Palo-Alto-Networks XDR-Analyst Practice Exam Questions

Palo-Alto-Networks XDR-Analyst Sample Question Answers

Question # 1

What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDRWindows Malware profile? (Choose two.)

A. Automatically close the connections involved in malicious traffic. 
B. Automatically kill the processes involved in malicious activity. 
C. Automatically terminate the threads involved in malicious activity. 
D. Automatically block the IP addresses involved in malicious traffic. 

Show Answer

Question # 2

When selecting multiple Incidents at a time, what options are available from the menuwhen a user right-clicks the incidents? (Choose two.)

A. Assign incidents to an analyst in bulk. 
B. Change the status of multiple incidents. 
C. Investigate several Incidents at once. 
D. Delete the selected Incidents. 

Show Answer

Question # 3

Cortex XDR Analytics can alert when detecting activity matching the following MITREATT&CKTM techniques.

A. Exfiltration, Command and Control, Collection 
B. Exfiltration, Command and Control, Privilege Escalation 
C. Exfiltration, Command and Control, Impact 
D. Exfiltration, Command and Control, Lateral Movement 

Show Answer

Question # 4

What is the Wildfire analysis file size limit for Windows PE files? 

A. No Limit  
B. 500MB  
C. 100MB  
D. 1GB 

Show Answer

Question # 5

Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via anongoing supply chain compromise was prevented on 1 server. What steps can you take toensure the same protection is extended to all your servers?

A. Conduct a thorough Endpoint Malware scan.  
B. Enable DLL Protection on all servers but there might be some false positives. 
C. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack fromspreading.
D. Create lOCs of the malicious files you have found to prevent their execution. 

Show Answer

Question # 6

Which of the following is NOT a precanned script provided by Palo Alto Networks? 

A. delete_file 
B. quarantine_file 
C. process_kill_name 
D. list_directories 

Show Answer

Question # 7

In Windows and macOS you need to prevent the Cortex XDR Agent from blockingexecution of a file based on the digital signer. What is one way to add an exception for thesinger?

A. In the Restrictions Profile, add the file name and path to the Executable Files allow list. 
B. Create a new rule exception and use the singer as the characteristic. 
C. Add the signer to the allow list in the malware profile. 
D. Add the signer to the allow list under the action center page. 

Show Answer

Question # 8

Which two types of exception profiles you can create in Cortex XDR? (Choose two.) 

A. exception profiles that apply to specific endpoints 
B. agent exception profiles that apply to specific endpoints 
C. global exception profiles that apply to all endpoints 
D. role-based profiles that apply to specific endpoints 

Show Answer

Question # 9

When reaching out to TAC for additional technical support related to a Security Event; what are two critical pieces of information you need to collect from the Agent? (Choose Two) 

A. The agent technical support file. 
B. The prevention archive from the alert.  
C. The distribution id of the agent.  
D. A list of all the current exceptions applied to the agent. 
E. The unique agent id. 

Show Answer

Question # 10

Which of the following paths will successfully activate Remediation Suggestions? 

A. Incident View > Actions > Remediation Suggestions  
B. Causality View > Actions > Remediation Suggestions 
C. Alerts Table > Right-click on a process node > Remediation Suggestions 
D. Alerts Table > Right-click on an alert > Remediation Suggestions 

Show Answer