Pass Exam Questions Efficiently With XDR-Analyst Questions (2026)
XDR-Analyst Questions - Truly Beneficial For Your Palo Alto Networks Exam
Palo Alto Networks XDR-Analyst Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 14
Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?
- A. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the firewall.
- B. Cortex XDR Analytics allows to interfere with the pattern as soon as it is observed on the endpoint.
- C. Cortex XDR Analytics does not interfere with the pattern as soon as it is observed on the endpoint.
- D. Cortex XDR Analytics does not have to interfere with the pattern as soon as it is observed on the endpoint in order to prevent the attack.
Answer: B
Explanation:
Cortex XDR Analytics is a cloud-based service that uses machine learning and artificial intelligence to detect and prevent network attacks. Cortex XDR Analytics can interfere with the attack pattern as soon as it is observed on the endpoint by applying protection policies that block malicious processes, files, or network connections. This way, Cortex XDR Analytics can stop the attack before it causes any damage or compromises the system. Reference:
[Cortex XDR Analytics Overview]
[Cortex XDR Analytics Protection Policies]
NEW QUESTION # 15
Where can SHA256 hash values be used in Cortex XDR Malware Protection Profiles?
- A. in the macOS Malware Protection Profile to indicate allowed signers
- B. in the Windows Malware Protection Profile to indicate allowed executables
- C. SHA256 hashes cannot be used in Cortex XDR Malware Protection Profiles
- D. in the Linux Malware Protection Profile to indicate allowed Java libraries
Answer: B
Explanation:
Cortex XDR Malware Protection Profiles allow you to configure the malware prevention settings for Windows, Linux, and macOS endpoints. You can use SHA256 hash values in the Windows Malware Protection Profile to indicate allowed executables that you want to exclude from malware scanning. This can help you reduce false positives and improve performance by skipping the scanning of known benign files. You can add up to 1000 SHA256 hash values per profile. You cannot use SHA256 hash values in the Linux or macOS Malware Protection Profiles, but you can use other criteria such as file path, file name, or signer to exclude files from scanning. Reference:
Malware Protection Profiles
Configure a Windows Malware Protection Profile
PCDRA Study Guide
NEW QUESTION # 16
How can you pivot within a row to Causality view and Timeline views for further investigate?
- A. You can't pivot within a row to Causality view and Timeline views
- B. Using the Open Card Only
- C. Using Open Timeline Actions Only
- D. Using the Open Card and Open Timeline actions respectively
Answer: D
Explanation:
To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row, showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident. Reference:
Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1: Investigate alerts using the Causality view and Timeline view
NEW QUESTION # 17
In the Cortex XDR console, from which two pages are you able to manually perform the agent upgrade action? (Choose two.)
- A. Agent Installations
- B. Endpoint Administration
- C. Action Center
- D. Asset Management
Answer: B,D
Explanation:
To manually upgrade the Cortex XDR agents, you can use the Asset Management page or the Endpoint Administration page in the Cortex XDR console. On the Asset Management page, you can select one or more endpoints and click Actions > Upgrade Agent. On the Endpoint Administration page, you can select one or more agent versions and click Upgrade. You can also schedule automatic agent upgrades using the Agent Installations page. Reference:
Asset Management
Endpoint Administration
Agent Installations
NEW QUESTION # 18
You can star security events in which two ways? (Choose two.)
- A. Create an alert-starring configuration.
- B. Create an Incident-starring configuration.
- C. Manually star an alert.
- D. Manually star an Incident.
Answer: C,D
Explanation:
You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or create an alert-starring or incident-starring configuration. Starring security events helps you prioritize and track the events that are most important to you. You can also filter and sort the events by their star status in the Cortex XDR console.
To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents table. You can also star an alert from the Causality View or the Query Center Results table. You can star an incident from the Incident View or the Query Center Results table. You can also unstar an event by clicking the star icon again.
To create an alert-starring or incident-starring configuration, you can use the Alert Starring Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define the criteria for starring alerts or incidents based on their severity, category, source, or other attributes. You can also enable or disable the configurations as needed.
Reference:
Star Security Events
Create an Alert Starring Configuration
Create an Incident Starring Configuration
NEW QUESTION # 19
What is the standard installation disk space recommended to install a Broker VM?
- A. 1GB disk space
- B. 2GB disk space
- C. 512GB disk space
- D. 256GB disk space
Answer: D
Explanation:
The Broker VM for Cortex XDR is a virtual machine that serves as the central communication hub for all Cortex XDR agents deployed in your organization. It enables agents to communicate with the Cortex XDR cloud service and allows you to manage and monitor the agents' activities from a centralized location. The system requirements for the Broker VM are as follows:
CPU: 4 cores
RAM: 8 GB
Disk space: 256 GB
Network: Internet access and connectivity to all Cortex XDR agents
The disk space requirement is based on the number of agents and the frequency of content updates. The Broker VM stores the content updates locally and distributes them to the agents. The disk space also depends on the retention period of the content updates, which can be configured in the Broker VM settings. The default retention period is 30 days.
