Palo Alto Networks PSE-Cortex Real Exam Questions and Answers FREE
Exam Dumps PSE-Cortex Practice Free Latest Palo Alto Networks Practice Tests
NEW QUESTION 15
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION 16
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks.com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 17
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?
- A. RPM
- B. DEB
- C. ZIP
- D. SH
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-configure-demisto-engines/create-a-new-engine.html
NEW QUESTION 18
The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only Which use case should be used for the POC?
- A. either
- B. ServiceNow
- C. neither
- D. phishing
Answer: D
NEW QUESTION 19
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?
- A. 1 TB
- B. 10 TB
- C. 100 GB
- D. 10 GB
Answer: A
NEW QUESTION 20
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. OS
- B. attack threat intelligence tag
- C. hostname
- D. Domain/workgroup membership
- E. quarantine status
Answer: A,C,E
NEW QUESTION 21
How do sub-playbooks affect the Incident Context Data?
- A. When set to private, task outputs automatically get written to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to global, allows parallel task execution.
- D. When set to global, sub-playbook tasks do not have access to the root context
Answer: B
NEW QUESTION 22
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. splunk-get-alerts integration command
- B. Cortex XSOAR TA App for Splunk
- C. SplunkSearch automation
- D. SplunkGO integration
Answer: A
NEW QUESTION 23
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. change the WildFire verdict for a given executable
- C. disable an EPM for a particular process
- D. permit processes to load specific DLLs
Answer: C
NEW QUESTION 24
An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?
- A. DNS Tunneling
- B. Uncommon Local Scheduled Task Creation
- C. Malware
- D. New Administrative Behavior
Answer: C
NEW QUESTION 25
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 26
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 27
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Tell them custom integrations are not created as part of the POC
- B. Extend the POC window to allow the solution architects to build it
- C. Agree to build the integration as part of the POC
- D. Tell them we can build it with Professional Services.
Answer: B
NEW QUESTION 28
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. registry entry
- C. IP
- D. endpoint hostname
Answer: A,C
NEW QUESTION 29
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. !*
- C. < >
- D. =>
Answer: A,B
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html
NEW QUESTION 30
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 31
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?
- A. SOC manager
- B. desktop engineer
- C. operations manager
- D. SOC analyst IT
Answer: A
NEW QUESTION 32
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The modified scnpt was run in the wrong Docker image
- B. The modified script required a different parameter to run successfully.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - D. The dictionary was defined incorrectly in the second script.
Answer: A
NEW QUESTION 33
If you have a playbook task that errors out. where could you see the output of the task?
- A. War Room of the incident
- B. /var/log/messages
- C. Playbook Editor
- D. Demisto Audit log
Answer: A
NEW QUESTION 34
Which two entities can be created as a BIOC? (Choose two.)
- A. alert log
- B. file
- C. registry
- D. event log
Answer: B,C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 35
......
Verified PSE-Cortex Exam Dumps Q&As - Provide PSE-Cortex with Correct Answers: https://www.prep4pass.com/PSE-Cortex_exam-braindumps.html
PSE-Cortex Exam Questions | Real PSE-Cortex Practice Dumps: https://drive.google.com/open?id=1uJ2-IQOCi65iKM1nBnSL3PdZX0f3L3ED
