Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA - Cortex XDR) · Palo Alto Networks
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
To configure the Global Behavioral Threat Protection Rules: Define the Action mode to take when the Cortex XDR agent detects malicious causality chains: Block (default)—Block all processes and threads in the event chain up to the CGO. Report—Allow the activity but report it to Cortex XDR. Disabled—Disable the module and do not analyze or report the activity.
I had seen about 4 questions from this site, that are very similar and can't really confirm which is the best answer. I keep coming up with a similar solution would be to create a BIOC rule for this situation but that is not one of the choices, it is different from a BTP rule, which to my research does not allow creation of rules to the general public. I had wondered if they possibly got the question mistranscribed from the source. Anyone have any other sources? C looks like it could be a good choice except as, 9smiles has suggested it is detection, not prevention, and the question asks for prevention.
Please provide a reference for your claim im2ca. I have not been able to find any supporting documentation for this. Probably you are talking about custom prevention rules, which are basically BIOC rules that you add to restriction profiles see [1], but BTP Rules are something else and their database is not available to the public [2]. [1]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Create-a-BIOC-Rule [2]: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/about-behavioral-threat-protection-btp-rules/td-p/395977