Pass Palo Alto Networks PSE-Cortex Exam With Practice Test Questions Dumps Bundle
2022 Valid PSE-Cortex test answers & Palo Alto Networks Exam PDF
NEW QUESTION 16
Which task allows the playbook to follow different paths based on specific conditions?
- A. Conditional
- B. Manual
- C. Automation
- D. Parallel
Answer: B
NEW QUESTION 17
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option A
- D. Option D
Answer: D
NEW QUESTION 18
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. SIEM alert
- B. registry set value
- C. full URL
- D. firewall alert
Answer: C,D
NEW QUESTION 19
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?
- A. DEB
- B. RPM
- C. SH
- D. ZIP
Answer: D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-config
NEW QUESTION 20
Which step is required to prepare the VDI Golden Image?
- A. Run the VDI conversion tool
- B. Ensure the latest content updates are installed
- C. Set the memory dumps to manual setting
- D. Review any PE files that WildFire determined to be malicious
Answer: C
NEW QUESTION 21
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, sub-playbook tasks do not have access to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to global, allows parallel task execution.
- D. When set to private, task outputs automatically get written to the root context
Answer: A
NEW QUESTION 22
Which two entities can be created as a BIOC? (Choose two.)
- A. registry
- B. alert log
- C. event log
- D. file
Answer: A,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 23
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. alert root cause
- B. hostname
- C. domain/workgroup membership
- D. OS
- E. presence of Flash executable
Answer: A,C,E
NEW QUESTION 24
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. cc-xnet.traps.paloaltonetworks.com
- B. xnettraps.paloaltonetworks.com
- C. cc.xnet50traps.paloaltonetworks.com
- D. ch-xnet.traps.paloaltonetworks.com
- E. hc-xnet50.traps.paloaltonetworks.com
- F. cc-xnet50.traps.paloaltonetworks.com
Answer: A,D,F
NEW QUESTION 25
Which four types of Traps logs are stored within Cortex Data Lake?
- A. Threat, Config, Authentication, Analytic
- B. Threat, Monitor. System, Analytic
- C. Threat, Config, System, Analytic
- D. Threat, Config, System, Data
Answer: C
NEW QUESTION 26
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. #Bob
- B. @Bob
- C. !invite Bob
- D. /invite Bob
Answer: A
NEW QUESTION 27
When a Demisto Engine is part of a Load-Balancing group it?
- A. Can be used separately as an engine, only if connected to the Demisto Server directly
- B. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- C. It must have port 443 open to allow the Demisto Server to establish a connection
- D. Must be in a Load-Balancing group with at least another 3 members
Answer: D
NEW QUESTION 28
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Agree to build the integration as part of the POC
- B. Tell them we can build it with Professional Services.
- C. Tell them custom integrations are not created as part of the POC
- D. Extend the POC window to allow the solution architects to build it
Answer: C
NEW QUESTION 29
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
- B. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
- C. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- D. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
Answer: C
NEW QUESTION 30
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)
- A. Define whether a playbook runs automatically when an incident type is encountered
- B. Define the way that incidents of a specific type are displayed in the system
- C. Add new fields to an incident type
- D. Set reminders for an incident SLA
- E. Drop new incidents of the same type that contain similar information
Answer: A,B,E
NEW QUESTION 31
Which two formats are supported by Whitelist? (Choose two)
- A. CSV
- B. STIX
- C. Regex
- D. CIDR
Answer: C,D
NEW QUESTION 32
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. Domain/workgroup membership
- B. attack threat intelligence tag
- C. OS
- D. quarantine status
- E. hostname
Answer: A,C,E
NEW QUESTION 33
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. quarantine status
- B. Domain/workgroup membership
- C. attack threat intelligence tag
- D. OS
- E. hostname
Answer: A,D,E
NEW QUESTION 34
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option A
- D. Option D
Answer: D
NEW QUESTION 35
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option A
- D. Option D
Answer: D
NEW QUESTION 36
Which Cortex XDR capability extends investigations to an endpoint?
- A. Live Terminal
- B. Sensors
- C. Causality Chain
- D. Log Stitching
Answer: D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts
NEW QUESTION 37
What is the result of creating an exception from an exploit security event?
- A. White lists the process from Wild Fire analysis
- B. disables the triggered EPM for the host and process involve
- C. exempts administrators from generating alerts for 24 hours
- D. exempts the user from generating events for 24 hours
Answer: B
NEW QUESTION 38
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Agree to build the integration as part of the POC
- B. Tell them we can build it with Professional Services.
- C. Extend the POC window to allow the solution architects to build it
- D. Tell them custom integrations are not created as part of the POC
Answer: C
NEW QUESTION 39
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect Username and Password
- B. incorrect appliance port
- C. incorrect server URL
- D. incorrect instance name
Answer: A
NEW QUESTION 40
......
Top Palo Alto Networks PSE-Cortex Courses Online: https://easypass.examsreviews.com/PSE-Cortex-pass4sure-exam-review.html