Best Preparations of PSE-Cortex Exam 2024 Palo Alto Networks Certification Unlimited 60 Questions
Focus on PSE-Cortex All-in-One Exam Guide For Quick Preparation.
The PSE-Cortex certification exam is a challenging test that requires extensive preparation. Candidates must have a deep understanding of the Cortex platform and its features. They must also have experience in designing and implementing security solutions in a variety of environments. In addition, candidates must have a solid understanding of cybersecurity best practices and the latest threats and vulnerabilities.
NEW QUESTION # 31
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. Domain/workgroup membership
- B. quarantine status
- C. OS
- D. hostname
- E. attack threat intelligence tag
Answer: A,C,D
NEW QUESTION # 32
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. domain/workgroup membership
- B. presence of Flash executable
- C. OS
- D. hostname
- E. alert root cause
Answer: A,B,E
NEW QUESTION # 33
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as scheduled entry
- B. Mark as evidence
- C. Mark as artifact
- D. Mark as note
Answer: C
NEW QUESTION # 34
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. disable an EPM for a particular process
- C. change the WildFire verdict for a given executable
- D. permit processes to load specific DLLs
Answer: A
NEW QUESTION # 35
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. observed activity
- C. error messages
- D. artifacts
Answer: A
NEW QUESTION # 36
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?
- A. SOC manager
- B. operations manager
- C. SOC analyst IT
- D. desktop engineer
Answer: A
NEW QUESTION # 37
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?
- A. 10 GB
- B. 1 TB
- C. 100 GB
- D. 10 TB
Answer: B
NEW QUESTION # 38
Which task allows the playbook to follow different paths based on specific conditions?
- A. Conditional
- B. Automation
- C. Manual
- D. Parallel
Answer: C
NEW QUESTION # 39
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option D
- D. Option B
Answer: C
NEW QUESTION # 40
Which two entities can be created as a BIOC? (Choose two.)
- A. alert log
- B. file
- C. event log
- D. registry
Answer: B,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION # 41
Whichfour types of Traps logs are stored within Cortex Data Lake?
- A. Threat, Config, Authentication, Analytic
- B. Threat, Config, System,Data
- C. Threat, Config, System, Analytic
- D. Threat, Monitor. System, Analytic
Answer: B
NEW QUESTION # 42
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)
- A. Set reminders for an incident SLA
- B. Define whether a playbook runs automatically when an incident type is encountered
- C. Drop new incidents of the same type that contain similar information
- D. Define the way that incidents of a specific type are displayed in the system
- E. Add new fields to an incident type
Answer: A,B,D
NEW QUESTION # 43
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. disable the Cortex XSOAR service
- B. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- C. enable the docker service
- D. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
Answer: B
NEW QUESTION # 44
Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)
- A. HIP
- B. Security Event
- C. Correlation
- D. Analytics
Answer: A,B
NEW QUESTION # 45
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect instance name
- B. incorrect server URL
- C. incorrect appliance port
- D. incorrect Username and Password
Answer: D
NEW QUESTION # 46
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, sub-playbook tasks do not have access to the root context
- B. When set to global, allows parallel task execution.
- C. When set to private, task outputs do not automatically get written to the root context
- D. When set to private, task outputs automatically get written to the root context
Answer: A
NEW QUESTION # 47
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. Cortex XSOAR TA App for Splunk
- B. splunk-get-alerts integration command
- C. SplunkGO integration
- D. SplunkSearch automation
Answer: A
NEW QUESTION # 48
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. splunk-get-alerts integration command
- B. SplunkGO integration
- C. Cortex XSOAR TA App for Splunk
- D. SplunkSearch automation
Answer: A
NEW QUESTION # 49
What method does the Traps agent use to identify malware during a scheduled scan?
- A. Heuristic analysis
- B. Signature comparison
- C. Local analysis
- D. WildFire hash comparison and dynamic analysis
Answer: D
NEW QUESTION # 50
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Control
- B. Agent Management
- C. Device Customization
- D. Agent Configuration
Answer: A
Explanation:
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION # 51
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. !invite Bob
- B. @Bob
- C. /invite Bob
- D. #Bob
Answer: D
NEW QUESTION # 52
How does an "inline" auto-extract task affect playbook execution?
- A. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
- B. Doesn't wait until the indicators are enriched but populate context data before executing the next
- C. Wait until the indicators are enriched and populate context data before executing the next step.
- D. Doesn't wait until the indicators are enriched and continues executing the next step
Answer: C
NEW QUESTION # 53
......
Guaranteed Success with PSE-Cortex Dumps: https://lead2pass.troytecdumps.com/PSE-Cortex-troytec-exam-dumps.html