Get Palo Alto Networks PCDRA Exam Practice Questions - Real and Updated

Answer : C

The ''assigned to'' field value of a new incident that was just reported to Cortex is ''Unassigned''. This means that the incident has not been assigned to any analyst or group yet, and it is waiting for someone to take ownership of it. The ''assigned to'' field is one of the default fields that are displayed in the incident layout, and it can be used to filter and sort incidents in the incident list.The ''assigned to'' field can be changed manually by an analyst, or automatically by a playbook or a rule12.

Let's briefly discuss the other options to provide a comprehensive explanation:

A) Pending: This is not the correct answer. Pending is not a valid value for the ''assigned to'' field. Pending is a possible value for the ''status'' field, which indicates the current state of the incident.The status field can have values such as ''New'', ''Active'', ''Done'', ''Closed'', or 'Pending'3.

B) It is blank: This is not the correct answer. The ''assigned to'' field is never blank for any incident.It always has a default value of ''Unassigned'' for new incidents, unless a playbook or a rule assigns it to a specific analyst or group12.

D) New: This is not the correct answer. New is not a valid value for the ''assigned to'' field. New is a possible value for the ''status'' field, which indicates the current state of the incident.The status field can have values such as ''New'', ''Active'', ''Done'', ''Closed'', or 'Pending'3.

In conclusion, the ''assigned to'' field value of a new incident that was just reported to Cortex is ''Unassigned''. This field can be used to manage the ownership and responsibility of incidents, and it can be changed manually or automatically.

Cortex XDR Pro Admin Guide: Manage Incidents

Cortex XDR Pro Admin Guide: Assign Incidents

Cortex XDR Pro Admin Guide: Update Incident Status

Answer : C, D

You can star security events in Cortex XDR in two ways: manually star an alert or an incident, or create an alert-starring or incident-starring configuration. Starring security events helps you prioritize and track the events that are most important to you. You can also filter and sort the events by their star status in the Cortex XDR console.

To manually star an alert or an incident, you can use the star icon in the Alerts table or the Incidents table. You can also star an alert from the Causality View or the Query Center Results table. You can star an incident from the Incident View or the Query Center Results table. You can also unstar an event by clicking the star icon again.

To create an alert-starring or incident-starring configuration, you can use the Alert Starring Configuration or the Incident Starring Configuration pages in the Cortex XDR console. You can define the criteria for starring alerts or incidents based on their severity, category, source, or other attributes. You can also enable or disable the configurations as needed.

Star Security Events

Create an Alert Starring Configuration

Create an Incident Starring Configuration

Answer : C

TheHost Insights moduleprovides the best visibility to view vulnerabilities on your endpoints. The Host Insights module is an add-on feature for Cortex XDR that combines vulnerability management, application and system visibility, and a Search and Destroy feature to help you identify and contain threats. The vulnerability management feature allows you to scan your Windows endpoints for known vulnerabilities and missing patches, and view the results in the Cortex XDR console. You can also filter and sort the vulnerabilities by severity, CVSS score, CVE ID, or patch availability. The Host Insights module helps you reduce your exposure to threats and improve your security posture.Reference:

Host Insights

Vulnerability Management

Answer : D

The Incident Management Dashboard provides a high-level overview of the incident response process, including the Mean Time to Resolution (MTTR) metric. This metric measures the average time it takes to resolve an incident from the moment it is created to the moment it is closed. The dashboard also shows the number of incidents by status, severity, and assigned analyst, as well as the top alerts by category, source, and destination. The Incident Management Dashboard is designed for executives and managers who want to monitor the performance and efficiency of their security teams.Reference: [PCDRA Study Guide], page 18.

Answer : C

Quarantine is a feature of Cortex XDR that allows you to isolate a malicious file from its original location and prevent it from being executed. Quarantine works by moving the file to a protected folder on the endpoint and changing its permissions and attributes. Quarantine can be applied to files detected by periodic scans or by behavioral threat protection (BTP) rules. Quarantine is only supported for portable executable (PE) and dynamic link library (DLL) files. Quarantine does not affect the network connectivity or the communication of the endpoint with Cortex XDR.Reference:

Quarantine Malicious Files

Manage Quarantined Files