Question 31 · 88 in bank
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?
Show answer
Answer: D
Palo Alto Networks Certified Detection and Remediation Analyst88 questions across 9 pages are complete and free, with no account or card.
88 questions in this bank
Free access · progress saved on this device
To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?
Answer: D
Which of the following is an example of a successful exploit?
Answer: B
From documentation : "An exploit is a piece of code or a program that takes advantage of a weakness (aka vulnerability) in an application or system." https://www.paloaltonetworks.com/cyberpedia/malware-vs-exploits
Source: Adapted from community discussion — Flky
Which of the following represents the correct relation of alerts to incidents?
Answer: C
Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Investigate-Incidents
Source: Adapted from community discussion — escar
What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)
Answer: AD
(Windows only) Respond to Malicious Causality Chains. When the Cortex XDR agent identifies a remote network connection that attempts to perform malicious activity—such as encrypting endpoint files—the agent can automatically block the IP address to close all existing communication and block new connections from this IP address to the endpoint. When Cortex XDRblocks an IP address per endpoint, that address remains blocked throughout all agent profiles and policies, including any host-firewall policy rules. You can view the list of all blocked IP addresses per endpoint from the Action Center, as well as unblock them to re-enable communication as appropriate.
Source: Adapted from community discussion — Karreldanam
Which of the following protection modules is checked first in the Cortex XDR Windows agent malware protection flow?
Answer: D
Phase 1: Evaluation of Child Process Protection Policy When a user attempts to run an executable, the operating system attempts to run the executable as a process. If the process tries to launch any child processes, the Cortex XDR agent first evaluates the child process protection policy. If the parent process is a known targeted process that attempts to launch a restricted child process, the Cortex XDR agent blocks the child processes from running and reports the security event to Cortex XDR.
Source: Adapted from community discussion — SpTester
While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
Answer: D
Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack will be neutralized. Which of the following statements is correct?
Answer: D
If you go here: https://www.paloaltonetworks.com/services/education/palo-alto-networks-certified-detection-and-remediation-analyst And then go to Sample questions (specifically here: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-sample-questions.pdf), there's 7 questions, one of them being: Which statement is valid regarding the Cortex XDR Analytics module? A. It interferes with an attack pattern as soon as it is observed on the endpoint. B. It does not interfere with any portion of the attack pattern on the endpoint. C. It does not need to interfere with any portion of the pattern to prevent the attack. D. It interferes with the attack pattern as soon as it is observed on the firewall. Palo Alto says the answer here is B. Therefore, for this question on ExamTopics I'd say the answer is B as well.
Source: Adapted from community discussion — sharkk43
After scan, how does file quarantine function work on an endpoint?
Answer: C
"it moves the file from the location on a local or removable drive to a local quarantine folder (%PROGRAMDATA%\Cyvera\Quarantine) where it isolates the file." in admin guide link
Source: Adapted from community discussion — Chiquitabandita
Which two types of exception profiles you can create in Cortex XDR? (Choose two.)
Answer: AC
Which profiles can the user use to configure malware protection in the Cortex XDR console?
Answer: A
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection this seems to be a bit nit picky on the wording in this question. but in the link it does reference the profile as malware protection profile so A is my answer.
Source: Adapted from community discussion — Chiquitabandita
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCDRA practice, question 31. 88 questions available.
Version 1.0.0. How we source questions