Palo Alto Networks Exam PSE-Cortex Topic 1 Question 49 Discussion

Actual exam question for Palo Alto Networks's Palo Alto Networks System Engineer - Cortex Professional exam

Question #: 49
Topic #: 1

[All Palo Alto Networks System Engineer - Cortex Professional Questions]

Which two entities can be created as a BIOC? (Choose two.)

Afile

Bregistry

Cevent log

Dalert log

Show Suggested Answer

Suggested Answer: A, B

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html

by Alishia at Feb 08, 2024, 01:11 AM

Limited Time Offer

25%

Off

Get Premium PSE-Cortex Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Stanford

24 hours ago

I agree with A) file, but I think C) event log could also be created as a BIOC.

upvoted 0 times

...

Leanora

2 days ago

I think it's A) file and D) alert log.

upvoted 0 times

...

Pamella

24 days ago

Oh man, this question is tricky. I'm going to have to think about it a bit more. Maybe we should ask the instructor for a hint or something?

upvoted 0 times

Mitsue

7 days ago

We can always double check with the instructor if needed.

upvoted 0 times

...

Janine

8 days ago

That makes sense, let's go with those two.

upvoted 0 times

...

Katlyn

9 days ago

I think it's A) file and C) event log.

upvoted 0 times

...

Kenny

10 days ago

Let's think it through together.

upvoted 0 times

...

Hermila

11 days ago

C) event log

upvoted 0 times

...

Stephaine

12 days ago

A) file

upvoted 0 times

...

Rima

25 days ago

I'm leaning towards B and C. Registry and event log sounds like the kind of entities that could be created as a BIOC, but I'm not too sure about the others.

upvoted 0 times

...

German

26 days ago

Yeah, I was thinking the same thing. I'm guessing it's probably something like a file or a registry that can be monitored for changes or events. But I'm not sure about the other options.

upvoted 0 times

...

Bernardo

27 days ago

Hmm, this is an interesting question. I'm not entirely sure about the correct answer, but I think it might have to do with creating entities that can be monitored or tracked in some way.

upvoted 0 times

...