Palo Alto Networks Exam PCSAE Topic 1 Question 62 Discussion

Actual exam question for Palo Alto Networks's PCSAE exam

Question #: 62
Topic #: 1

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

A-status:closed -category:job type:Phishing created:>='30 days ago'

Bstatus:closed -category:job & type:Phishing created:>='30 days ago'

C-status:closed -category:job & type:Phishing created:<='30 days ago'

D-status:closed -category:job type:Phishing created:='30 days ago'

Show Suggested Answer

Suggested Answer: C

by Nu at Nov 26, 2023, 06:29 PM

Limited Time Offer

25%

Off

Get Premium PCSAE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Arlette

8 months ago

Hmm, you make a good point, Laila. Maybe option B would be a better choice, since it has the 'status:closed' without the negative sign.

upvoted 0 times

Agustin

7 months ago

Yeah, I agree with you. Option B looks like the correct query to use.

upvoted 0 times

...

Matthew

7 months ago

Option A seems to be the most logical choice.

upvoted 0 times

...

Kenneth

8 months ago

I'm not sure, but I think option C might be the correct one.

upvoted 0 times

...

Shaun

8 months ago

I'm leaning towards option D for the query.

upvoted 0 times

...

Cassi

8 months ago

Actually, I think option C is the best choice.

upvoted 0 times

...

Aretha

8 months ago

Hmm, I disagree. I believe option A is the right query to use.

upvoted 0 times

...

Rozella

8 months ago

I think option B is correct.

upvoted 0 times

...

Laila

8 months ago

I'm not sure about that. Option A has a negative sign before the 'status:closed', which seems a bit counterintuitive to me. Wouldn't we want to retrieve the open incidents, not the closed ones?

upvoted 0 times

...

Leila

8 months ago

Well, the question is asking for the correct query to use, so we need to analyze the answer options carefully. I'm leaning towards option A, since it seems to be the most straightforward approach.

upvoted 0 times

...

Franklyn

8 months ago

Alright, let's take a look at this question. It seems like we need to retrieve a list of all open phishing incidents in the last 30 days. What do you guys think about this?

upvoted 0 times

...