Reference:
Broker VM for Cortex XDR
PCDRA Study Guide
NEW QUESTION # 20
What kind of the threat typically encrypts user files?
- A. SQL injection attacks
- B. ransomware
- C. Zero-day exploits
- D. supply-chain attacks
Answer: B
Explanation:
Ransomware is a type of malicious software, or malware, that encrypts user files and prevents them from accessing their data until they pay a ransom. Ransomware can affect individual users, businesses, and organizations of all kinds. Ransomware attacks can cause costly disruptions, data loss, and reputational damage. Ransomware can spread through various methods, such as phishing emails, malicious attachments, compromised websites, or network vulnerabilities. Some ransomware variants can also self-propagate and infect other devices or networks. Ransomware authors typically demand payment in cryptocurrency or other untraceable methods, and may threaten to delete or expose the encrypted data if the ransom is not paid within a certain time frame. However, paying the ransom does not guarantee that the files will be decrypted or that the attackers will not target the victim again. Therefore, the best way to protect against ransomware is to prevent infection in the first place, and to have a backup of the data in case of an attack123456 Reference:
What is Ransomware? | How to Protect Against Ransomware in 2023
Ransomware - Wikipedia
What is ransomware? | Ransomware meaning | Cloudflare
What Is Ransomware? | Ransomware.org
Ransomware - FBI
NEW QUESTION # 21
What is the function of WildFire for Cortex XDR?
- A. WildFire runs entirely on the agent to quickly analyse samples and provide a verdict.
- B. WildFire runs in the cloud and analyses alert data from the XDR agent to check for behavioural threats.
- C. WildFire is the engine that runs on the local agent and determines whether behavioural threats are occurring on the endpoint.
- D. WildFire accepts and analyses a sample to provide a verdict.
Answer: D
Explanation:
WildFire is a cloud-based service that accepts and analyses samples from various sources, including Cortex XDR, to provide a verdict of malware, benign, or grayware. WildFire also generates detailed analysis reports that show the behaviour and characteristics of the samples. Cortex XDR uses WildFire verdicts and reports to enhance its detection and prevention capabilities, as well as to provide more visibility and context into the threats. Reference:
WildFire Analysis Concepts
WildFire Overview
NEW QUESTION # 22
Which minimum Cortex XDR agent version is required for Kubernetes Cluster?
- A. Cortex XDR 6.1
- B. Cortex XDR 7.5
- C. Cortex XDR 7.4
- D. Cortex XDR 5.0
Answer: B
Explanation:
The minimum Cortex XDR agent version required for Kubernetes Cluster is Cortex XDR 7.5. This version introduces the Cortex XDR agent for Kubernetes hosts, which provides protection and visibility for Linux hosts that run on Kubernetes clusters. The Cortex XDR agent for Kubernetes hosts supports the following features:
Anti-malware protection
Behavioral threat protection
Exploit protection
File integrity monitoring
Network security
Audit and remediation
Live terminal
To install the Cortex XDR agent for Kubernetes hosts, you need to deploy the Cortex XDR agent as a DaemonSet on your Kubernetes cluster. You also need to configure the agent settings profile and the agent installer in the Cortex XDR management console. Reference:
Cortex XDR Agent Release Notes: This document provides the release notes for Cortex XDR agent versions, including the new features, enhancements, and resolved issues.
Install the Cortex XDR Agent for Kubernetes Hosts: This document explains how to install and configure the Cortex XDR agent for Kubernetes hosts using the Cortex XDR management console and the Kubernetes command-line tool.
NEW QUESTION # 23
Can you disable the ability to use the Live Terminal feature in Cortex XDR?
- A. No, it is a required feature of the agent.
- B. Yes, via the Cortex XDR console or with an installation switch.
- C. Yes, via Agent Settings Profile.
- D. No, a separate installer package without Live Terminal is required.
Answer: C
Explanation:
The Live Terminal feature in Cortex XDR allows you to initiate a remote connection to an endpoint and perform various actions such as running commands, uploading and downloading files, and terminating processes. You can disable the ability to use the Live Terminal feature in Cortex XDR by configuring the Agent Settings Profile. The Agent Settings Profile defines the behavior and functionality of the Cortex XDR agent on the endpoint. You can create different profiles for different groups of endpoints and assign them accordingly. To disable the Live Terminal feature, you need to uncheck the Enable Live Terminal option in the Agent Settings Profile and save the changes. This will prevent the Cortex XDR agent from accepting any Live Terminal requests from the Cortex XDR management console. Reference:
Live Terminal: This document explains how to use the Live Terminal feature to investigate and respond to security events on Windows endpoints.
Agent Settings Profile: This document describes how to create and manage Agent Settings Profiles to define the behavior and functionality of the Cortex XDR agent on the endpoint.
NEW QUESTION # 24
When creating a scheduled report which is not an option?
- A. Run quarterly on a certain day and time.
- B. Run daily at a certain time (selectable hours and minutes).
