PCDRA

PCDRA practice questions, page 3 of 4, with answer review and explanations.

Question 11

In incident-related widgets, how would you filter the display to only show incidents that were “starred”?

  1. Create a custom XQL widget
  2. This is not currently supported
  3. Create a custom report and filter on starred incidents
  4. Click the star in the widget

Question 12

Where would you view the WildFire report in an incident?

  1. next to relevant Key Artifacts in the incidents details page
  2. under Response --> Action Center
  3. under the gear icon --> Agent Audit Logs
  4. on the HUB page at apps.paloaltonetworks.com

Question 13

What does the following output tell us?

  1. There is one low severity incident.
  2. Host shpapy_win10 had the most vulnerabilities.
  3. There is one informational severity alert.
  4. This is an actual output of the Top 10 hosts with the most malware.

Question 14

Which engine, of the following, in Cortex XDR determines the most relevant artifacts in each alert and aggregates all alerts related to an event into an incident?

  1. Sensor Engine
  2. Causality Analysis Engine
  3. Log Stitching Engine
  4. Causality Chain Engine

Question 15

Which type of BIOC rule is currently available in Cortex XDR?

  1. Threat Actor
  2. Discovery
  3. Network
  4. Dropper