Palo Alto Networks XDR Analyst - XDR-Analyst Exam Practice Test

Question 1

The Cortex XDR console has triggered an incident, blocking a vitally important piece of software in your organization that is known to be benign. Which of the following options would prevent Cortex XDR from blocking this software in the future, for all endpoints in your organization?

A. Create a global inclusion.

B. Create an endpoint-specific exception.

C. Create an individual alert exclusion.

D. Create a global exception.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

What is the standard installation disk space recommended to install a Broker VM?

A. 1GB disk space

B. 512GB disk space

C. 2GB disk space

D. 256GB disk space

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?

A. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles

B. in the Linux Malware Protection Profile to indicate allowed Java libraries

C. in the macOS Malware Protection Profile to indicate allowed signers

D. in the Windows Malware Protection Profile to indicate allowed executables

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

A. Causality Chain Engine

B. Causality Analysis Engine

C. Log Stitching Engine

D. Sensor Engine

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

What is by far the most common tactic used by ransomware to shut down a victim's operation?

A. restricting access to administrative accounts to the victim

B. denying traffic out of the victims network until payment is received

C. preventing the victim from being able to access APIs to cripple infrastructure

D. encrypting certain files to prevent access by the victim

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Which of the following is an example of a successful exploit?

A. executing a process executable for well-known and signed software.

B. a user executing code which takes advantage of a vulnerability on a local service.

C. identifying vulnerable services on a server.

D. connecting unknown media to an endpoint that copied malware due to Autorun.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

What is the action taken out by Managed Threat Hunting team for Zero Day Exploits?

A. MTH researches for threats in the logs and reports to engineering.

B. MTH researches for threats in the tenant and generates a report with the findings.

C. MTH runs queries and investigative actions and no further action is taken.

D. MTH pushes content updates to prevent against the zero-day exploits.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

When investigating security events, which feature in Cortex XDR is useful for reverting the changes on the endpoint?

A. Remediation Automation

B. Machine Remediation

C. Remediation Suggestions

D. Automatic Remediation

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Which search methods is supported by File Search and Destroy?

A. File Seek and Repair

B. File Search and Repair

C. File Seek and Destroy

D. File Search and Destroy

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

A. Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

B. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

C. From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

D. Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Palo Alto Networks XDR Analyst - XDR-Analyst Exam Practice Test

Latest Update

Useful Links

Contact Us