- C. Run weekly on a certain day and time.
- D. Run monthly on a certain day and time.
Answer: A
Explanation:
When creating a scheduled report in Cortex XDR, the option to run quarterly on a certain day and time is not available. You can only schedule reports to run daily, weekly, or monthly. You can also specify the start and end dates, the time zone, and the recipients of the report. Scheduled reports are useful for generating regular reports on the security events, incidents, alerts, or endpoints in your network. You can create scheduled reports from the Reports page in the Cortex XDR console, or from the Query Center by saving a query as a report. Reference:
Run or Schedule Reports
Create a Scheduled Report
NEW QUESTION # 25
What is the difference between presets and datasets in XQL?
- A. A dataset is a built-in or third-party source; presets group XDR data fields.
- B. A dataset is a Cortex data lake data source only; presets are built-in data source.
- C. A dataset is a third-party data source; presets are built-in data source.
- D. A dataset is a database; presets is a field.
Answer: A
Explanation:
The difference between presets and datasets in XQL is that a dataset is a built-in or third-party data source, while a preset is a group of XDR data fields. A dataset is a collection of data that you can query and analyze using XQL. A dataset can be a Cortex data lake data source, such as endpoints, alerts, incidents, or network flows, or a third-party data source, such as AWS CloudTrail, Azure Activity Logs, or Google Cloud Audit Logs. A preset is a predefined set of XDR data fields that are relevant for a specific use case, such as process execution, file operations, or network activity. A preset can help you simplify and standardize your XQL queries by selecting the most important fields for your analysis. You can use presets with any Cortex data lake data source, but not with third-party data sources. Reference:
Datasets and Presets
XQL Language Reference
NEW QUESTION # 26
What is the purpose of targeting software vendors in a supply-chain attack?
- A. to take advantage of a trusted software delivery method.
- B. to access source code.
- C. to report Zero-day vulnerabilities.
- D. to steal users' login credentials.
Answer: A
Explanation:
A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers services or software vital to the supply chain. Software supply chain attacks inject malicious code into an application in order to infect all users of an app. The purpose of targeting software vendors in a supply-chain attack is to take advantage of a trusted software delivery method, such as an update or a download, that can reach a large number of potential victims. By compromising a software vendor, an attacker can bypass the security measures of the downstream organizations and gain access to their systems, data, or networks. Reference:
What Is a Supply Chain Attack? - Definition, Examples & More | Proofpoint US What Is a Supply Chain Attack? - CrowdStrike What Is a Supply Chain Attack? | Zscaler What Is a Supply Chain Attack? Definition, Examples & Prevention
NEW QUESTION # 27
When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)
- A. Assign incidents to an analyst in bulk.
- B. Delete the selected Incidents.
- C. Change the status of multiple incidents.
- D. Investigate several Incidents at once.
Answer: A,C
Explanation:
When selecting multiple incidents at a time, the options that are available from the menu when a user right-clicks the incidents are: Assign incidents to an analyst in bulk and Change the status of multiple incidents. These options allow the user to perform bulk actions on the selected incidents, such as assigning them to a specific analyst or changing their status to open, in progress, resolved, or closed. These options can help the user to manage and prioritize the incidents more efficiently and effectively. To use these options, the user needs to select the incidents from the incident table, right-click on them, and choose the desired option from the menu. The user can also use keyboard shortcuts to perform these actions, such as Ctrl+A to select all incidents, Ctrl+Shift+A to assign incidents to an analyst, and Ctrl+Shift+S to change the status of incidents12 Reference:
Assign Incidents to an Analyst in Bulk
Change the Status of Multiple Incidents
NEW QUESTION # 28
Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?
- A. Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.
- B. From the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.
- C. In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.
- D. Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.
Answer: C
Explanation:
To add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint, you need to use the Action Center in Cortex XDR. The Action Center allows you to create and manage actions that apply to endpoints, such as adding files or processes to the allow list or block list, isolating or unisolating endpoints, or initiating live terminal sessions. To add a file hash to the allow list, you need to choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it. This will prevent the Malware profile from scanning or blocking the file on the endpoints that match the scope of the action. Reference: Cortex XDR 3: Responding to Attacks1, Action Center2
NEW QUESTION # 29
What should you do to automatically convert leads into alerts after investigating a lead?
- A. Build a search query using Query Builder or XQL using a list of lOCs.
- B. Lead threats can't be prevented in the future because they already exist in the environment.
- C. Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
- D. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
Answer: D
Explanation:
To automatically convert leads into alerts after investigating a lead, you should create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting. IOC rules are used to detect known threats based on indicators of compromise (IOCs) such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can prevent future occurrences of the same threats and generate alerts for them. Reference:
PCDRA Study Guide, page 25
Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2
Cortex XDR Documentation, section "Create IOC Rules"
NEW QUESTION # 30
......
Truly Beneficial For Your Palo Alto Networks Exam: https://passguide.validtorrent.com/XDR-Analyst-valid-exam-torrent.html