PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Questions and Answers

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive

NetBIOS over TCP

WebSocket

UDP and a random port

TCP, over port 80

SHA256 hash of the file

AES256 hash of the file

MD5 hash of the file

SHA1 hash of the file

The ultimate goal of any exploit is to reach the application.

Kernel exploits are easier to prevent then application exploits.

The ultimate goal of any exploit is to reach the kernel.

Application exploits leverage kernel vulnerability.

Automatically close the connections involved in malicious traffic.

Automatically kill the processes involved in malicious activity.

Automatically terminate the threads involved in malicious activity.

Automaticallyblock the IP addresses involved in malicious traffic.

Click the three dots on the widget andthen choose “Save” and this will link the query to the Widget Library.

This isn’t supported, you have to exit the dashboard and go into the Widget Library first to create it.

Click on “Save to Action Center” in the dashboard and you will be promptedto give the query a name and description.

Click on “Save to Widget Library” in the dashboard and you will be prompted to give the query a name and description.