Free Paloalto Networks PCDRA Practice Exam with Questions & Answers | Set: 3

 When creating a scheduled report in Cortex XDR, the option to run quarterly on a certain day and time is not available. You can only schedule reports to run daily, weekly, or monthly. You can also specify the start and end dates, the time zone, and the recipients of the report. Scheduled reports are useful for generating regular reports on the security events, incidents, alerts, or endpoints in your network. You can create scheduled reports from the Reports page in the Cortex XDR console, or from the Query Center by saving a query as a report. References:

• Run or Schedule Reports
• Create a Scheduled Report

 The output shows the top 10 hosts with the most malware in the last 30 days, based on the Cortex XDR data. The output is sorted by the number of incidents, with the host with the most incidents at the top. The output also shows the number of alerts, the number of endpoints, and the percentage of endpoints for each host. The output is generated by using the ACC (Application Command Center) feature of Cortex XDR, which provides a graphical representation of the network activity and threat landscape. The ACC allows you to view and analyze various widgets, such as the Top 10 hosts with the most malware, the Top 10 applications by bandwidth, the Top 10 threats by count, and more .

References:

• Use the ACC to Analyze Network Activity
• Top 10 Hosts with the Most Malware

The WSS (WebSocket Secure) protocol is an extension of the WebSocket protocol that provides a secure communication channel over the internet. It is used to establish a persistent, full-duplex communication channel between a client (in this case, the Cortex XDR agent) and a server (such as the Cortex XDR management console or other components). The Cortex XDR agent uses the WSS protocol to establish a secure and real-time bidirectional communication channel with the Cortex XDR management console or other components in the Palo Alto Networks security ecosystem. This communication channel allows the agent to send data, such as security events, alerts, and other relevant information, to the management console, and receive commands, policy updates, and responses in return. By using the WSS protocol, the Cortex XDR agent can maintain a persistent connection with the management console, which enables timely communication of security-related information and allows for efficient incident response and remediation actions. It’s important to note that the other options mentioned in the question also involve communication between the CortexXDR agent and various components, but they do not specifically mention the use of the WSS protocol. For example:

• A. The Cortex XDR agent downloading new security content typically utilizes protocols like HTTP or HTTPS.
• B. When the Cortex XDR agent uploads alert data, it may use protocols like HTTP or HTTPS to transmit the data securely.
• C. When the Cortex XDR agent connects to WildFire to upload files for analysis, it typically uses protocols like HTTP or HTTPS. Therefore, the correct answer is D, when the Cortex XDR agent establishes a bidirectional communication channel. References:
• Device communication protocols – AWS IoT Core
• WebSocket – Wikipedia
• Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) – Palo Alto Networks
• [What are WebSockets? | Web Security Academy]
• [Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Palo Alto Networks Certified Detection and Remediation Analyst PCDRA exam and earn Palo Alto Networks Certified Detection and Remediation Analyst PCDRA certification.]

A BIOC rule is a custom detection rule that uses the Cortex Query Language (XQL) to define the behavior or actions that indicate a potential threat. A BIOC rule can use the xdr_data and cloud_audit_log datasets and presets for these datasets. A BIOC rule can also use the filter stage, alter stage, and functions without any aggregations in the XQL query. The query must return a single field named action_process_image, which is the process image name of the suspicious process. The query must also include the event_type and event_sub_type fields in the filter stage to specify the type and sub-type of the event that triggers the rule.

Option B is the correct answer because it meets all the requirements for a valid BIOC rule query. It uses the xdr_data dataset, the filter stage, the event_type and event_sub_type fields, and the action_process_image_name field with a regular expression to match any process image name that ends with .pdf.exe or .docx.exe, which are common indicators of malicious files.

Option A is incorrect because it does not include the event_type field in the filter stage, which is mandatory for a BIOC rule query.

Option C is incorrect because it does not include the event_type and event_sub_type fields in the filter stage, and it uses the fields stage, which is not supported for a BIOC rule query. It also returns the action_process_image field instead of the action_process_image_name field, which is the expected output for a BIOC rule query.

Option D is incorrect because it uses the event_behavior field, which is not supported for a BIOC rule query. It also does not include the event_type field in the filter stage, and it uses the event_sub_type field incorrectly. The event_sub_type field should be equal to PROCESS_START, not true.

References:

• Working with BIOCs
• Cortex Query Language (XQL) Reference

 You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or create an alert-starring or incident-starring configuration. Starring security events helps you prioritize and track the events that are most important to you. You can also filter and sort the events by their star status in the Cortex XDR console.

• To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents table. You can also star an alert from the Causality View or the Query Center Results table. You can star an incident from the Incident View or the Query Center Results table. You can also unstar an event by clicking the star icon again.
• To create an alert-starring or incident-starring configuration, you can use the Alert Starring Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define the criteria for starring alerts or incidents based on their severity, category, source, or other attributes. You can also enable or disable the configurations as needed.

References:

• Star Security Events
• Create an Alert Starring Configuration
• Create an Incident Starring Configuration

The Broker VM is a virtual machine that you can deploy in your network to provide various services and functionalities to the Cortex XDR agents. One of the services that the Broker VM offers is the Local Agent Settings applet, which allows you to configure the agent proxy, agent installer, and content caching settings for the agents. The Local Agent Settings applet can support a maximum number of 10,000 agents per Broker VM. If you have more than 10,000 agents in your network, you need to deploy additional Broker VMs and distribute the load among them. References:

• Broker VM Overview: This document provides an overview of the Broker VM and its features, requirements, and deployment options.
• Configure the Broker VM: This document explains how to install, set up, and configure the Broker VM in an ESXi environment.
• Manage Broker VM from the Cortex XDR Management Console: This document describes how to activate and manage the Broker VM applets from the Cortex XDR management console.

The “assigned to” field value of a new incident that was just reported to Cortex is “Unassigned”. This means that the incident has not been assigned to any analyst or group yet, and it is waiting for someone to take ownership of it. The “assigned to” field is one of the default fields that are displayed in the incident layout, and it can be used to filter and sort incidents in the incident list. The “assigned to” field can be changed manually by an analyst, or automatically by a playbook or a rule12.

Let’s briefly discuss the other options to provide a comprehensive explanation:

A. Pending: This is not the correct answer. Pending is not a valid value for the “assigned to” field. Pending is a possible value for the “status” field, which indicates the current state of the incident. The status field can have values such as “New”, “Active”, “Done”, “Closed”, or "Pending"3.

B. It is blank: This is not the correct answer. The “assigned to” field is never blank for any incident. It always has a default value of “Unassigned” for new incidents, unless a playbook or a rule assigns it to a specific analyst or group12.

D. New: This is not the correct answer. New is not a valid value for the “assigned to” field. New is a possible value for the “status” field, which indicates the current state of the incident. The status field can have values such as “New”, “Active”, “Done”, “Closed”, or "Pending"3.

In conclusion, the “assigned to” field value of a new incident that was just reported to Cortex is “Unassigned”. This field can be used to manage the ownership and responsibility of incidents, and it can be changed manually or automatically.

References:

• Cortex XDR Pro Admin Guide: Manage Incidents
• Cortex XDR Pro Admin Guide: Assign Incidents
• Cortex XDR Pro Admin Guide: Update Incident Status