ExamTopics Logo
Mail Us[email protected]
Menu
Palo-Alto-Networks Discussions
exam questions

Exam PCDRA All Questions

View all questions & answers for the PCDRA exam
Go to Exam

Exam PCDRA topic 1 question 2 discussion

Actual exam question from Palo Alto Networks's PCDRA
Question #: 2
Topic #: 1
[All PCDRA Questions]

When creating a BIOC rule, which XQL query can be used?

  • A. dataset = xdr_data
    | filter event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  • B. dataset = xdr_data
    | filter event_type = PROCESS and
    event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
  • C. dataset = xdr_data
    | filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
    | fields action_process_image
  • D. dataset = xdr_data
    | filter event_behavior = true
    event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by 9smiles at May 26, 2023, 11:26 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
nobody165456131354
9 months, 3 weeks ago
Selected Answer: B
Correct answer is: B A: missing event_type C: wrong action_process_image D: wrong event_behaviour
upvoted 2 times
...
9smiles
1 year, 5 months ago
Correct answer is: B "The XQL query must at a minimum filter on the event_type field in order for it to be a valid BIOC rule."
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago