Steps Necessary To Pass The PSE-Cortex Exam from Training Expert Exam-Killer
Valid Way To Pass Palo Alto Networks Certification's PSE-Cortex Exam
NEW QUESTION 27
When a Demisto Engine is part of a Load-Balancing group it?
- A. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- B. It must have port 443 open to allow the Demisto Server to establish a connection
- C. Can be used separately as an engine, only if connected to the Demisto Server directly
- D. Must be in a Load-Balancing group with at least another 3 members
Answer: D
NEW QUESTION 28
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
- B. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- C. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
Answer: D
NEW QUESTION 29
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?
- A. 100 GB
- B. 10 TB
- C. 10 GB
- D. 1 TB
Answer: A
NEW QUESTION 30
Which step is required to prepare the VDI Golden Image?
- A. Ensure the latest content updates are installed
- B. Review any PE files that WildFire determined to be malicious
- C. Set the memory dumps to manual setting
- D. Run the VDI conversion tool
Answer: C
NEW QUESTION 31
What are process exceptions used for?
- A. change the WildFire verdict for a given executable
- B. permit processes to load specific DLLs
- C. disable an EPM for a particular process
- D. whitelist programs from WildFire analysis
Answer: C
NEW QUESTION 32
Whichfour types of Traps logs are stored within Cortex Data Lake?
- A. Threat, Config, System, Analytic
- B. Threat, Config, Authentication, Analytic
- C. Threat, Config, System,Data
- D. Threat, Monitor. System, Analytic
Answer: C
NEW QUESTION 33
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. =
- B. < >
- C. Is Contained By
- D. Contains
Answer: A,D
NEW QUESTION 34
Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)
- A. Security Event
- B. HIP
- C. Correlation
- D. Analytics
Answer: A,B
NEW QUESTION 35
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. IP
- B. endpoint hostname
- C. domain
- D. registry entry
Answer: B,D
NEW QUESTION 36
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. xnettraps.paloaltonetworks.com
- B. cc-xnet50.traps.paloaltonetworks.com
- C. hc-xnet50.traps.paloaltonetworks.com
- D. cc.xnet50traps.paloaltonetworks.com
- E. ch-xnet.traps.paloaltonetworks.com
- F. cc-xnet.traps.paloaltonetworks.com
Answer: B,E,F
NEW QUESTION 37
Which two entities can be created as a BIOC? (Choose two.)
- A. file
- B. alert log
- C. registry
- D. event log
Answer: A,C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 38
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. =>
- B. not Contains
- C. < >
- D. !*
Answer: B,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-c
NEW QUESTION 39
How can you view all the relevant incidents for an indicator?
- A. Related Indicators column in Incident Screen
- B. Linked Indicators column in Incident Screen
- C. Related Incidents column in Indicator Screen
- D. Linked Incidents column in Indicator Screen
Answer: C
NEW QUESTION 40
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION 41
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
- A. the chain's alert initiator
- B. the relevant shell
- C. The causality group owner
- D. the adversary's remote process
Answer: C
NEW QUESTION 42
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as scheduled entry
- B. Mark as artifact
- C. Mark as note
- D. Mark as evidence
Answer: B
NEW QUESTION 43
Which task allows the playbook to follow different paths based on specific conditions?
- A. Parallel
- B. Manual
- C. Automation
- D. Conditional
Answer: B
NEW QUESTION 44
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. hostname
- B. OS
- C. quarantine status
- D. attack threat intelligence tag
- E. Domain/workgroup membership
Answer: A,B,E
NEW QUESTION 45
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
NEW QUESTION 46
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)
- A. Add new fields to an incident type
- B. Set reminders for an incident SLA
- C. Define whether a playbook runs automatically when an incident type is encountered
- D. Define the way that incidents of a specific type are displayed in the system
- E. Drop new incidents of the same type that contain similar information
Answer: C,D,E
NEW QUESTION 47
What is the difference between an exception and an exclusion?
- A. An exclusion does not exist
- B. An exception is based on rules and exclusions are on alerts
- C. An exclusion is based on rules and exceptions are based on alerts.
- D. An exception does not exist
Answer: B
NEW QUESTION 48
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. SplunkGO integration
- B. SplunkSearch automation
- C. Cortex XSOAR TA App for Splunk
- D. splunk-get-alerts integration command
Answer: D
NEW QUESTION 49
......
All PSE-Cortex Dumps and Palo Alto Networks System Engineer - Cortex Professional Training Courses: https://www.exam-killer.com/PSE-Cortex-valid-questions.html
Free Test Engine For Palo Alto Networks System Engineer - Cortex Professional Certification Exams: https://drive.google.com/open?id=1ac7nmIKQ0VPzTdPuCAcsjPZn5_9KVBLm
