Exit PCDRA Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA)
Question 5 of 5
0% complete
Q5 Single choice

When creating a BIOC rule, which XQL query can be used?

  • A

    dataset = xdr_data
    | filter event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

  • B

    dataset = xdr_data
    | filter event_type = PROCESS and
    event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

  • C

    dataset = xdr_data
    | filter action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe" | fields action_process_image

  • D

    dataset = xdr_data
    | filter event_behavior = true
    event_sub_type = PROCESS_START and
    action_process_image_name ~= ".*?\.(?:pdf|docx)\.exe"

Previous Save & finish