PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Exam

The Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) certification is a knowledge-based certification that validates candidates’ understanding of fundamental cybersecurity, network security, cloud security, and SOC security.

Certification Objectives
The PCDRA certification is the first of its kind credential to cover foundational knowledge of industry recognized Cybersecurity and Endpoint security concepts as well as various cutting-edge advancements across all Palo Alto Networks technologies. The PCDRA certification validates that engineers possess the in-depth skills and knowledge to develop playbooks, manage incidents, create automations and integrations and demonstrate the highest standard of deployment methodology and operational best practices associated with Palo Alto Networks Cortex® XDR™.

Target Audience
The PCDRA certification is designed for students, technical professionals, as well as any non-technical individuals interested in validating comprehensive knowledge on current cybersecurity tenets including security engineers, security administrators, security operators, security analysts, and security architects.

Enablement Path
This certification has no prerequisites. Recommended Instructor-led training includes the Palo Alto Networks Cortex XDR: Prevention and Deployment (EDU-260) and Palo Alto Networks Cortex XDR: Investigation and Response (EDU- 262). Recommended Self-paced training include Analyzing and securing with Cortex XDR and Extending Cortex XDR and Proactive security. The training and the self-paced learnings can be accessed from the Palo Alto Education portal.

Palo Alto Networks Education
The technical curriculum developed and authorized by Palo Alto Networks and delivered by Palo Alto Networks Authorized Training Partners helps provide the knowledge and expertise that prepare you to protect our digital way of life. Our trusted certifications validate your knowledge of the Palo Alto Networks product portfolio and your ability to help prevent successful cyberattacks and safely enable applications.

Threats and Attacks 10%
Prevention and Detection 20%
Investigation 20%
Remediation 15%
Threat Hunting 10%
Reporting 10%
Architecture 15%

Domain 1 Threats and Attacks 10%
Task 1.1 Recognize the different types of attacks
1.1.1 Differentiate between exploits and malware.
1.1.2 Define a file-less attack.
1.1.3 Define a supply chain attack.
1.1.4 Outline ransomware threats.

Task 1.2 Recognize common attack tactics
1.2.1 List common attack tactics.
1.2.2 Define various attack tactics.
1.2.3 Outline MITRE framework steps.

Task 1.3 Recognize various types of threats/vulnerabilities
1.3.1 Differentiate between threats and attacks.
1.3.2 Define product modules that help identify threats.
1.3.3 Identify legitimate threats (true positives) vs. illegitimate threats (false positives).
1.3.4 Summarize the generally available references for vulnerabilities.

Domain 2 Prevention and Detection 20%
Task 2.1 Recognize common defense systems
2.1.1 Identify ransomware defense systems.
2.1.2 Summarize device management defenses.

Task 2.2 Identify attack vectors.
2.2.1 Summarize how to prevent agent attacks.
2.2.2 Describe how to use XDR to prevent supply chain attacks.
2.2.3 Describe how to use XDR to prevent phishing attacks.
2.2.4 Characterize the differences between malware and exploits.
2.2.5 Categorize the types and structures of vulnerabilities.

Task 2.3 Outline malware prevention.
2.3.1 Define behavioral threat protection.
2.3.2 Identify the profiles that must be configured for malware prevention.
2.3.3 Outline malware protection flow.
2.3.4 Describe the uses of hashes in Cortex XDR.
2.3.5 Identify the use of malware prevention modules (MPMs).

Task 2.4 Outline exploit prevention
2.4.1 Identify the use of exploit prevention modules (EPMs).
2.4.2 Define default protected processes.
2.4.3 Characterize the differences between application protection and kernel protection.

Task 2.5 Outline analytic detection capabilities
2.5.1 Define the purpose of detectors.
2.5.2 Define machine learning in the context of analytic detection.
2.5.3 Identify the connection of analytic detection capabilities to MITRE.

Domain 3 Investigation 20%
Task 3.1 Identify the investigation capabilities of Cortex XDR
3.1.1 Describe how to navigate the console.
3.1.2 Identify the remote terminal options.
3.1.3 Characterize the differences between incidents and alerts.
3.1.4 Characterize the differences between exclusions and exceptions.

Task 3.2 Identify the steps of an investigation
3.2.1 Clarify how incidents and alerts interrelate.
3.2.2 Identify the order in which to resolve incidents.
3.2.3 Identify which steps are valid for an investigation.
3.2.4 List the options to highlight or suppress incidents.

Task 3.3 Identify actions to investigate incidents
3.3.1 Describe when to perform actions using the live terminal.
3.3.2 Describe what actions can be performed using the live terminal.
3.3.3 Describe when to perform actions using a script.
3.3.4 Identify common investigation screens and processes.

