Palo Alto Networks Exam PCCET Topic 7 Question 49 Discussion

Actual exam question for Palo Alto Networks's PCCET exam

Question #: 49
Topic #: 7

What should a security operations engineer do if they are presented with an encoded string during an incident investigation?

ASave it to a new file and run it in a sandbox.

BRun it against VirusTotal.

CAppend it to the investigation notes but do not alter it.

DDecode the string and continue the investigation.

Show Suggested Answer

Suggested Answer: C

by Arthur at Nov 22, 2023, 01:02 PM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

I'm feeling a bit cautious here. I think C is the way to go - we don't want to accidentally run some malicious code, you know?

upvoted 0 times

...

3 days ago

But what if it's a time-sensitive incident? Decoding the string might be necessary to continue the investigation quickly.

upvoted 0 times

...

4 days ago

I agree with Jessenia, running it in a sandbox is the safest option.

upvoted 0 times

...

9 days ago

I think we should save it to a new file and run it in a sandbox.

upvoted 0 times

...

9 days ago

Whoa, this is a real brain-teaser! I'm going to go with D - decoding the string seems like the logical next step to continue the investigation.

upvoted 0 times

...