Practice Examples and Dumps & Tips for 2022 Latest PSE-Cortex Valid Tests Dumps
Latest [Jan 13, 2022] 100% Passing Guarantee - Brilliant PSE-Cortex Exam Questions PDF
NEW QUESTION 15
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 16
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 17
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
- A. Live Terminal
- B. File Explorer
- C. Live Sensors
- D. Log Stitching
Answer: A
NEW QUESTION 18
Which option is required to prepare the VDI Golden Image?
- A. Configure the Golden Image as a persistent VDI
- B. Use the Cortex XDR VDI tool to obtain verdicts for all PE files
- C. Install the Cortex XOR Agent on the local machine
- D. Run the Cortex VDI conversion tool
Answer: D
NEW QUESTION 19
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Customization
- B. Agent Configuration
- C. Device Control
- D. Agent Management
Answer: C
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 20
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. registry entry
- C. IP
- D. endpoint hostname
Answer: A,C
NEW QUESTION 21
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- B. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- C. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- D. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
Answer: B
NEW QUESTION 22
How can you view all the relevant incidents for an indicator?
- A. Linked Indicators column in Incident Screen
- B. Related Incidents column in Indicator Screen
- C. Related Indicators column in Incident Screen
- D. Linked Incidents column in Indicator Screen
Answer: B
NEW QUESTION 23
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Sub-Play books
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Playbook Tasks
Answer: A,B
NEW QUESTION 24
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?
- A. SOC manager
- B. desktop engineer
- C. operations manager
- D. SOC analyst IT
Answer: A
NEW QUESTION 25
When a Demisto Engine is part of a Load-Balancing group it?
- A. Must be in a Load-Balancing group with at least another 3 members
- B. It must have port 443 open to allow the Demisto Server to establish a connection
- C. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- D. Can be used separately as an engine, only if connected to the Demisto Server directly
Answer: C
NEW QUESTION 26
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Related Indicators column in Incident Screen
- D. Linked Incidents column in Indicator Screen
Answer: B
NEW QUESTION 27
How does an "inline" auto-extract task affect playbook execution?
- A. Wait until the indicators are enriched and populate context data before executing the next step.
- B. Doesn't wait until the indicators are enriched and continues executing the next step
- C. Doesn't wait until the indicators are enriched but populate context data before executing the next
- D. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
Answer: A
NEW QUESTION 28
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. Contains
- B. < >
- C. =
- D. Is Contained By
Answer: A,C
NEW QUESTION 29
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. xnettraps.paloaltonetworks.com
- B. cc-xnet50.traps.paloaltonetworks.com
- C. ch-xnet.traps.paloaltonetworks.com
- D. cc-xnet.traps.paloaltonetworks.com
- E. cc.xnet50traps.paloaltonetworks.com
- F. hc-xnet50.traps.paloaltonetworks.com
Answer: B,C,D
NEW QUESTION 30
......
PSE-Cortex are Available for Instant Access: https://www.exam-killer.com/PSE-Cortex-valid-questions.html
PSE-Cortex Certification – Valid Exam Dumps Questions Study Guide: https://drive.google.com/open?id=151RvUk67piubDy5cDkqx-toHQJMEI9Dx
