Palo Alto Networks PCDRA Exam - Topic 15 Question 33 Discussion

Actual exam question for Palo Alto Networks's PCDRA exam

Question #: 33
Topic #: 15

Where would you go to add an exception to exclude a specific file hash from examination by the Malware profile for a Windows endpoint?

AFind the Malware profile attached to the endpoint, Under Portable Executable and DLL Examination add the hash to the allow list.

BFrom the rules menu select new exception, fill out the criteria, choose the scope to apply it to, hit save.

CFind the exceptions profile attached to the endpoint, under process exceptions select local analysis, paste the hash and save.

DIn the Action Center, choose Allow list, select new action, select add to allow list, add your hash to the list, and apply it.

Show Suggested Answer

Suggested Answer: B

by Veronika at Mar 23, 2023, 05:48 PM

Limited Time Offer

25%

Off

Get Premium PCDRA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Denise

4 months ago

Option D is also valid, but A is more direct for this case.

upvoted 0 times

...

Kayleigh

4 months ago

Wait, can you really just add hashes like that? Seems risky.

upvoted 0 times

...

Cary

4 months ago

I agree with A, it’s the most straightforward way!

upvoted 0 times

...

Serina

4 months ago

I think B sounds right, but I’m not too sure.

upvoted 0 times

...

Bette

4 months ago

Definitely option A, that's where the malware profiles are managed.

upvoted 0 times

...

Cordie

5 months ago

I have a vague memory of the Action Center being involved, so maybe option D is the right choice? I just can't recall the exact steps.

upvoted 0 times

...

Nathan

5 months ago

I could be wrong, but I think option C sounds familiar. It mentions process exceptions, which seems relevant to what we studied.

upvoted 0 times

...

Carry

5 months ago

I remember practicing a similar question, and I feel like it was about adding exceptions through the rules menu, which might be option B.

upvoted 0 times

...

Curt

5 months ago

I think it's option A, but I'm not entirely sure if the hash goes in the allow list or somewhere else.

upvoted 0 times

...

Marg

5 months ago

I've got a strategy for this. I'll eliminate the options I know are parent tables, and then the remaining one must be the exception.

upvoted 0 times

...

Leatha

5 months ago

Hmm, I'm not entirely sure what the question is asking for. I'll need to re-read the prompt a few times to make sure I understand what kind of developments they want me to identify.

upvoted 0 times

...