Palo Alto Networks Certified Detection and Remediation Analyst

Question 1

Which statement is correct based on the report output below?

A. Host Inventory Data Collection is enabled.

B. Forensic inventory data collection is enabled.

C. 3,297 total incidents have been detected.

D. 133 agents have full disk encryption.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Which version of python is used in live terminal?

A. Python 3 with standard Python libraries

B. Python 2 and 3 with specific XDR Python libraries developed by Palo Alto Networks

C. Python 3 with specific XDR Python libraries developed by Palo Alto Networks

D. Python 2 and 3 with standard Python libraries

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

In the Cortex XDR console, from which two pages are you able to manually perform the agent upgrade action?
(Choose two.)

A. Asset Management

B. Action Center

C. Agent Installations

D. Endpoint Administration

Correct Answer: A,D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which of the following represents a common sequence of cyber-attack tactics?

A. Actions on the objective » Reconnaissance »Weaponization& Delivery » Exploitation » Installation » Command & Control

B. Reconnaissance »Weaponization& Delivery » Exploitation » Installation » Command & Control » Actions on the objective

C. Installation » Reconnaissance »Weaponization& Delivery » Exploitation » Command & Control » Actions on the objective

D. Reconnaissance » Installation »Weaponization& Delivery » Exploitation » Command & Control » Actions on the objective

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

Which of the following paths will successfully activate Remediation Suggestions?

A. Alerts Table > Right-click on an alert > Remediation Suggestions

B. Causality View > Actions > Remediation Suggestions

C. Incident View > Actions > Remediation Suggestions

D. Alerts Table > Right-click on a process node > Remediation Suggestions

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?

A. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.

B. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.

C. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.

D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

A. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

B. in the Linux Malware Protection Profile to indicate allowed Java libraries

C. in the macOS Malware Protection Profile to indicate allowed signers

D. in the Windows Malware Protection Profile to indicate allowed executables

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

A. Causality Chain Engine

B. Causality Analysis Engine

C. Log Stitching Engine

D. Sensor Engine

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

A file is identified as malware by the Local Analysis module whereas WildFire verdict is Benign, Assuming WildFire is accurate. Which statement is correct for the incident?

A. It is a false negative.

B. It is true negative.

C. It is false positive.

D. It is true positive.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which of the following best defines the Windows Registry as used by the Cortex XDR agent?

A. a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system

B. a central system, available via the internet, for registering officially licensed versions of software to prove ownership

C. a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the "swap"

D. a hierarchical database that stores settings for the operating system and for applications

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Palo Alto Networks Certified Detection and Remediation Analyst - PCDRA Exam Practice Test

Latest Update

Useful Links

Contact Us