PASS PSE-Cortex exam with Palo Alto Networks Real Exam Questions - 100% Valid!
Actual PSE-Cortex Exam Recently Updated Questions with Free Demo
NEW QUESTION # 20
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. full URL
- B. registry set value
- C. firewall alert
- D. SIEM alert
Answer: B,C
NEW QUESTION # 21
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)
- A. Define the way that incidents of a specific type are displayed in the system
- B. Add new fields to an incident type
- C. Drop new incidents of the same type that contain similar information
- D. Define whether a playbook runs automatically when an incident type is encountered
- E. Set reminders for an incident SLA
Answer: A,D,E
NEW QUESTION # 22
Which two entities can be created as a BIOC? (Choose two.)
- A. event log
- B. registry
- C. alert log
- D. file
Answer: B,D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION # 23
What method does the Traps agent use to identify malware during a scheduled scan?
- A. Signature comparison
- B. WildFire hash comparison and dynamic analysis
- C. Heuristic analysis
- D. Local analysis
Answer: B
NEW QUESTION # 24
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. presence of Flash executable
- B. domain/workgroup membership
- C. alert root cause
- D. hostname
- E. OS
Answer: A,B,C
NEW QUESTION # 25
Which Cortex XDR capability extends investigations to an endpoint?
- A. Live Terminal
- B. Causality Chain
- C. Sensors
- D. Log Stitching
Answer: D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-conc
NEW QUESTION # 26
How does an "inline" auto-extract task affect playbook execution?
- A. Doesn't wait until the indicators are enriched but populate context data before executing the next
- B. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
- C. Doesn't wait until the indicators are enriched and continues executing the next step
- D. Wait until the indicators are enriched and populate context data before executing the next step.
Answer: D
NEW QUESTION # 27
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Tell them custom integrations are not created as part of the POC
- B. Tell them we can build it with Professional Services.
- C. Agree to build the integration as part of the POC
- D. Extend the POC window to allow the solution architects to build it
Answer: A
NEW QUESTION # 28
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. alert root cause
- B. domain/workgroup membership
- C. OS
- D. hostname
- E. presence of Flash executable
Answer: B,C,D
NEW QUESTION # 29
Which step is required to prepare the VDI Golden Image?
- A. Run the VDI conversion tool
- B. Review any PE files that WildFire determined to be malicious
- C. Ensure the latest content updates are installed
- D. Set the memory dumps to manual setting
Answer: B
NEW QUESTION # 30
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect appliance port
- B. incorrect instance name
- C. incorrect Username and Password
- D. incorrect server URL
Answer: B
NEW QUESTION # 31
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- B. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
- C. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- D. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
Answer: D
NEW QUESTION # 32
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?
- A. DEB
- B. RPM
- C. SH
- D. ZIP
Answer: D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-configure-demisto-engines/create-a-new-engine.html
NEW QUESTION # 33
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option C
- B. Option A
- C. Option B
- D. Option D
Answer: D
NEW QUESTION # 34
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. Endpoint > Endpoint Management
- B. Telnet
- C. Response > Action Center
- D. the local console
Answer: A,C
NEW QUESTION # 35
What is the difference between an exception and an exclusion?
- A. An exclusion does not exist
- B. An exception does not exist
- C. An exclusion is based on rules and exceptions are based on alerts.
- D. An exception is based on rules and exclusions are on alerts
Answer: D
NEW QUESTION # 36
......
PSE-Cortex Free Sample Questions to Practice One Year Update: https://vceplus.actualtestsquiz.com/PSE-Cortex-test-torrent.html
