based on App-IDs, but you can use the Cortex XDR Analytics app to create custom rules that use App-IDs as part of the rule logic5.

In conclusion, full path is the type of IOC that you can define in Cortex XDR. By using full path IOCs, you can enhance your detection and response capabilities and protect your endpoints from malicious files or folders.

Reference: Create an IOC Rule

XQL Reference Guide: Network Events Schema Cortex XDR – IOC

Cortex XDR Analytics App

PCDRA: Which Type of IOC can define in Cortex XDR?

Question #10

When viewing the incident directly, what is the “assigned to” field value of a new Incident that was just reported to Cortex?

A . Pending
B . It is blank
C . Unassigned
D . New

Reveal Solution Hide Solution

Paloalto Networks PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Online Training