PCDRA 無料問題集「Palo Alto Networks Certified Detection and Remediation Analyst」

（A）mark the incident as Resolved - False Positive

（B）create a BIOC rule excluding this behavior

（C）mark the incident as Unresolved

（D）create an exception to prevent future false positives

（A）Jira

（B）Salesforce

（C）Service Now

（D）Slack

（A）Manage Network configurations, Quarantine Files, Run PowerShell scripts

（B）Apply patches, Reboot System, send notification for end user, Run Python Commands and Scripts

（C）Manage Processes, Manage Files, Run Operating System Commands, Run Python Commands and Scripts

（D）Manage Processes, Manage Files, Run Operating System Commands, Run Ruby Commands and Scripts

（A）SHA1 hash of the file

（B）MD5 hash of the file

（C）SHA256 hash of the file

（D）AES256 hash of the file

（A）Exfiltration, Command and Control, Collection

（B）Exfiltration, Command and Control, Lateral Movement

（C）Exfiltration, Command and Control, Privilege Escalation

（D）Exfiltration, Command and Control, Impact

（A）No, a separate installer package without Live Terminal is required.

（B）No, it is a required feature of the agent.

（C）Yes, via Agent Settings Profile.

（D）Yes, via the Cortex XDR console or with an installation switch.

（A）Rootkit

（B）Worm

（C）Keylogger

（D）Ransomware

（A）threat_event

（B）event_type

（C）endpoint_name

（D）causality_chain

（A）Click on "Save to Action Center" in the dashboard and you will be prompted to give the query a name and description.

（B）This isn't supported, you have to exit the dashboard and go into the Widget Library first to create it.

（C）Click the three dots on the widget and then choose "Save" and this will link the query to the Widget Library.

（D）Click on "Save to Widget Library" in the dashboard and you will be prompted to give the query a name and description.