Palo Alto PCDRA Practice Test (Legacy – exam retired 2025)

PCDRA practice test: what's covered

• Cortex XDR
• Detection & Remediation Analyst

Free PCDRA sample questions

1. A new customer is deploying Cortex XDR in a hybrid network where on-prem firewalls and third-party log sources need to forward telemetry to the Cortex Data Lake, but direct outbound internet from the SIEM/firewall segment is forbidden. Which Cortex component is PURPOSE-BUILT to act as the secure egress proxy for these on-prem data sources?

   • A. Cortex XDR Agent (in proxy mode)
   • B. Broker VM (with the appropriate applets — Syslog Collector, Pathfinder, etc.)
   • C. Cortex Data Lake forwarder running on Panorama
   • D. WildFire appliance in cluster mode
   Show answer

   Correct: B. Broker VM is the on-prem appliance/applet host that proxies Syslog, AD, Pathfinder, NetFlow, and other on-prem feeds into the Cortex tenant — it speaks TLS outbound on 443 only. The agent never proxies third-party logs. Panorama can send firewall logs to CDL but is not the broker for arbitrary on-prem sources. WildFire is a sandbox, not a data-collection proxy.

2. Which TWO statements about the Cortex Data Lake (CDL) are correct in a Cortex XDR Pro per-Endpoint deployment? (Choose 2)

   • A. CDL retains EDR data (process, file, network, registry events) for the licensed retention period
   • B. CDL is a customer-managed Elasticsearch cluster running on the Broker VM
   • C. CDL provides the storage backend that XQL queries run against
   • D. CDL only stores firewall logs; XDR EDR data is stored on the agent
   • E. CDL must be installed in the customer's own AWS/Azure subscription
   Show answer

   Correct: A and C. CDL is Palo Alto-managed cloud storage; customer does not run it. XDR EDR telemetry from agents is shipped to CDL and is the dataset XQL searches. Agents do NOT persist long-term telemetry locally — only buffers. The "only firewall logs" idea is the classic legacy-Logging-Service misconception.

3. A SOC analyst sees that the Cortex XDR agent on an endpoint is in "Disconnected" state for 4 hours. Real-time response actions (isolate, Live Terminal) are unavailable, but earlier alerts continue to appear in the console for a brief window after disconnect. What is the BEST explanation?

   • A. The agent stops collecting telemetry the moment it loses cloud connectivity
   • B. The agent buffers telemetry locally and uploads on reconnect; live actions require an active session to the cloud and therefore fail while disconnected
   • C. Cortex XDR cannot detect anything when the agent is offline
   • D. The endpoint switches to legacy Traps mode automatically
   Show answer

   Correct: B. The agent has a local event buffer; prevention modules (BTP, exploit, malware) keep running locally even while disconnected, and queued telemetry uploads on reconnect — which is why alerts still appear. Live Terminal, file retrieval, and isolation need a live cloud session, so they fail. "Traps mode" was the old name; there is no auto-switch.

4. During an architecture review, a customer asks which Cortex license tier is the MINIMUM required to ingest third-party logs (e.g., Microsoft 365, AWS CloudTrail, Okta) for cross-correlation with EDR data. Which is correct?

   • A. Cortex XDR Prevent
   • B. Cortex XDR Pro per Endpoint
   • C. Cortex XDR Pro per TB (or Pro per GB) — required to ingest non-XDR third-party data sources
   • D. Any Cortex license includes unlimited third-party ingestion
   Show answer

   Correct: C. Pro per Endpoint covers EDR for the licensed endpoints only. To bring in non-XDR data (cloud audit logs, SaaS, network telemetry from non-PAN sources) you need Pro per TB/GB, which is sized on ingestion volume. Prevent is NGAV/EPP only — no EDR, no third-party ingestion.

5. Which statement BEST describes how the Cortex XDR agent communicates with the management plane?

   • A. It opens an inbound TCP/8443 listener that the console connects to
   • B. It establishes an outbound persistent TLS session to a region-specific FQDN on TCP/443; all command/control flows back over that session
   • C. It uses UDP/4501 for low-latency telemetry and TCP/443 only for policy fetch
   • D. It requires a static public IP on every endpoint
   Show answer

   Correct: B. Agent is always client-initiated over outbound 443 to *.paloaltonetworks.com / regional Cortex FQDNs. There is no inbound listener — that would be unfirewall-friendly. Endpoints behind NAT/proxy are fine; just allowlist the FQDNs.

Last updated: 2026-10-19

PCDRA practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCCSE practice test