New PCDRA Exam Questions [2022] Released For Preparation OF Palo Alto Networks PCDRA Exam

Page 1 of 1

1. To create a BIOC rule with XQL query you must at a minimum filter on which field inorder for it to be a valid BIOC rule?

causality_chain

endpoint_name

threat_event

event_type

2. When selecting multiple Incidents at a time, what options are available from the menu when a user right-clicks the incidents? (Choose two.)

Assign incidents to an analyst in bulk.

Change the status of multiple incidents.

Investigate several Incidents at once.

Delete the selected Incidents.

3. What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automaticallyblock the IP addresses involved in malicious traffic.

4. Which of the following represents the correct relation of alerts to incidents?

Only alerts with the same host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

5. Which of the following policy exceptions applies to the following description?

‘An exception allowing specific PHP files’

Support exception

Local file threat examination exception

Behavioral threat protection rule exception

Process exception

6. Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

Security Manager Dashboard

Data Ingestion Dashboard

Security Admin Dashboard

Incident Management Dashboard

7. When creating a BIOC rule, which XQL query can be used?

dataset = xdr_data | filterevent_sub_type = PROCESS_START and action_process_image_name ~= ".*?.(?:pdf|docx).exe"

dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?.(?:pdf|docx).exe"

dataset = xdr_data | filter action_process_image_name ~= ".*?.(?:pdf|docx).exe" | fields action_process_image

dataset = xdr_data | filter event_behavior = true event_sub_type = PROCESS_START and action_process_image_name ~=".*?.(?:pdf|docx).exe"

Read Palo Alto Networks PCDRA Free Exam Questions