Task 3.4 Outline incident collaboration and management using XDR.
3.4.1 Outline, read, and write attributes.
3.4.2 Characterize the difference between incidents and alerts.

Domain 4 Remediation 15%
Task 4.1 Describe basic remediation
4.1.1 Describe how to navigate the remediation suggestions.
4.1.2 Distinguish between automatic vs. manual remediations.
4.1.3 Summarize how/when to run a script.
4.1.4 Describe how to fix false positives.

Task 4.2 Define examples of remediation
4.2.1 Define ransomware.
4.2.2 Define registry.
4.2.3 Define file changes/deletions.

Task 4.3 Define configuration options in XDR to fix problems
4.3.1 Define blocklist.
4.3.2 Define signers.
4.3.3 Define allowlist.
4.3.4 Define exceptions.
4.3.5 Define quarantine/isolation.
4.3.6 Define file search and destroy.

Domain 5 Threat Hunting 10%

Task 5.1 Outline the tools for threat hunting
5.1.1 Explain the purpose and use of the IOC technique.
5.1.2 Explain the purpose and use of the BIOC technique.
5.1.3 Explain the purpose and use of the XQL technique.
5.1.4 Explain the purpose and use of the query builder technique.

Task 5.2 Identify how to prevent the threat
    5.2.1 Convert BIOCs into custom prevention rules.

Task 5.3 Manage threat hunting
    5.3.1 Describe the purpose of Unit 42.

Domain 6 Reporting 10%Task 6.1 Identify the reporting capabilities of XDR
    6.1.1 Leverage reporting tools.

Task 6.2 Outline how to build a quality report
    6.2.1 Identify what is relevant to a report given context.
    6.2.2 Interpret meaning from a report.
    6.2.3 Identify the information needed for a given audience.
    6.2.4 Outline the capabilities of XQL to build a report.
    6.2.5 Outline distributing and scheduling capabilities of Cortex XDR.

Domain 7 Architecture 15%
Task 7.1 Outline components of Cortex XDR
    7.1.1 Define the role of Cortex XDR Data Lake.
    7.1.2 Define the role of Cortex Agent.
    7.1.3 Define the role of Cortex Console.
    7.1.4 Define the role of Cortex Broker.
    7.1.5 Distinguish between different proxies.
    7.1.6 Define the role of Directory Sync.
    7.1.7 Define the role of Wildfire.

Task 7.2 Describe communication among components
    7.2.1 Define communication of data lakes.
    7.2.2 Define communication for Wildfire.
    7.2.3 Define communication options/channels to and from the client.
    7.2.4 Define communication for external dynamic list (EDL).
    7.2.5 Define communication from the broker.

Task 7.3 Describe the architecture of agent related to different operating systems
    7.3.1 Recognize different supported operating systems.
    7.3.2 Characterize the differences between functions or features on operating systems.

Task 7.4 Outline how Cortex XDR ingests other non-Palo Alto Networks data sources.
    7.4.1 Outline all ingestion possibilities.
    7.4.2 Describe details of the ingestion methods.

Task 7.5 Overview of functions and deployment of Broker
    7.5.1 Outline deployment of Broker.
    7.5.2 Describe how to use the Broker to ingest third party alert.
    7.5.3 Describe how to use the Broker as a proxy between the agents and XDR in the Cloud.
    7.5.4 Describe how to use the Broker to activate Pathfinder.

QUESTION 1
Phishing belongs which of the following MITRE ATT&CK tactics?

A. Initial Access, Persistence
B. Persistence, Command and Control
C. Reconnaissance, Persistence
D. Reconnaissance, Initial Access

Answer: D

QUESTION 2
When creating a BIOC rule, which XQL query can be used?

A. dataset = xdr_data
| filter event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?\.(?:pdf|docx)\.exe”
B. dataset = xdr_data
| filter event_type = PROCESS and
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?\.(?:pdf|docx)\.exe”
C. dataset = xdr_data
| filter action_process_image_name ~= “.*?\.(?:pdf|docx)\.exe”
| fields action_process_image
D. dataset = xdr_data
| filter event_behavior = true
event_sub_type = PROCESS_START and
action_process_image_name ~= “.*?\.(?:pdf|docx)\.exe”

Answer: B

QUESTION 3
Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

A. Security Manager Dashboard
B. Data Ingestion Dashboard
C. Security Admin Dashboard
D. Incident Management Dashboard

Answer: A

Examkingdom Palo Alto PCDRA Exam pdf, Certkingdom Palo Alto PCDRA PDF