Free PCDRA Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The user can use the Malware Protection profile to configure malware protection in the Cortex XDR

console. The Malware Protection profile defines the actions that Cortex XDR takes when it detects

malware on your endpoints. You can configure different actions for different types of malware, such

as ransomware, password theft, or child process. You can also configure the scan frequency and

scope for periodic malware scans. The Malware Protection profile is part of the Endpoint Security

policy that you assign to your endpoints. Reference:

Malware Protection Profile

Endpoint Security Policy

The Managed Threat Hunting (MTH) team is a group of security experts who proactively hunt for

threats in the Cortex XDR tenant and generate a report with the findings. The MTH team uses

advanced queries and investigative actions to identify and analyze potential threats, such as zero-day

exploits, that may have bypassed the prevention and detection capabilities of Cortex XDR. The MTH

team also provides recommendations and best practices to help customers remediate the threats

and improve their security posture. Reference:

Managed Threat Hunting Service

Managed Threat Hunting Report

The Wildfire analysis file size limit for Windows PE files is 100MB. Windows PE files are executable

files that run on the Windows operating system, such as .exe, .dll, .sys, or .scr files. Wildfire is a

cloud-based service that analyzes files and URLs for malicious behavior and generates signatures and

protections for them. Wildfire can analyze various file types, such as PE, APK, PDF, MS Office, and

others, but each file type has a different file size limit. The file size limit determines the maximum

size of the file that can be uploaded or forwarded to Wildfire for analysis. If the file size exceeds the

limit, Wildfire will not analyze the file and will return an error message.

According to the Wildfire documentation1, the file size limit for Windows PE files is 100MB. This

means that any PE file that is larger than 100MB will not be analyzed by Wildfire. However, the

firewall can still apply other security features, such as antivirus, anti-spyware, vulnerability

protection, and file blocking, to the PE file based on the security policy settings. The firewall can also

perform local analysis on the PE file using the Cortex XDR agent, which uses machine learning

models to assess the file and assign it a verdict2.

Reference:

WildFire File Size Limits: This document provides the file size limits for different file types that can be

analyzed by Wildfire.

Local Analysis: This document explains how the Cortex XDR agent performs local analysis on files that

cannot be sent to Wildfire for analysis.

To automatically convert leads into alerts after investigating a lead, you should create IOC rules

based on the set of the collected attribute-value pairs over the affected entities concluded during the

lead hunting. IOC rules are used to detect known threats based on indicators of compromise (IOCs)

such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can

prevent future occurrences of the same threats and generate alerts for them. Reference:

PCDRA Study Guide, page 25

Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2

Cortex XDR Documentation, section “Create IOC Rules”

The Broker VM is a virtual machine that you can deploy in your network to provide various services

and functionalities to the Cortex XDR agents. One of the services that the Broker VM offers is the

Local Agent Settings applet, which allows you to configure the agent proxy, agent installer, and

content caching settings for the agents. The Local Agent Settings applet can support a maximum

number of 10,000 agents per Broker VM. If you have more than 10,000 agents in your network, you

need to deploy additional Broker VMs and distribute the load among them. Reference:

Broker VM Overview: This document provides an overview of the Broker VM and its features,

requirements, and deployment options.

Configure the Broker VM: This document explains how to install, set up, and configure the Broker VM

in an ESXi environment.

Manage Broker VM from the Cortex XDR Management Console: This document describes how to

activate and manage the Broker VM applets from the Cortex XDR management console.

Palo Alto Networks provides a set of precanned scripts that you can use to perform various actions

on your endpoints, such as deleting files, killing processes, or quarantining malware. The precanned

scripts are written in Python and are available in the Agent Script Library in the Cortex XDR console.

You can use the precanned scripts as they are, or you can customize them to suit your needs. The

precanned scripts are:

delete_file: Deletes a specific file from a local or removable drive.

quarantine_file: Moves a specific file from its location on a local or removable drive to a protected

folder and prevents it from being executed.

process_kill_name: Kills a process by its name on the endpoint.

process_kill_pid: Kills a process by its process ID (PID) on the endpoint.

process_kill_tree: Kills a process and all its child processes by its name on the endpoint.

process_kill_tree_pid: Kills a process and all its child processes by its PID on the endpoint.

process_list: Lists all the processes running on the endpoint, along with their names, PIDs, and

command lines.

process_list_tree: Lists all the processes running on the endpoint, along with their names, PIDs,

command lines, and parent processes.

process_start: Starts a process on the endpoint by its name or path.

registry_delete_key: Deletes a registry key and all its subkeys and values from the Windows registry.

registry_delete_value: Deletes a registry value from the Windows registry.

registry_list_key: Lists all the subkeys and values under a registry key in the Windows registry.

registry_list_value: Lists the value and data of a registry value in the Windows registry.

registry_set_value: Sets the value and data of a registry value in the Windows registry.

