Free PCDRA Questions for Palo Alto Networks Certified Detection and Remediation Analyst PCDRA Exam as PDF & Practice Test Engine

Exam Code/Number: PCDRA
Exam Name/Title: Palo Alto Networks Certified Detection and Remediation Analyst
Certification Provider: Palo Alto Networks
Corresponding Certification: Palo Alto Certifications and Accreditations

Exam Questions: 93
Updated On: Jul 01, 2026

Question #1

In incident-related widgets, how would you filter the display to only show incidents that were "starred"?

A. This is not currently supported

B. Create a custom report and filter on starred incidents

C. Click the star in the widget

D. Create a custom XQL widget

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #2

To create a BIOC rule with XQL query you must at a minimum filter on which field in order for it to be a valid BIOC rule?

A. causality_chain

B. event_type

C. endpoint_name

D. threat_event

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #3

What is an example of an attack vector for ransomware?

A. Phishing emails containing malicious attachments

B. Performing SSL Decryption on an endpoint

C. A URL filtering feature enabled on a firewall

D. Performing DNS queries for suspicious domains

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #4

When using the "File Search and Destroy" feature, which of the following search hash type is supported?

A. SHA256 hash of the file

B. MD5 hash of the file

C. SHA1 hash of the file

D. AES256 hash of the file

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #5

When creating a scheduled report which is not an option?

A. Run weekly on a certain day and time.

B. Run daily at a certain time (selectable hours and minutes).

C. Run quarterly on a certain day and time.

D. Run monthly on a certain day and time.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #6

While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

A. mark the incident as Unresolved

B. mark the incident as Resolved - False Positive

C. create an exception to prevent future false positives

D. create a BIOC rule excluding this behavior

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #7

Live Terminal uses which type of protocol to communicate with the agent on the endpoint?

A. UDP and a random port

B. WebSocket

C. NetBIOS over TCP

D. TCP, over port 80

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #8

Which version of python is used in live terminal?

A. Python 2 and 3 with specific XDR Python libraries developed by Palo Alto Networks

B. Python 3 with specific XDR Python libraries developed by Palo Alto Networks

C. Python 3 with standard Python libraries

D. Python 2 and 3 with standard Python libraries

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #9

What contains a logical schema in an XQL query?

A. Bin

B. Field

C. Dataset

D. Array expand

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Question #10

What is the outcome of creating and implementing an alert exclusion?

A. The Cortex XDR console will delete those alerts and block ingestion of them in the future.

B. The Cortex XDR agent will not create an alert for this event in the future.

C. The Cortex XDR console will hide those alerts.

D. The Cortex XDR agent will allow the process that was blocked to run on the endpoint.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).

Free PCDRA Questions for Palo Alto Networks Certified Detection and Remediation Analyst PCDRA Exam as PDF & Practice Test Engine

Download Free Palo Alto Networks PCDRA Demo