Palo Alto Networks PSE-Cortex Professional PSE-CORTEX Questions & Answers

• Question 1:

  Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

  A. firewall alert

  B. SIEM alert

  C. full URL

  D. registry set value

  Correct Answer: AD

• Question 2:

  Which Cortex XDR capability extends investigations to an endpoint?

  A. Log Stitching

  B. Causality Chain

  C. Sensors

  D. Live Terminal

  Correct Answer: A

  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts

• Question 3:

  What is the retention requirement for Cortex Data Lake sizing?

  A. number of endpoints

  B. number of VM-Series NGFW

  C. number of days

  D. logs per second

  Correct Answer: C

  https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/set-log-storage-quota

• Question 4:

  Which option is required to prepare the VDI Golden Image?

  A. Configure the Golden Image as a persistent VDI

  B. Use the Cortex XDR VDI tool to obtain verdicts for all PE files

  C. Install the Cortex XOR Agent on the local machine

  D. Run the Cortex VDI conversion tool

  Correct Answer: D

• Question 5:

  Which two filter operators are available in Cortex XDR? (Choose two.)

  A. not Contains

  B. !*

  C. =>

  D. < >

  Correct Answer: AB

  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html

• Question 6:

  Which CLI query would bring back Notable Events from Splunk?

  A. ! splunk-search query=" `notable` | head 3"

  B. ! splunk-search query=" 'notable' | head 3"

  C. ! splunk-search query="*"

  D. ! splunk-search query="* | head 3"

  Correct Answer: D

• Question 7:

  An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them

  How should an administrator perform this evaluation?

  A. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool

  B. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities

  C. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities

  D. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool

  Correct Answer: C

• Question 8:

  If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

  A. Live Sensors

  B. File Explorer

  C. Log Stitching

  D. Live Terminal

  Correct Answer: D

• Question 9:

  Given the integration configuration and error in the screenshot what is the cause of the problem? [missing the exhibits]

  A. incorrect instance name

  B. incorrect Username and Password

  C. incorrect appliance port

  D. incorrect server URL

  Correct Answer: A

• Question 10:

  What are two manual actions allowed on War Room entries? (Choose two.)

  A. Mark as artifact

  B. Mark as scheduled entry

  C. Mark as note

  D. Mark as evidence

  Correct Answer: A