PCDRA

Review 96 PCDRA practice questions with answer explanations and community insights.

Question 1

Phishing belongs which of the following MITRE ATT&CK tactics?

  1. Initial Access, Persistence
  2. Persistence, Command and Control
  3. Reconnaissance, Persistence
  4. Reconnaissance, Initial Access

Question 2

When creating a BIOC rule, which XQL query can be used?

  1. dataset = xdr_data | filter event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  2. dataset = xdr_data | filter event_type = PROCESS and event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  3. dataset = xdr_data | filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" | fields action_process_image
  4. dataset = xdr_data | filter event_behavior = true event_sub_type = PROCESS_START and action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

Question 3

Which built-in dashboard would be the best option for an executive, if they were looking for the Mean Time to Resolution (MTTR) metric?

  1. Security Manager Dashboard
  2. Data Ingestion Dashboard
  3. Security Admin Dashboard
  4. Incident Management Dashboard

Question 4

What are two purposes of “Respond to Malicious Causality Chains” in a Cortex XDR Windows Malware profile? (Choose two.)

  1. Automatically close the connections involved in malicious traffic.
  2. Automatically kill the processes involved in malicious activity.
  3. Automatically terminate the threads involved in malicious activity.
  4. Automatically block the IP addresses involved in malicious traffic.

Question 5

When creating a custom XQL query in a dashboard, how would a user save that XQL query to the Widget Library?

  1. Click the three dots on the widget and then choose “Save” and this will link the query to the Widget Library.
  2. This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.
  3. Click on “Save to Action Center” in the dashboard and you will be prompted to give the query a name and description.
  4. Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.