Free Preparation Discussions
MENU
Palo Alto Networks PCDRA Exam Questions
- Topic 1: Threats and Attacks: This section of the exam measures the skills of Cybersecurity Analysts and covers various attack types, including exploits, malware, file-less attacks, supply chain threats, and ransomware. Candidates must differentiate between threats and attacks while understanding how security modules identify risks. Recognizing attack tactics and understanding the MITRE framework are also key aspects of this section. One skill assessed is identifying legitimate threats versus false positives in security analysis.
- Topic 2: Prevention and Detection: This section of the exam measures the skills of Security Engineers and focuses on defense mechanisms against cyber threats. Candidates must understand ransomware defense systems, device management techniques, and methods to prevent agent-based attacks.
- Topic 3: Investigation: This section of the exam measures the skills of Incident Response Specialists and involves using Cortex XDR for security investigations. Candidates must learn how to navigate the console, use remote terminal options, and distinguish between incidents and alerts.
- Topic 4: Remediation: This section of the exam measures the skills of Security Operations Analysts and focuses on implementing remediation strategies. Candidates will explore the differences between automatic and manual remediation processes, how to run scripts for mitigation, and how to address false positives in security alerts.
- Topic 5: Threat Hunting: This section of the exam measures the skills of a Security Operations Analyst and covers proactive threat detection techniques. Candidates will learn about various tools, including Indicators of Compromise (IOC), Behavioral Indicators of Compromise (BIOC), and the XQL query language for threat hunting.
- Topic 6: Reporting: This section of the exam measures the skills of Security Analysts and evaluates the ability to generate and interpret security reports using Cortex XDR. Candidates must understand how to leverage reporting tools to provide insights into security incidents, system vulnerabilities, and attack trends.
- Topic 7: Architecture: This section of the exam measures the skills of a Security Operations Analyst and covers the structural components of Cortex XDR. Candidates must understand the role of the Cortex XDR Data Lake, Cortex Agent, and Cortex Console. The architecture of Cortex XDR across different operating systems is also explored, including how security functions vary between platforms.
Free Palo Alto Networks PCDRA Exam Actual Questions
Note: Premium Questions for PCDRA were last updated On Apr. 03, 2025 (see below)
What is the standard installation disk space recommended to install a Broker VM?
The Broker VM for Cortex XDR is a virtual machine that serves as the central communication hub for all Cortex XDR agents deployed in your organization. It enables agents to communicate with the Cortex XDR cloud service and allows you to manage and monitor the agents' activities from a centralized location. The system requirements for the Broker VM are as follows:
CPU: 4 cores
RAM: 8 GB
Disk space: 256 GB
Network: Internet access and connectivity to all Cortex XDR agents
The disk space requirement is based on the number of agents and the frequency of content updates. The Broker VM stores the content updates locally and distributes them to the agents. The disk space also depends on the retention period of the content updates, which can be configured in the Broker VM settings. The default retention period is 30 days.
Which of the following is NOT a precanned script provided by Palo Alto Networks?
Palo Alto Networks provides a set of precanned scripts that you can use to perform various actions on your endpoints, such as deleting files, killing processes, or quarantining malware. The precanned scripts are written in Python and are available in the Agent Script Library in the Cortex XDR console. You can use the precanned scripts as they are, or you can customize them to suit your needs. The precanned scripts are:
delete_file: Deletes a specific file from a local or removable drive.
quarantine_file: Moves a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.
process_kill_name: Kills a process by its name on the endpoint.
process_kill_pid: Kills a process by its process ID (PID) on the endpoint.
process_kill_tree: Kills a process and all its child processes by its name on the endpoint.
process_kill_tree_pid: Kills a process and all its child processes by its PID on the endpoint.
process_list: Lists all the processes running on the endpoint, along with their names, PIDs, and command lines.
process_list_tree: Lists all the processes running on the endpoint, along with their names, PIDs, command lines, and parent processes.
process_start: Starts a process on the endpoint by its name or path.
registry_delete_key: Deletes a registry key and all its subkeys and values from the Windows registry.
registry_delete_value: Deletes a registry value from the Windows registry.
registry_list_key: Lists all the subkeys and values under a registry key in the Windows registry.
registry_list_value: Lists the value and data of a registry value in the Windows registry.
registry_set_value: Sets the value and data of a registry value in the Windows registry.
The script list_directories isnota precanned script provided by Palo Alto Networks. It is a custom script that you can write yourself using Python commands.
Agent Script Library
Precanned Scripts
Which two types of exception profiles you can create in Cortex XDR? (Choose two.)
Cortex XDR allows you to create two types of exception profiles: agent exception profiles and global exception profiles. Agent exception profiles apply to specific endpoints that are assigned to the profile. Global exception profiles apply to all endpoints in your network. You can use exception profiles to configure different types of exceptions, such as process exceptions, support exceptions, behavioral threat protection rule exceptions, local analysis rules exceptions, advanced analysis exceptions, or digital signer exceptions. Exception profiles help you fine-tune the security policies for your endpoints and reduce false positives.Reference:
Create an Agent Exception Profile
Create a Global Exception Profile
What motivation do ransomware attackers have for returning access to systems once their victims have paid?
Ransomware attackers have a motivation to return access to systems once their victims have paid because they want to maintain their reputation and credibility. If they fail to restore access to systems, they risk losing the trust of future victims who may not believe that paying the ransom will result in getting their data back. This would reduce the effectiveness and profitability of their scheme. Therefore, ransomware attackers have an incentive to honor their promises and decrypt the data after receiving the ransom.Reference:
What is the motivation behind ransomware? | Foresite
As Ransomware Attackers' Motives Change, So Should Your Defense - Forbes
What types of actions you can execute with live terminal session?
Live terminal session is a feature of Cortex XDR that allows you to remotely access and control endpoints from the Cortex XDR console. With live terminal session, you can execute various actions on the endpoints, such as:
Manage Processes: You can view, start, or kill processes on the endpoint, and monitor their CPU and memory usage.
Manage Files: You can view, create, delete, or move files and folders on the endpoint, and upload or download files to or from the endpoint.
Run Operating System Commands: You can run commands on the endpoint using the native command-line interface of the operating system, such as cmd.exe for Windows, bash for Linux, or zsh for macOS.
Run Python Commands and Scripts: You can run Python commands and scripts on the endpoint using the Python interpreter embedded in the Cortex XDR agent. You can use the Python commands and scripts to perform advanced tasks or automation on the endpoint.
Initiate a Live Terminal Session
Manage Processes
Manage Files
Run Operating System Commands
Run Python Commands and Scripts
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Tiera
2 days agoKrissy
6 days agoViola
17 days agoMiesha
1 months agoLynsey
1 months agoRaylene
2 months agoLavonna
2 months agoAnnice
2 months agoVenita
3 months agoAvery
3 months agoMaia
3 months agoLezlie
3 months agoNguyet
3 months agoRenato
4 months agoSabrina
4 months agoAmira
4 months agoBreana
4 months agoLauran
4 months agoMalika
5 months agoDemetra
5 months agoAleta
5 months agoMarnie
5 months agoSabra
6 months agoKaycee
6 months agoYoulanda
6 months agoJess
6 months agoRhea
6 months agoColetta
7 months agoElmer
7 months agoVirgilio
7 months agoCiara
7 months agoAlbina
8 months agoAleta
9 months agoTarra
9 months agoJoaquin
9 months agoGenevive
9 months agoDudley
10 months agoRebbecca
10 months agoFrance
10 months agoJeniffer
11 months ago