Exam PCDRA topic 1 question 65 discussion

Actual exam question from Palo Alto Networks's PCDRA

Question #: 65
Topic #: 1

[All PCDRA Questions]

What should you do to automatically convert leads into alerts after investigating a lead?

A. Lead threats can't be prevented in the future because they already exist in the environment.
B. Build a search query using Query Builder or XQL using a list of IOCs.
C. Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.
D. Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Show Suggested Answer

Suggested Answer: D 🗳️

by kareem101 at Nov. 19, 2023, 2:02 a.m.

Comments

Submit Cancel

Chiquitabandita

4 months, 1 week ago

Selected Answer: D

Create BIOC rules based on the set of attribute-value pairs to automatically convert the leads into alerts.

upvoted 1 times

...

I believe this should be D. Leads are not static IOCs. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Research-a-Known-Threat#:~:text=Inspect%20the%20information%20again%2C%20and%20identify%20any%20characteristics%20you%20can%20use%20to%20Create%20a%20BIOC%20Rule%20or%20Create%20a%20Correlation%20Rule.

upvoted 2 times

...

Exam PCDRA All Questions

View all questions & answers for the PCDRA exam

Exam PCDRA topic 1 question 65 discussion

Comments

Chiquitabandita

kareem101

SY0-701