Palo Alto Networks PCDRA Exam - Topic 1 Question 55 Discussion

Actual exam question for Palo Alto Networks's PCDRA exam

Question #: 55
Topic #: 1

When viewing the incident directly, what is the ''assigned to'' field value of a new Incident that was just reported to Cortex?

APending

BIt is blank

CUnassigned

DNew

Show Suggested Answer

Suggested Answer: B

To pivot within a row to Causality view and Timeline views for further investigation, you can use the Open Card and Open Timeline actions respectively. The Open Card action will open a new tab with the Causality view of the selected row, showing the causal chain of events that led to the alert. The Open Timeline action will open a new tab with the Timeline view of the selected row, showing the chronological sequence of events that occurred on the affected endpoint. These actions allow you to drill down into the details of each alert and understand the root cause and impact of the incident.Reference:

Cortex XDR User Guide, Chapter 9: Investigate Alerts, Section: Pivot to Causality View and Timeline View

PCDRA Study Guide, Section 3: Investigate and Respond to Alerts, Objective 3.1: Investigate alerts using the Causality view and Timeline view

by Adria at Jun 01, 2024, 02:32 AM

Limited Time Offer

25%

Off

Get Premium PCDRA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ming

3 months ago

I remember it being blank in some cases too.

upvoted 0 times

...

Deane

3 months ago

I agree, "Unassigned" makes the most sense.

upvoted 0 times

...

Ahmad

3 months ago

Wait, is it really "Unassigned"? That seems odd.

upvoted 0 times

...

Herman

4 months ago

I thought it was "Pending"?

upvoted 0 times

...

Hayley

4 months ago

It's definitely "Unassigned" when first reported.

upvoted 0 times

...

Desmond

4 months ago

I want to say it's "Pending," but I can't recall if that's for incidents that are being processed.

upvoted 0 times

...

Lina

4 months ago

I feel like it could be blank too, but that doesn't seem right for a new incident.

upvoted 0 times

...

Meghann

4 months ago

I remember practicing a similar question, and I think it was "New" for the status of newly reported incidents.

upvoted 0 times

...

Lewis

5 months ago

I think the "assigned to" field might be "Unassigned" since it's a new incident, but I'm not entirely sure.

upvoted 0 times

...

Amber

5 months ago

This seems like a tricky question. I'll need to think carefully about the typical workflow for new incidents in Cortex. Maybe I can eliminate some of the options and narrow it down.

upvoted 0 times

...

Linn

5 months ago

I'm a little confused by this question. I don't recall learning about the specific default value for the "assigned to" field in Cortex. I'll have to guess on this one.

upvoted 0 times

...

Moon

5 months ago

Okay, let's see. The question is asking about the default value of the "assigned to" field, so I'll need to remember how Cortex handles new incidents. I'm pretty confident I can figure this out.

upvoted 0 times

...

Sueann

5 months ago

Hmm, I'm not entirely sure about this one. I'll need to think it through carefully and review my notes on incident management in Cortex.

upvoted 0 times

...

Carla

5 months ago

This seems like a straightforward question about the default value of the "assigned to" field for a new incident in Cortex. I think I can handle this one.

upvoted 0 times

...

Tequila

5 months ago

Wait, is it "precision"? I'm second-guessing myself now. I know precision is important in sampling, but I'm not sure if it's the specific term for evaluating the possible error in both directions. Hmm, I'll have to re-read that section in my notes.

upvoted 0 times

...

Vallie

5 months ago

This looks like a tricky one. I'll need to carefully review the details and think through the possible solutions.

upvoted 0 times

...

Moon

10 months ago

Ah, the age-old question of the 'assigned to' field on a new incident. It's like a game of IT support roulette! I'm going to go with 'Unassigned' on this one. After all, who needs to be the first poor soul to get saddled with a fresh new problem?

upvoted 0 times

Carrol

9 months ago

I'm pretty sure it's 'New'. That would make the most sense for a brand new incident.

upvoted 0 times

...

Patria

9 months ago

I believe it's 'Pending'. That's usually the default status for new incidents.

upvoted 0 times

...

Lettie

9 months ago

I think it's 'Unassigned' too. No one wants to be the first one to deal with a new incident.

upvoted 0 times

...

Nu

10 months ago

Hmm, tricky one. I'm leaning towards 'It is blank', since the incident is just being reported and hasn't been assigned yet. But then again, maybe Cortex has a default 'Unassigned' setting. Decisions, decisions! At least this question isn't about configuring a printer – that's where the real fun begins.

upvoted 0 times

Elke

9 months ago

'Pending' could also be a possibility. It might be in a queue waiting for action.

upvoted 0 times

...

Scot

9 months ago

I agree, 'Unassigned' makes sense. It's probably waiting to be assigned to someone.

upvoted 0 times

...

Tyra

9 months ago

I think it's 'Unassigned'. Cortex probably has a default setting for new incidents.

upvoted 0 times

...

Svetlana

10 months ago

Let's see, 'Pending' seems a bit too ambiguous, and 'New' doesn't really convey the assignment status. I'm going to go with 'Unassigned' on this one. After all, who wants to be the one left holding the bag on a brand new incident?

upvoted 0 times

...

Oneida

10 months ago

Aha! I bet it's 'Unassigned'. That's the typical default value for new incidents that haven't been assigned to a specific user yet. Though 'Pending' would also make sense, I suppose. Gotta love these subtle IT support questions!

upvoted 0 times

Ligia

9 months ago

I'm leaning towards 'Pending'.

upvoted 0 times

...

Augustine

9 months ago

I believe it's 'Unassigned' as well.

upvoted 0 times

...

Linette

10 months ago

I would go with 'Pending'.

upvoted 0 times

...

Elke

10 months ago

I think it's 'Unassigned'.

upvoted 0 times

...

Phil

11 months ago

Hmm, this is a tricky one. I'd say the 'assigned to' field is probably blank, since the incident is just being reported and hasn't been assigned to anyone yet. But who knows, maybe it defaults to 'Unassigned'? I'll have to think this one through carefully.

upvoted 0 times