Palo Alto Networks Exam PCDRA Topic 9 Question 63 Discussion

Actual exam question for Palo Alto Networks's PCDRA exam

Question #: 63
Topic #: 9

What should you do to automatically convert leads into alerts after investigating a lead?

ALead threats can't be prevented in the future because they already exist in the environment.

BCreate IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

CCreate BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

DBuild a search query using Query Builder or XQL using a list of lOCs.

Show Suggested Answer

Suggested Answer: B

To automatically convert leads into alerts after investigating a lead, you should create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting. IOC rules are used to detect known threats based on indicators of compromise (IOCs) such as file hashes, IP addresses, domain names, etc. By creating IOC rules from the leads, you can prevent future occurrences of the same threats and generate alerts for them.Reference:

PCDRA Study Guide, page 25

Cortex XDR 3: Handling Cortex XDR Alerts, section 3.2

Cortex XDR Documentation, section ''Create IOC Rules''

by Rory at Sep 19, 2024, 08:07 AM

Limited Time Offer

25%

Off

Get Premium PCDRA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gladis

2 months ago

C) BIOC? Is that some kind of new cybersecurity dance move? I'll stick with good old IOCs, thanks.

upvoted 0 times

...

Blossom

2 months ago

I'm not sure, but I think D) Build a search query using Query Builder or XQL using a list of IOCs could also be a valid option.

upvoted 0 times

...

Shakira

2 months ago

Haha, A) is a classic case of closing the barn door after the horse has bolted. Can't prevent what's already happened!

upvoted 0 times

Gianna

1 months ago

D) Build a search query using Query Builder or XQL using a list of lOCs.

upvoted 0 times

...

Shawnta

1 months ago

C) Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

upvoted 0 times

...

Kimberely

2 months ago

B) Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

upvoted 0 times

...

3 months ago

B) is the correct answer. Creating IOC rules based on the investigation findings is the way to automatically convert leads into alerts.

upvoted 0 times

Goldie

2 months ago

D) Build a search query using Query Builder or XQL using a list of IOCs.

upvoted 0 times

...

Bambi

2 months ago

A) Lead threats can't be prevented in the future because they already exist in the environment.

upvoted 0 times

...

Ocie

2 months ago

B) Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

upvoted 0 times

...

Krissy

3 months ago

I think the answer is B) Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

upvoted 0 times

...