PCDRA Palo Alto Networks Certified Detection and Remediation Analyst Questions and Answers

destination port

e-mail address

full path

App-ID

There are a total of 689 Up To Date agents.

Agent Auto Upgrade was enabled but not on all endpoints.

Agent Auto Upgrade has not been enabled.

There are more agents in Pending status than InProgress status.

Find the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

Fromthe rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

Find the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

In the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

Exfiltration, Command and Control, Collection

Exfiltration, Command and Control, Privilege Escalation

Exfiltration, Command and Control, Impact

Exfiltration, Command and Control, Lateral Movement

by encrypting the disk first.

by utilizing decoy Files.

by retrieving the encryption key.

by patching vulnerable applications.

mark the incident as Unresolved

create a BIOC rule excluding this behavior

create an exception to prevent future false positives

mark the incident as Resolved – False Positive