Best Tips To Pass Palo Alto Networks PCDRA Certification Exam

test2022-04-07T06:05:03+00:00

PCDRA certification is the first of its kind credential to cover foundational knowledge of industry recognized Cybersecurity and Endpoint security concepts as well as various cutting-edge advancements across all Palo Alto Networks technologies. To pass the PCDRA certification, you’ll need to download the most recent PCDRA exam dumps, which will help you pass the test without difficulty. We update our PCDRA Exam Questions regularly, and the following is a sample of the most recent PCDRA Exam Questions added to our PCDRA Exam preparation solutions.

Try PCDRA practice exam below for free! You will face them on the actual exam!

Page 1 of 2

1. What is the standard installation disk space recommended to install a Broker VM?

1GB disk space

2GB disk space

512GB disk space

256GB disk space

2. Which two types of exception profiles you can create in Cortex XDR? (Choose two.)

exception profiles that apply to specific endpoints

agent exception profiles that apply to specific endpoints

global exception profiles that apply to all endpoints

role-based profiles that apply to specific endpoints

3. Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

4. Network attacks follow predictable patterns. If you interfere withany portion of this pattern, the attack will be neutralized .

Which of the following statements is correct?

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.

Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.

Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.

Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

5. What is by far the most common tactic used by ransomware to shut down a victim’s operation?

preventing the victim from being able to access APIs to cripple infrastructure

denying traffic out of the victims network until payment is received

restricting access to administrative accounts to the victim

encrypting certain files to prevent access by the victim

6. In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer .

What is one way to add an exception for the singer?

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

7. Which statement best describes how Behavioral Threat Protection (BTP) works?

BTP injects into known vulnerable processes to detect malicious activity.

BTP runs on the Cortex XDR and distributes behavioral signatures to all agents.

BTP matches EDR data with rules provided by Cortex XD

BTP uses machine Learning to recognize malicious activity even if it is not known.

8. Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

9. Which module provides the best visibility to view vulnerabilities?

Live Terminal module

Device Control Violations module

Host Insights module

Forensics module

10. A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate .

Which statement is correct for the incident?

It is true positive.

It is false positive.

It is a false negative.

It is true negative.

Page 2 of 2

11. If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?

Broker VM Pathfinder

Local Agent Proxy

Local Agent Installer and Content Caching

Broker VM Syslog Collector

12. Where would you view the WildFire report in an incident?

next to relevant Key Artifacts in the incidents details page

under Response --> Action Center

under the gear icon --> Agent Audit Logs

on the HUB page at apps.paloaltonetworks.com

13. What kind of the threat typically encrypts userfiles?

ransomware

SQL injection attacks

Zero-day exploits

supply-chain attacks

14. When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

Remediation Automation

Machine Remediation

Automatic Remediation

Remediation Suggestions

15. Which statement is true for Application Exploits and Kernel Exploits?

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.