PCDRA練習テスト問題解答には更新された62問があります
PCDRA問題集はPalo Alto Certifications and Accreditations合格確定させる練習で62問があります
質問 22
Which of the following is NOT a precanned script provided by Palo Alto Networks?
- A. delete_file
- B. list_directories
- C. process_kill_name
- D. quarantine_file
正解: D
質問 23
What functionality of the Broker VM would you use to ingest third-party firewall logs to the Cortex Data Lake?
- A. Netflow Collector
- B. Syslog Collector
- C. DB Collector
- D. Pathfinder
正解: B
質問 24
Which of the following best defines the Windows Registry as used by the Cortex XDR agent?
- A. a ledger for maintaining accurate and up-to-date information on total disk usage and disk space remaining available to the operating system
- B. a system of files used by the operating system to commit memory that exceeds the available hardware resources. Also known as the "swap"
- C. a central system, available via the internet, for registering officially licensed versions of software to prove ownership
- D. a hierarchical database that stores settings for the operating system and for applications
正解: D
質問 25
What kind of the threat typically encrypts user files?
- A. supply-chain attacks
- B. SQL injection attacks
- C. Zero-day exploits
- D. ransomware
正解: D
質問 26
Which Type of IOC can you define in Cortex XDR?
- A. destination port
- B. full path
- C. App-ID
- D. e-mail address
正解: B
質問 27
When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)
- A. Assign incidents to an analyst in bulk.
- B. Investigate several Incidents at once.
- C. Delete the selected Incidents.
- D. Change the status of multiple incidents.
正解: A,D
質問 28
In incident-related widgets, how would you filter the display to only show incidents that were "starred"?
- A. Click the star in the widget
- B. This is not currently supported
- C. Create a custom XQL widget
- D. Create a custom report and filter on starred incidents
正解: A
解説:
Reference:
%20you%20clear%20the%20star
質問 29
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
- A. mark the incident as Resolved - False Positive
- B. create an exception to prevent future false positives
- C. mark the incident as Unresolved
- D. create a BIOC rule excluding this behavior
正解: A
質問 30
Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.
- A. Exfiltration, Command and Control, Collection
- B. Exfiltration, Command and Control, Impact
- C. Exfiltration, Command and Control, Privilege Escalation
- D. Exfiltration, Command and Control, Lateral Movement
正解: D
質問 31
If you have an isolated network that is prevented from connecting to the Cortex Data Lake, which type of Broker VM setup can you use to facilitate the communication?
- A. Local Agent Proxy
- B. Broker VM Syslog Collector
- C. Broker VM Pathfinder
- D. Local Agent Installer and Content Caching
正解: D
質問 32
After scan, how does file quarantine function work on an endpoint?
- A. Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.
- B. Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.
- C. Quarantine takes ownership of the files and folders and prevents execution through access control.
- D. Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.
正解: B
質問 33
With a Cortex XDR Prevent license, which objects are considered to be sensors?
- A. Third-Party security devices
- B. Cortex XDR agents
- C. Palo Alto Networks Next-Generation Firewalls
- D. Syslog servers
正解: B
質問 34
When viewing the incident directly, what is the "assigned to" field value of a new Incident that was just reported to Cortex?
- A. New
- B. It is blank
- C. Unassigned
- D. Pending
正解: A
質問 35
In the deployment of which Broker VM applet are you required to install a strong cipher SHA256-based SSL certificate?
- A. Agent Installer and Content Caching
- B. Syslog Collector
- C. Agent Proxy
- D. CSV Collector
正解: A
質問 36
What license would be required for ingesting external logs from various vendors?
- A. Cortex XDR Vendor Agnostic Pro
- B. Cortex XDR Pro per TB
- C. Cortex XDR Cloud per Host
- D. Cortex XDR Pro per Endpoint
正解: B
質問 37
When is the wss (WebSocket Secure) protocol used?
- A. when the Cortex XDR agent uploads alert data
- B. when the Cortex XDR agent establishes a bidirectional communication channel
- C. when the Cortex XDR agent connects to WildFire to upload files for analysis
- D. when the Cortex XDR agent downloads new security content
正解: B
質問 38
When creating a BIOC rule, which XQL query can be used?
- A. dataset = xdr_data
| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
| fields action_process_image - B. dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" - C. dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" - D. dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
正解: C
質問 39
What is the purpose of the Unit 42 team?
- A. Unit 42 is responsible for the configuration optimization of the Cortex XDR server
- B. Unit 42 is responsible for the rapid deployment of Cortex XDR agents
- C. Unit 42 is responsible for automation and orchestration of products
- D. Unit 42 is responsible for threat research, malware analysis and threat hunting
正解: D
質問 40
What are two purposes of "Respond to Malicious Causality Chains" in a Cortex XDR Windows Malware profile? (Choose two.)
- A. Automatically close the connections involved in malicious traffic.
- B. Automatically kill the processes involved in malicious activity.
- C. Automatically terminate the threads involved in malicious activity.
- D. Automatically block the IP addresses involved in malicious traffic.
正解: A,D
解説:
Reference:
%20threat%20protection%2C%20the,appear%20legitimate%20if%20inspected%20individually
質問 41
Phishing belongs which of the following MITRE ATT&CK tactics?
- A. Initial Access, Persistence
- B. Persistence, Command and Control
- C. Reconnaissance, Persistence
- D. Reconnaissance, Initial Access
正解: D
質問 42
Which profiles can the user use to configure malware protection in the Cortex XDR console?
- A. Anti-Malware profile
- B. Malware Detection profile
- C. Malware Protection profile
- D. Malware profile
正解: D
質問 43
Which module provides the best visibility to view vulnerabilities?
- A. Device Control Violations module
- B. Live Terminal module
- C. Host Insights module
- D. Forensics module
正解: C
解説:
Host Insights, an add-on module for Cortex XDR, combines vulnerability assessment, application and system visibility, and a powerful Search and Destroy feature to help you identify and contain threats. Vulnerability Assessment provides you real-time visibility into vulnerability exposure and current patch levels across your end-points. Host inventory presents detailed information about your host applications and settings whileSearch and Destroy lets you swiftly find and eradicate threats across all endpoints. Host Insights offers a holistic approach to endpoint visibility and attack containment, helping reduce your exposure to threats so you can avoid future breached.
質問 44
......
最新PCDRA試験問題にはリアルなPCDRA問題集があります：https://jp.fast2test.com/PCDRA-premium-file.html