Palo-Alto-Networks XDR-Analyst Exam Dumps

Palo-Alto-Networks XDR-Analyst Sample Question Answers

Palo-Alto-Networks XDR-Analyst Sample Questions

Question # 1

What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDRWindows Malware profile? (Choose two.)

A. Automatically close the connections involved in malicious traffic. 
B. Automatically kill the processes involved in malicious activity. 
C. Automatically terminate the threads involved in malicious activity. 
D. Automatically block the IP addresses involved in malicious traffic. 

Answer: B,D

Show Answer

Question # 2

When selecting multiple Incidents at a time, what options are available from the menuwhen a user right-clicks the incidents? (Choose two.)

A. Assign incidents to an analyst in bulk. 
B. Change the status of multiple incidents. 
C. Investigate several Incidents at once. 
D. Delete the selected Incidents. 

Answer: A,B

Show Answer

Question # 3

Cortex XDR Analytics can alert when detecting activity matching the following MITREATT&CKTM techniques.

A. Exfiltration, Command and Control, Collection 
B. Exfiltration, Command and Control, Privilege Escalation 
C. Exfiltration, Command and Control, Impact 
D. Exfiltration, Command and Control, Lateral Movement 

Answer: D

Show Answer

Question # 4

What is the Wildfire analysis file size limit for Windows PE files? 

A. No Limit  
B. 500MB  
C. 100MB  
D. 1GB 

Answer: C

Show Answer

Question # 5

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via anongoing supply chain compromise was prevented on 1 server. What steps can you take toensure the same protection is extended to all your servers?

A. Conduct a thorough Endpoint Malware scan.  
B. Enable DLL Protection on all servers but there might be some false positives. 
C. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack fromspreading.
D. Create lOCs of the malicious files you have found to prevent their execution. 

Answer: D

Show Answer

Question # 6

Which of the following is NOT a precanned script provided by Palo Alto Networks? 

A. delete_file 
B. quarantine_file 
C. process_kill_name 
D. list_directories 

Answer: D

Show Answer

Question # 7

In Windows and macOS you need to prevent the Cortex XDR Agent from blockingexecution of a file based on the digital signer. What is one way to add an exception for thesinger?

A. In the Restrictions Profile, add the file name and path to the Executable Files allow list. 
B. Create a new rule exception and use the singer as the characteristic. 
C. Add the signer to the allow list in the malware profile. 
D. Add the signer to the allow list under the action center page. 

Answer: C

Show Answer

Question # 8

Which two types of exception profiles you can create in Cortex XDR? (Choose two.) 

A. exception profiles that apply to specific endpoints 
B. agent exception profiles that apply to specific endpoints 
C. global exception profiles that apply to all endpoints 
D. role-based profiles that apply to specific endpoints 

Answer: B,C

Show Answer

Question # 9

When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose Two) 

A. The agent technical support file. 
B. The prevention archive from the alert.  
C. The distribution id of the agent.  
D. A list of all the current exceptions applied to the agent. 
E. The unique agent id. 

Answer: A,B

Show Answer

Question # 10

Which of the following paths will successfully activate Remediation Suggestions? 

A. Incident View > Actions > Remediation Suggestions  
B. Causality View > Actions > Remediation Suggestions 
C. Alerts Table > Right-click on a process node > Remediation Suggestions 
D. Alerts Table > Right-click on an alert > Remediation Suggestions 

Answer: B

Show Answer

Question # 11

To stop a network-based attack, any interference with a portion of the attack pattern isenough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?

A. It does not interfere with any portion of the pattern on the endpoint.  
B. It interferes with the pattern as soon as it is observed by the firewall.  
C. It does not need to interfere with the any portion of the pattern to prevent the attack. 
D. It interferes with the pattern as soon as it is observed on the endpoint. 

Answer: D

Show Answer

Question # 12

Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct? 

A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed onthe firewall.
B. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on theendpoint.
C. Cortex XDR Analytics does not have to interfere with the pattern as soon as it isobserved on the endpoint in order to prevent the attack.
D. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed onthe endpoint.

Answer: D

Show Answer

Question # 13

What is the standard installation disk space recommended to install a Broker VM? 

A. 1GB disk space 
B. 2GB disk space 
C. 512GB disk space 
D. 256GB disk space 

Answer: D

Show Answer

Question # 14

When viewing the incident directly, what is the “assigned to” field value of a new Incidentthat was just reported to Cortex?

A. Pending 
B. It is blank 
C. Unassigned 
D. New 

Answer: C

Show Answer

Question # 15

What is by far the most common tactic used by ransomware to shut down a victim’soperation?

A. preventing the victim from being able to access APIs to cripple infrastructure 
B. denying traffic out of the victims network until payment is received 
C. restricting access to administrative accounts to the victim 
D. encrypting certain files to prevent access by the victim 

Answer: D

Show Answer