PCDRA

PCDRA practice questions, page 4 of 4, with answer review and explanations.

Question 16

In Windows and macOS you need to prevent the Cortex XDR Agent from blocking execution of a file based on the digital signer. What is one way to add an exception for the singer?

  1. In the Restrictions Profile, add the file name and path to the Executable Files allow list.
  2. Create a new rule exception and use the singer as the characteristic.
  3. Add the signer to the allow list in the malware profile.
  4. Add the signer to the allow list under the action center page.

Question 17

As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive ongoing supply chain attack. Using Cortex XDR you recognize that your server was compromised by the attack and that Cortex XDR prevented it. What steps can you take to ensure that the same protection is extended to all your servers?

  1. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
  2. Enable DLL Protection on all servers but there might be some false positives.
  3. Create IOCs of the malicious files you have found to prevent their execution.
  4. Enable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

Question 18

Which statement is true based on the following Agent Auto Upgrade widget?

  1. There are a total of 689 Up To Date agents.
  2. Agent Auto Upgrade was enabled but not on all endpoints.
  3. Agent Auto Upgrade has not been enabled.
  4. There are more agents in Pending status than In Progress status.

Question 19

What is the purpose of targeting software vendors in a supply-chain attack?

  1. to take advantage of a trusted software delivery method.
  2. to steal users’ login credentials.
  3. to access source code.
  4. to report Zero-day vulnerabilities.