Paloalto Networks PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Exam Practice Test

Initial Access, Persistence

Persistence, Command and Control

Reconnaissance, Persistence

Reconnaissance, Initial Access

delete_file

quarantine_file

process_kill_name

list_directories

Create a custom XQL widget

This is not currently supported

Create a custom report and filter on starred incidents

Click the starin the widget

In the Restrictions Profile, add the file name and path to the Executable Files allow list.

Create a new rule exception and use the singer as the characteristic.

Add the signer to the allow list in the malware profile.

Add the signer to the allow list under the action center page.

Support exception

Local file threat examination exception

Behavioral threat protection rule exception

Process exception

Only alerts with thesame host are grouped together into one Incident in a given time frame.

Alerts that occur within a three hour time frame are grouped together into one Incident.

Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.

Every alert creates a new Incident.

Quarantine takes ownership of the files and folders and prevents execution through access control.

Quarantine disables the network adapters and locks down access preventing any communications with the endpoint.

Quarantine removes a specific file from its location on a local or removable drive to a protected folder and prevents it from being executed.

Quarantine prevents an endpoint from communicating with anything besides the listed exceptions in the agent profile and Cortex XDR.

Assign incidents to an analyst in bulk.

Change the status of multiple incidents.

Investigate several Incidents at once.

Delete the selected Incidents.

Any version of Python script can be run.

The level of risk is assigned to the script upon import.

Any script can be imported including Visual Basic (VB) scripts.

The script is run on the machine uploading the script to ensure that it is operational.