Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA - Cortex XDR) Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Unit42 through in-depth threat intel investigations understand and grab potential Ransomware behaviors such as common file paths or processes affected in order to build decoy files and enhance the ransomware detection. These decoy files are sent through content updates.

• 1

  Correct Answer: B Behavior-Based Ransomware Protection This module protects against encryption-based behavior associated with ransomware by analyzing and stopping ransomware activity before any data loss occurs. To combat these attacks, Cortex XDR employs decoy files to attract the ransomware. When the ransomware attempts to write to, rename, move, delete, or encrypt the decoy files, the Cortex XDR agent analyzes the behavior and prevents the ransomware from encrypting and holding files hostage. When configured to operate in Prevention Mode, the Cortex XDR agent blocks the process attempting to manipulate the decoy files. When you configure this module in Notification Mode, the agent logs a security event.

• 2

  My answer would be: B