Palo Alto Networks PCDRA Exam - Topic 9 Question 58 Discussion

Actual exam question for Palo Alto Networks's PCDRA exam

Question #: 58
Topic #: 9

What are two purposes of ''Respond to Malicious Causality Chains'' in a Cortex XDR Windows Malware profile? (Choose two.)

AAutomatically close the connections involved in malicious traffic.

BAutomatically kill the processes involved in malicious activity.

CAutomatically terminate the threads involved in malicious activity.

DAutomatically block the IP addresses involved in malicious traffic.

Show Suggested Answer

Suggested Answer: C

The Wildfire analysis file size limit for Windows PE files is 100MB. Windows PE files are executable files that run on the Windows operating system, such as .exe, .dll, .sys, or .scr files. Wildfire is a cloud-based service that analyzes files and URLs for malicious behavior and generates signatures and protections for them. Wildfire can analyze various file types, such as PE, APK, PDF, MS Office, and others, but each file type has a different file size limit. The file size limit determines the maximum size of the file that can be uploaded or forwarded to Wildfire for analysis. If the file size exceeds the limit, Wildfire will not analyze the file and will return an error message.

According to the Wildfire documentation1, the file size limit for Windows PE files is 100MB. This means that any PE file that is larger than 100MB will not be analyzed by Wildfire. However, the firewall can still apply other security features, such as antivirus, anti-spyware, vulnerability protection, and file blocking, to the PE file based on the security policy settings.The firewall can also perform local analysis on the PE file using the Cortex XDR agent, which uses machine learning models to assess the file and assign it a verdict2.

WildFire File Size Limits: This document provides the file size limits for different file types that can be analyzed by Wildfire.

Local Analysis: This document explains how the Cortex XDR agent performs local analysis on files that cannot be sent to Wildfire for analysis.

by Kimberlie at Jul 09, 2024, 05:11 PM

Limited Time Offer

25%

Off

Get Premium PCDRA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Loren

3 months ago

A and D make the most sense to me!

upvoted 0 times

...

Nilsa

3 months ago

Definitely B, but I'm not so sure about D.

upvoted 0 times

...

Bulah

3 months ago

Wait, can it really terminate threads automatically? That sounds risky!

upvoted 0 times

...

Nikita

4 months ago

I disagree, I believe it's A and C.

upvoted 0 times

...

Chun

4 months ago

I think it's B and D for sure.

upvoted 0 times

...

Joseph

4 months ago

I’m a bit confused; I thought terminating threads was also a key action, but I can't remember if it was included in the profile.

upvoted 0 times

...

Lore

4 months ago

I practiced a similar question where we had to identify actions taken against threats, and I feel like automatically closing connections was one of them.

upvoted 0 times

...

Delmy

4 months ago

I think one of the options is about blocking IP addresses, but I can't recall if that's part of the malicious causality chains specifically.

upvoted 0 times

...

Rodrigo

5 months ago

I remember something about automatically killing processes, but I'm not sure if that's the only purpose.

upvoted 0 times

...

Rashida

5 months ago

This is a tricky one, but I'll do my best to apply my knowledge of malware detection and response.

upvoted 0 times

...

Dawne

5 months ago

I've got a good strategy - I'll read through the options and try to eliminate the ones that don't seem relevant.

upvoted 0 times

...

Erin

5 months ago

Okay, let's see, the key is to identify the two main purposes of "Respond to Malicious Causality Chains" in this context.

upvoted 0 times

...

Brittni

5 months ago

Hmm, I'm not too familiar with Cortex XDR, so I'll need to think this through carefully.

upvoted 0 times

...

Adria

5 months ago

This question seems straightforward, I think I can handle it.

upvoted 0 times

...

Cyril

5 months ago

Okay, I think I've got a good handle on this. The key is setting the ConflictResolutionMode to Custom and configuring the custom stored procedure to use the isTomstone parameter. As long as I implement that correctly, I should be able to meet the goal of ensuring conflicts are sent to the conflict feed.

upvoted 0 times

...

Helene

5 months ago

Hmm, these acronyms are tricky. I'll eliminate the ones that sound too legal or absolute, like option A about being 'required by law'.

upvoted 0 times

...

Melissa

5 months ago

Removing the IPsec encapsulation on vBond seems like a risky move. I'd be more inclined to configure the IPsec settings properly on vManage to ensure a secure connection.

upvoted 0 times

...

Lashaunda

10 months ago

Ooh, this is a tricky one. I'm going to go with A and D, but I'm not totally confident. Maybe I should have spent more time studying the Cortex XDR documentation instead of binge-watching that new TV show...

upvoted 0 times

Tijuana

10 months ago

Yeah, I agree. It's important to stop the malicious traffic at multiple points to protect the system.

upvoted 0 times

...

Stevie

10 months ago

I think A and D are correct. Closing connections and blocking IP addresses makes sense.

upvoted 0 times

...

Ezekiel

11 months ago

Haha, I love how these options are all about 'automatically' doing something. I guess the Cortex XDR team really wants this to be a hands-off kind of deal. 'Malicious activity? No problem, we'll just take care of it!'

upvoted 0 times

...

Hubert

11 months ago

I'm torn between B and C. Killing processes and terminating threads could also be effective in disrupting the malicious activity. But I'm not sure if those are the primary purposes of this feature.

upvoted 0 times

...

Rodolfo

11 months ago

I'm not sure about killing processes, but I think terminating threads and blocking IP addresses are important for stopping the malware.

upvoted 0 times

...

Desmond

11 months ago

A and D seem like the most logical options here. Automatically closing connections and blocking IP addresses involved in malicious traffic seems like a good way to respond to these malicious chains.

upvoted 0 times