Share Latest Feb-2023 PSE-CortexTest Practice Test Questions, Exam Dumps
Positive Aspects of Valid Dumps PSE-Cortex Exam Dumps!
NEW QUESTION 18
An antivirus refresh project was initiated by the IT operations executive. Who is the best source for discussion about the project's operational considerations'?
- A. desktop engineer
- B. SOC analyst
- C. SOC manager
- D. endpoint manager
Answer: B
NEW QUESTION 19
Which task allows the playbook to follow different paths based on specific conditions?
- A. Manual
- B. Parallel
- C. Conditional
- D. Automation
Answer: A
NEW QUESTION 20
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. add paloaltonetworks.com to the SSL Decryption Exclusion list
- B. reinstall the root CA certificate
- C. disable SSL decryption
- D. enable SSL decryption
Answer: B
NEW QUESTION 21
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. OS
- B. attack threat intelligence tag
- C. Domain/workgroup membership
- D. hostname
- E. quarantine status
Answer: A,C,D
NEW QUESTION 22
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. observed activity
- C. error messages
- D. artifacts
Answer: A
NEW QUESTION 23
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. error messages
- C. observed activity
- D. artifacts
Answer: C
NEW QUESTION 24
Which two entities can be created as a BIOC? (Choose two.)
- A. event log
- B. registry
- C. alert log
- D. file
Answer: B,D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION 25
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Playbook Tasks
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Sub-Play books
Answer: C,D
NEW QUESTION 26
A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)
- A. "Close" Incident Form
- B. Incident Summary
- C. Incident Quick View
- D. "New"/Edit" Incident Form
Answer: B,C
NEW QUESTION 27
Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)
- A. Correlation
- B. HIP
- C. Analytics
- D. Security Event
Answer: B,D
NEW QUESTION 28
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- B. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
- C. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
Answer: A
NEW QUESTION 29
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Functions
- C. Playbook Tasks
- D. Sub-Play books
Answer: B,D
NEW QUESTION 30
What are process exceptions used for?
- A. permit processes to load specific DLLs
- B. change the WildFire verdict for a given executable
- C. whitelist programs from WildFire analysis
- D. disable an EPM for a particular process
Answer: D
NEW QUESTION 31
Which step is required to prepare the VDI Golden Image?
- A. Ensure the latest content updates are installed
- B. Review any PE files that WildFire determined to be malicious
- C. Set the memory dumps to manual setting
- D. Run the VDI conversion tool
Answer: C
NEW QUESTION 32
If you have a playbook task that errors out. where could you see the output of the task?
- A. Demisto Audit log
- B. /var/log/messages
- C. Playbook Editor
- D. War Room of the incident
Answer: D
NEW QUESTION 33
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Agent Management
- B. Device Control
- C. Agent Configuration
- D. Device Customization
Answer: B
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 34
How can you view all the relevant incidents for an indicator?
- A. Related Indicators column in Incident Screen
- B. Linked Incidents column in Indicator Screen
- C. Linked Indicators column in Incident Screen
- D. Related Incidents column in Indicator Screen
Answer: C
NEW QUESTION 35
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. < >
- C. =>
- D. !*
Answer: A,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-c
NEW QUESTION 36
Which option is required to prepare the VDI Golden Image?
- A. Install the Cortex XOR Agent on the local machine
- B. Run the Cortex VDI conversion tool
- C. Use the Cortex XDR VDI tool to obtain verdicts for all PE files
- D. Configure the Golden Image as a persistent VDI
Answer: B
NEW QUESTION 37
Which step is required to prepare the VDI Golden Image?
- A. Review any PE files that WildFire determined to be malicious
- B. Ensure the latest content updates are installed
- C. Set the memory dumps to manual setting
- D. Run the VDI conversion tool
Answer: A
NEW QUESTION 38
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?
- A. Cortex XDR Prevent
- B. Cortex XDR Endpoint
- C. Cortex XDR Pro Per Endpoint
- D. Cortex XDR Pro per TB
Answer: B
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licen
NEW QUESTION 39
What is the retention requirement for Cortex Data Lake sizing?
- A. number of days
- B. number of endpoints
- C. logs per second
- D. number of VM-Series NGFW
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-corte
NEW QUESTION 40
How many use cases should a POC success criteria document include?
- A. no more than 5
- B. no more than 2
- C. 3 or more
- D. only 1
Answer: B
NEW QUESTION 41
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. Cortex XSOAR TA App for Splunk
- B. SplunkGO integration
- C. SplunkSearch automation
- D. splunk-get-alerts integration command
Answer: D
NEW QUESTION 42
What are process exceptions used for?
- A. disable an EPM for a particular process
- B. permit processes to load specific DLLs
- C. whitelist programs from WildFire analysis
- D. change the WildFire verdict for a given executable
Answer: C
NEW QUESTION 43
......
Practice LATEST PSE-Cortex Exam Updated 60 Questions: https://actualanswers.testsdumps.com/PSE-Cortex_real-exam-dumps.html
