Exam PCDRA topic 1 question 42 discussion

If you go here: https://www.paloaltonetworks.com/services/education/palo-alto-networks-certified-detection-and-remediation-analyst And then go to Sample questions (specifically here: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcdra-sample-questions.pdf), there's 7 questions, one of them being: Which statement is valid regarding the Cortex XDR Analytics module? A. It interferes with an attack pattern as soon as it is observed on the endpoint. B. It does not interfere with any portion of the attack pattern on the endpoint. C. It does not need to interfere with any portion of the pattern to prevent the attack. D. It interferes with the attack pattern as soon as it is observed on the firewall. Palo Alto says the answer here is B. Therefore, for this question on ExamTopics I'd say the answer is B as well.

looking at the links below I think it is B

Coverage of MITRE Attack Tactics: Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack is neutralized. The Cortex XDR Analytics Engine retrieves logs from the Cortex XDR tenant to create a baseline so that it can raise alerts when abnormal activity occurs. This analysis is highly sophisticated and performed on more than a thousand dimensions of data. Internally, Cortex XDR organizes its analytics activity into algorithms called detectors. Each detector is responsible for raising an alert when suspicious behavior is detected. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts So I vote B. It enables the possibility but not to do anything on the Firewall itself or Endpoint itself. So it cannot act as soon as pattern is detected.

Coverage of MITRE Attack Tactics: Network attacks follow predictable patterns. If you interfere with any portion of this pattern, the attack is neutralized. The Cortex XDR Analytics Engine retrieves logs from the Cortex XDR tenant to create a baseline so that it can raise alerts when abnormal activity occurs. This analysis is highly sophisticated and performed on more than a thousand dimensions of data. Internally, Cortex XDR organizes its analytics activity into algorithms called detectors. Each detector is responsible for raising an alert when suspicious behavior is detected. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts So I vote D. It enables the possibility but not to do anything on the Firewall itself.

BIOC Analytics is just a detection alert. Unless you have set a custom BIOC Prevention rules. My answer would be B.

The question is talking about Network Attacks, so I think, it is talking about Firewalls, https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts The Cortex XDR app uses its Analytics Engine to examine logs and data retrieved from your sensors on the Cortex XDR tenants to build an activity baseline, and recognize abnormal activity when it occurs. The Analytics Engine accesses your logs as they are streamed to the Cortex XDR tenant, including any Firewall data, and analyzes the data as soon as it arrives. Cortex XDR raises an Analytics alert when the Analytics Engine determines an anomaly. I guess the answer is A.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Analytics-Concepts