Free Palo Alto Networks XDR-Analyst Exam Dumps Questions & Answers

When is the wss (WebSocket Secure) protocol used?

• A.  when the Cortex XDR agent downloads new security content
• B.  when the Cortex XDR agent connects to WildFire to upload files for analysis
• C.  when the Cortex XDR agent uploads alert data
• D.  when the Cortex XDR agent establishes a bidirectional communication channel

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?

• A.  No step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.
• B.  Enable DLL Protection on all endpoints but there might be some false positives.
• C.  Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
• D.  No step is required because the malicious document is already stopped.

To stop a network-based attack, any interference with a portion of the attack pattern is enough to prevent it from succeeding. Which statement is correct regarding the Cortex XDR Analytics module?

• A.  It does not interfere with any portion of the pattern on the endpoint.
• B.  It interferes with the pattern as soon as it is observed by the firewall.
• C.  It interferes with the pattern as soon as it is observed on the endpoint.
• D.  It does not need to interfere with the any portion of the pattern to prevent the attack.

What is the standard installation disk space recommended to install a Broker VM?

• A.  1GB disk space
• B.  512GB disk space
• C.  2GB disk space
• D.  256GB disk space

What does the following output tell us?

• A.  This is an actual output of the Top 10 hosts with the most malware.
• B.  There is one informational severity alert.
• C.  Host shpapy_win10 had the most vulnerabilities.
• D.  There is one low severity incident.