Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA - Cortex XDR) Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  C is the right answer since in the malware profile you can add items to the allowed list based on the signer. A is wrong, I mean you can do it but that is not what the question is asking for lol

• 1

  It's worth to mention that creating an allow list based on digital signer used to be available in the malware protection profile but in older versions, on the very newer versions this feature has changed and is not available on that profile anymore. There is a new feature called "Legacy Agent Exceptions" under Settings > Exceptions Configurations and you basically have to create a rule exception based on your needs such as the digital signer. So if the question is expecting an updated answer then the right choice would be "B", probably on the real exam the question is worded different.

• Chose C1

  Option A will allow only a specific executable while option C will allow this Signer in general which is the point of this question.