The script list_directories is not a precanned script provided by Palo Alto Networks. It is a custom

script that you can write yourself using Python commands.

Reference:

Run Scripts on an Endpoint

Agent Script Library

Precanned Scripts

WildFire is a cloud-based service that accepts and analyses samples from various sources, including

Cortex XDR, to provide a verdict of malware, benign, or grayware. WildFire also generates detailed

analysis reports that show the behaviour and characteristics of the samples. Cortex XDR uses

WildFire verdicts and reports to enhance its detection and prevention capabilities, as well as to

provide more visibility and context into the threats. Reference:

WildFire Analysis Concepts

WildFire Overview

The policy exception that applies to the following description is B, local file threat examination

exception. A local file threat examination exception is an exception that allows you to exclude specific

files or folders from being scanned by the Cortex XDR agent for malware or threats. You can use this

exception to prevent false positives, performance issues, or compatibility problems with legitimate

files or applications. You can define the local file threat examination exception by file name, file path,

file hash, or digital signer. For example, you can create a local file threat examination exception for

specific PHP files by entering their file names or paths in the exception configuration. Reference:

Local File Threat Examination Exceptions

Create a Local File Threat Examination Exception

The report output shows the number of endpoints that have forensic inventory data collection

enabled, which is a feature of Cortex XDR that allows the collection of detailed information about the

endpoint’s hardware, software, and network configuration. This feature helps analysts to investigate

and respond to incidents more effectively by providing a comprehensive view of the endpoint’s state

and activity. Forensic inventory data collection can be enabled or disabled per policy in Cortex

XDR. Reference:

Forensic Inventory Data Collection

Cortex XDR 3: Getting Started with Endpoint Protection

When reaching out to TAC for additional technical support related to a security event, two critical

pieces of information you need to collect from the agent are:

The agent technical support file. This is a file that contains diagnostic information about the agent,

such as its configuration, status, logs, and system information. The agent technical support file can

help TAC troubleshoot and resolve issues with the agent or the endpoint. You can generate and

download the agent technical support file from the Cortex XDR console, or from the agent itself.

The prevention archive from the alert. This is a file that contains forensic data related to the alert,

such as the process tree, the network activity, the registry changes, and the files involved. The

prevention archive can help TAC analyze and understand the alert and the malicious activity. You can

generate and download the prevention archive from the Cortex XDR console, or from the agent itself.

The other options are not critical pieces of information for TAC, and may not be available or relevant

for every security event. For example:

The distribution id of the agent is a unique identifier that is assigned to the agent when it is installed

on the endpoint. The distribution id can help TAC identify the agent and its profile, but it is not

sufficient to provide technical support or forensic analysis. The distribution id can be found in the

Cortex XDR console, or in the agent installation folder.

A list of all the current exceptions applied to the agent is a set of rules that define the files,

processes, or behaviors that are excluded from the agent’s security policies. The exceptions can help

TAC understand the agent’s configuration and behavior, but they are not essential to provide

technical support or forensic analysis. The exceptions can be found in the Cortex XDR console, or in

the agent configuration file.

The unique agent id is a unique identifier that is assigned to the agent when it registers with Cortex

XDR. The unique agent id can help TAC identify the agent and its endpoint, but it is not sufficient to

provide technical support or forensic analysis. The unique agent id can be found in the Cortex XDR

console, or in the agent log file.

Reference:

Generate and Download the Agent Technical Support File

Generate and Download the Prevention Archive

Cortex XDR Agent Administrator Guide: Agent Distribution ID

Cortex XDR Agent Administrator Guide: Exception Security Profiles

[Cortex XDR Agent Administrator Guide: Unique Agent ID]

Live Terminal uses the WebSocket protocol to communicate with the agent on the endpoint.

WebSocket is a full-duplex communication protocol that enables bidirectional data exchange

between a client and a server over a single TCP connection. WebSocket is designed to be

implemented in web browsers and web servers, but it can be used by any client or server

application. WebSocket provides a persistent connection between the Cortex XDR console and the

endpoint, allowing you to execute commands and receive responses in real time. Live Terminal uses

port 443 for WebSocket communication, which is the same port used for HTTPS traffic. Reference:

Initiate a Live Terminal Session

WebSocket

Unit 42 is the threat intelligence and response team of Palo Alto Networks. The purpose of Unit 42 is

to collect and analyze the most up-to-date threat intelligence and apply it to respond to cyberattacks.

Unit 42 is composed of world-renowned threat researchers, incident responders and security

consultants who help organizations proactively manage cyber risk. Unit 42 is responsible for threat

research, malware analysis and threat hunting, among other activities12.

Let’s briefly discuss the other options to provide a comprehensive explanation:

A) Unit 42 is not responsible for automation and orchestration of products. Automation and

orchestration are capabilities that are provided by Palo Alto Networks products such as Cortex

XSOAR, which is a security orchestration, automation and response platform that helps security

teams automate tasks, coordinate actions and manage incidents3.

B) Unit 42 is not responsible for the configuration optimization of the Cortex XDR server. The Cortex

XDR server is the cloud-based platform that provides detection and response capabilities across

network, endpoint and cloud data sources. The configuration optimization of the Cortex XDR server

is the responsibility of the Cortex XDR administrators, who can use the Cortex XDR app to manage

the settings and policies of the Cortex XDR server4.

C) Unit 42 is not responsible for the rapid deployment of Cortex XDR agents. The Cortex XDR agents

are the software components that are installed on endpoints to provide protection and visibility. The

rapid deployment of Cortex XDR agents is the responsibility of the Cortex XDR administrators, who

can use various methods such as group policy objects, scripts, or third-party tools to deploy the

Cortex XDR agents to multiple endpoints5.

In conclusion, Unit 42 is the threat intelligence and response team of Palo Alto Networks that is

responsible for threat research, malware analysis and threat hunting. By leveraging the expertise and

insights of Unit 42, organizations can enhance their security posture and protect against the latest

cyberthreats.

Reference:

About Unit 42: Our Mission and Team

Unit 42: Threat Intelligence & Response

Cortex XSOAR

Cortex XDR Pro Admin Guide: Manage Cortex XDR Settings and Policies

Cortex XDR Pro Admin Guide: Deploy Cortex XDR Agents

A BIOC rule is a custom detection rule that uses the Cortex Query Language (XQL) to define the

behavior or actions that indicate a potential threat. A BIOC rule can use the xdr_data and

cloud_audit_log datasets and presets for these datasets. A BIOC rule can also use the filter stage,

alter stage, and functions without any aggregations in the XQL query. The query must return a single

field named action_process_image, which is the process image name of the suspicious process. The

query must also include the event_type and event_sub_type fields in the filter stage to specify the

type and sub-type of the event that triggers the rule.

Option B is the correct answer because it meets all the requirements for a valid BIOC rule query. It

uses the xdr_data dataset, the filter stage, the event_type and event_sub_type fields, and the

action_process_image_name field with a regular expression to match any process image name that

ends with .pdf.exe or .docx.exe, which are common indicators of malicious files.

Option A is incorrect because it does not include the event_type field in the filter stage, which is

mandatory for a BIOC rule query.

Option C is incorrect because it does not include the event_type and event_sub_type fields in the

filter stage, and it uses the fields stage, which is not supported for a BIOC rule query. It also returns

the action_process_image field instead of the action_process_image_name field, which is the

expected output for a BIOC rule query.

Option D is incorrect because it uses the event_behavior field, which is not supported for a BIOC rule

query. It also does not include the event_type field in the filter stage, and it uses the event_sub_type

field incorrectly. The event_sub_type field should be equal to PROCESS_START, not true.

Reference:

Working with BIOCs

Cortex Query Language (XQL) Reference

You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or

create an alert-starring or incident-starring configuration. Starring security events helps you prioritize

and track the events that are most important to you. You can also filter and sort the events by their

star status in the Cortex XDR console.

To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents

table. You can also star an alert from the Causality View or the Query Center Results table. You can

star an incident from the Incident View or the Query Center Results table. You can also unstar an

event by clicking the star icon again.

To create an alert-starring or incident-starring configuration, you can use the Alert Starring

Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define

the criteria for starring alerts or incidents based on their severity, category, source, or other

attributes. You can also enable or disable the configurations as needed.

Reference:

Star Security Events

Create an Alert Starring Configuration

Create an Incident Starring Configuration

A supply chain attack is a type of cyberattack that targets a trusted third-party vendor who offers

services or software vital to the supply chain. Software supply chain attacks inject malicious code into

an application in order to infect all users of an app. The purpose of targeting software vendors in a

supply-chain attack is to take advantage of a trusted software delivery method, such as an update or

a download, that can reach a large number of potential victims. By compromising a software vendor,

an attacker can bypass the security measures of the downstream organizations and gain access to

their systems, data, or networks. Reference:

What Is a Supply Chain Attack? - Definition, Examples & More | Proofpoint US

What Is a Supply Chain Attack? - CrowdStrike

What Is a Supply Chain Attack? | Zscaler

What Is a Supply Chain Attack? Definition, Examples & Prevention