Home
Exams
Providers
About
Sign In
Sign Up
Home
/
Exams
/
Palo Alto Networks Palo Alto Networks Certified Detection and Remediation Analyst
/
Question #2
#2
Multiple Choice
Mark for review
When creating a BIOC rule, which XQL query can be used?
A.
dataset = xdr_data| filter event_sub_type = PROCESS_START andaction_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
B.
dataset = xdr_data| filter event_type = PROCESS andevent_sub_type = PROCESS_START andaction_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
C.
dataset = xdr_data| filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"| fields action_process_image
D.
dataset = xdr_data| filter event_behavior = trueevent_sub_type = PROCESS_START andaction_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"
Reveal Answer
Previous
Question 2 of 96
Exam PCDRA Topic 1 Question 2
Back to all questions
Next
Sign In
Sign Up