Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Google
Exam Format
90 min
55-65
70%
Specialist
Registration
$175 USD
Pearson VUE or online proctoring
English
Validity
2 years
Pass current version of the exam; Pass a higher-level Palo Alto Networks certification exam; Transition to XDR-Analyst or XDR-Engineer certification
PCD Exam Topics and Domains
PCD is organized into 7 weighted domains. Expect to work with Cortex XDR, Cortex XDR Broker, Cortex XDR Agent, WildFire, and more.
1
Threats and Attacks
10%
Recognize the different types of attacks
Differentiate between exploits and malwareDefine a file-less attackDefine a supply chain attackOutline ransomware threats
- Identify and differentiate various attack types
- Understand modern attack techniques and vectors
Recognize common attack tactics
List common attack tacticsDefine various attack tacticsOutline MITRE framework steps
- Understand MITRE ATT&CK framework
- Map attacks to framework stages
Recognize various types of threats/vulnerabilities
Differentiate between threats and attacksDefine product modules that help identify threatsIdentify legitimate threats vs. false positivesSummarize vulnerability references
- Differentiate threat types and vulnerabilities
- Validate and assess threat legitimacy
2
Prevention and Detection
20%
Recognize common defense systems
Identify ransomware defense systemsSummarize device management defenses
- Understand defense system capabilities
- Configure protection mechanisms
Identify attack vectors
Prevent agent attacksPrevent supply chain attacksPrevent phishing attacksDifferentiate malware and exploitsCategorize vulnerability types
- Identify and prevent various attack vectors
- Understand vulnerability categorization
Outline malware prevention
Define behavioral threat protectionConfigure malware prevention profilesOutline malware protection flowUse of hashes in Cortex XDRMalware prevention modules (MPMs)
- Configure malware prevention
- Understand protection workflows
Outline exploit prevention
Exploit prevention modules (EPMs)Default protected processesApplication vs kernel protection
- Understand exploit prevention mechanisms
- Configure protection modules
Outline analytic detection capabilities
Purpose of detectorsMachine learning in detectionConnection to MITRE
- Understand analytic detection
- Configure and use detectors
3
Investigation
20%
Investigation capabilities of Cortex XDR
Navigate the consoleRemote terminal optionsIncidents vs alertsExclusions vs exceptions
- Navigate investigation tools
- Understand incident management
Steps of an investigation
Incidents and alerts relationshipIncident resolution orderValid investigation stepsHighlight or suppress incidents
- Follow investigation workflows
- Prioritize and resolve incidents
Actions to investigate incidents
When to use live terminalLive terminal actionsWhen to use scriptsInvestigation screens and processes
- Execute investigation actions
- Use appropriate investigation tools
Incident collaboration and management
Read and write attributesIncidents vs alerts management
- Collaborate on incidents
- Manage incident attributes
4
Remediation
15%
Basic remediation
Navigate remediation suggestionsAutomatic vs manual remediationWhen to run scriptsFix false positives
- Execute remediation actions
- Choose appropriate remediation methods
Examples of remediation
Ransomware remediationRegistry remediationFile changes/deletions
- Apply remediation to specific threats
- Understand remediation scenarios
Configuration options to fix problems
Blocklist configurationSigners configurationAllowlist configurationExceptions configurationQuarantine/isolationFile search and destroy
- Configure remediation options
- Implement containment actions
5
Threat Hunting
10%
Tools for threat hunting
IOC techniqueBIOC techniqueXQL techniqueQuery builder technique
- Use threat hunting tools
- Create effective queries
Prevent the threat
Convert BIOCs to prevention rules
Convert detections to prevention
Manage threat hunting
Purpose of Unit 42
Leverage threat intelligence
6
Reporting
10%
Reporting capabilities of XDR
Leverage reporting tools
Generate effective reports
Build quality reports
Identify relevant contentInterpret report meaningAudience-specific informationXQL for reportingDistribution and scheduling
- Create audience-appropriate reports
- Automate report distribution
7
Architecture
15%
Components of Cortex XDR
Cortex XDR Data LakeCortex AgentCortex ConsoleCortex BrokerDifferent proxiesDirectory SyncWildFire
- Understand XDR architecture
- Identify component roles
Communication among components
Data Lake communicationWildFire communicationClient communication optionsExternal Dynamic List (EDL)Broker communication
- Understand component communication
- Configure communication paths
Agent architecture for different OS
Supported operating systemsOS-specific features
- Understand OS-specific capabilities
- Deploy across platforms
Ingesting non-Palo Alto data sources
Ingestion possibilitiesIngestion method details
- Configure data ingestion
- Integrate third-party sources
Broker functions and deployment
Broker deploymentBroker for third-party alertsBroker as proxyBroker for Pathfinder
- Deploy and configure Broker
- Enable advanced features
How do I earn this certification?
Passing PCD earns the PCDRA - Detection and Remediation Analyst certification. It sits in the Security Operations track.
Current Level Exams
PCDRA - Detection and Remediation Analyst
Next Level Options
Alternative Paths
- PCNSA - Palo Alto Networks Certified Network Security AdministratorExpand into firewall and network security
- PCCSE - Palo Alto Networks Certified Cloud Security EngineerAdd cloud security expertise to SOC skills
- PSE-Cortex - Palo Alto Networks System Engineer - CortexTechnical pre-sales for Cortex solutions
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for PCD is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- RETIRING
- Last content update: 2021-11-21
- Announcement date: 2024-10-01
Updates
- Cortex XDR 3.0 New features will be included in XDR-Analyst and XDR-Engineer exams • Release date: 2024-11-01
- XQL (Extended Query Language) 2.0 Enhanced query capabilities tested in new certifications • Release date: 2024-09-01
- MITRE ATT&CK Framework v14 Updated framework mappings in exam content • Release date: 2024-10-31
Who should take this exam?
This exam is typically taken by Security Operations Center (SOC) analysts and Security operations specialists.
- Working knowledge of network security
- Working knowledge of TCP/IP and networking
- Working knowledge of OS fundamentals
- Working knowledge of security automation technology
- Working knowledge of information security control technologies
- Tier 2+ level user competency in Cortex XDR
- Basic understanding of Python, PowerShell, SQL, XQL
- Knowledge of MITRE ATT&CK Framework