Palo Alto Networks PSE-Cortex Exam Questions (Updated 2022) 100% Real Question Answers
Pass Palo Alto Networks PSE-Cortex Exam Quickly With Actual4Cert
NEW QUESTION 35
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
- A. File Explorer
- B. Live Sensors
- C. Log Stitching
- D. Live Terminal
Answer: D
NEW QUESTION 36
Which task allows the playbook to follow different paths based on specific conditions?
- A. Parallel
- B. Conditional
- C. Automation
- D. Manual
Answer: D
NEW QUESTION 37
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?
- A. ZIP
- B. RPM
- C. DEB
- D. SH
Answer: A
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-configure-demisto-engines/create-a-new-engine.html
NEW QUESTION 38
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. artifacts
- C. error messages
- D. observed activity
Answer: A
NEW QUESTION 39
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console.What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. reinstall the root CA certificate
- B. enable SSL decryption
- C. add paloaltonetworks.com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: D
NEW QUESTION 40
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?
- A. 1 TB
- B. 10 TB
- C. 10 GB
- D. 100 GB
Answer: D
NEW QUESTION 41
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Extend the POC window to allow the solution architects to build it
- B. Tell them custom integrations are not created as part of the POC
- C. Tell them we can build it with Professional Services.
- D. Agree to build the integration as part of the POC
Answer: A
NEW QUESTION 42
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. endpoint hostname
- C. registry entry
- D. IP
Answer: A,D
NEW QUESTION 43
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
- A. the adversary's remote process
- B. the relevant shell
- C. The causality group owner
- D. the chain's alert initiator
Answer: C
NEW QUESTION 44
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- C. Contact support and ask for a security exception.
- D. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
Answer: C
NEW QUESTION 45
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- B. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- C. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- D. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
Answer: A
NEW QUESTION 46
Which two entities can be created as a BIOC? (Choose two.)
- A. event log
- B. registry
- C. file
- D. alert log
Answer: B,C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 47
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. Telnet
- B. Endpoint > Endpoint Management
- C. Response > Action Center
- D. the local console
Answer: B,C
NEW QUESTION 48
What is the retention requirement for Cortex Data Lake sizing?
- A. logs per second
- B. number of VM-Series NGFW
- C. number of endpoints
- D. number of days
Answer: D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/set-log-storage-quota
NEW QUESTION 49
What method does the Traps agent use to identify malware during a scheduled scan?
- A. WildFire hash comparison and dynamic analysis
- B. Signature comparison
- C. Local analysis
- D. Heuristic analysis
Answer: A
NEW QUESTION 50
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Tasks
- C. Playbook Functions
- D. Sub-Play books
Answer: A,D
NEW QUESTION 51
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. splunk-get-alerts integration command
- B. SplunkGO integration
- C. Cortex XSOAR TA App for Splunk
- D. SplunkSearch automation
Answer: C
NEW QUESTION 52
How do sub-playbooks affect the Incident Context Data?
- A. When set to private, task outputs do not automatically get written to the root context
- B. When set to global, allows parallel task execution.
- C. When set to global, sub-playbook tasks do not have access to the root context
- D. When set to private, task outputs automatically get written to the root context
Answer: A
NEW QUESTION 53
How many use cases should a POC success criteria document include?
- A. no more than 5
- B. only 1
- C. no more than 2
- D. 3 or more
Answer: B
NEW QUESTION 54
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
NEW QUESTION 55
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. firewall alert
- B. registry set value
- C. full URL
- D. SIEM alert
Answer: A,C
NEW QUESTION 56
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, allows parallel task execution.
- B. When set to global, sub-playbook tasks do not have access to the root context
- C. When set to private, task outputs do not automatically get written to the root context
- D. When set to private, task outputs automatically get written to the root context
Answer: B
NEW QUESTION 57
How does an "inline" auto-extract task affect playbook execution?
- A. Doesn't wait until the indicators are enriched and continues executing the next step
- B. Wait until the indicators are enriched and populate context data before executing the next step.
- C. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
- D. Doesn't wait until the indicators are enriched but populate context data before executing the next
Answer: B
NEW QUESTION 58
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option D
- B. Option A
- C. Option C
- D. Option B
Answer: A
NEW QUESTION 59
Which step is required to prepare the VDI Golden Image?
- A. Ensure the latest content updates are installed
- B. Review any PE files that WildFire determined to be malicious
- C. Run the VDI conversion tool
- D. Set the memory dumps to manual setting
Answer: B
NEW QUESTION 60
......
Real Palo Alto Networks PSE-Cortex Exam Questions [Updated 2022]: https://www.actual4cert.com/PSE-Cortex-real-questions.html
Prepare PSE-Cortex Question Answers - PSE-Cortex Exam Dumps: https://drive.google.com/open?id=1Lq29i-mBgiVBFd7r58T9eW5iiGh6QSl8