Skip to main content

PSE-CORTEX Real Exam Questions

Palo Alto Networks System Engineer Professional - Cortex

60 questions available · Page 1 of 6

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Multiple choice

Which two filter operators are available in Cortex XDR? (Choose two.)

  1. A

    < >

  2. B

    Contains

  3. C

    =

  4. D

    Is Contained By

Show answer and explanation

Correct answers: B, C

Question 2 Single choice

Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

  1. A

    Agent Configuration

  2. B

    Device Control

  3. C

    Device Customization

  4. D

    Agent Management

Show answer and explanation

Correct answer: B

Explanation

https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231

Question 3 Single choice

What is the difference between an exception and an exclusion?

  1. A

    An exception is based on rules and exclusions are on alerts

  2. B

    An exclusion is based on rules and exceptions are based on alerts.

  3. C

    An exception does not exist

  4. D

    An exclusion does not exist

Show answer and explanation

Correct answer: A

Question 4 Single choice

When analyzing logs for indicators, which are used for only BIOC identification'?

  1. A

    observed activity

  2. B

    artifacts

  3. C

    techniques

  4. D

    error messages

Show answer and explanation

Correct answer: A

Question 5 Single choice

The images show two versions of the same automation script and the results they produce when executed in Demisto.

What are two possible causes of the exception thrown in the second Image? (Choose two.)

  1. A

    The modified scnpt was run in the wrong Docker image

  2. B

    The modified script required a different parameter to run successfully.

  3. C

    The dictionary was defined incorrectly in the second script.

  4. D

    The modified script attempted to access a dictionary key that did not exist in the dictionary named
    "data"

Show answer and explanation

Correct answer: A

Question 6 Multiple choice

Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?

Desmisto REST API

Name: Demisto REST API_instance_1
Demisto Server URL: https://127.0.0.1
Demisto Server API Key: *******

User system proxy settings
Use sigle engine: No engine

! Script failed to run: Demisto REST APIs-
Request Failed.
Status code:1
Body:{"StatusCode":-1,"Status":"Get https://127.0.0.1/user:x509;cannot validate certificate for 127.0.0.1
because it doesn't contain any IP SANs","Cookies":
[],"Body":"","Bytes":[],"Headers":{},"Path":"}, at sendRequest(script:59:23(79)):(2603)

Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)

  1. A

    Generic Polling Automation Playbook

  2. B

    Playbook Tasks

  3. C

    Sub-Play books

  4. D

    Playbook Functions

Show answer and explanation

Correct answers: C, D

Question 7 Multiple choice

During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.

During the service instance provisioning which three DNS host names are created? (Choose three.)

  1. A

    cc-xnet50.traps.paloaltonetworks.com

  2. B

    hc-xnet50.traps.paloaltonetworks.com

  3. C

    cc-xnet.traps.paloaltonetworks.com

  4. D

    cc.xnet50traps.paloaltonetworks.com

  5. E

    xnettraps.paloaltonetworks.com

  6. F

    ch-xnet.traps.paloaltonetworks.com

Show answer and explanation

Correct answers: A, C, F

Question 8 Single choice

What are two manual actions allowed on War Room entries? (Choose two.)

  1. A

    Mark as artifact

  2. B

    Mark as scheduled entry

  3. C

    Mark as note

  4. D

    Mark as evidence

Show answer and explanation

Correct answer: A

Question 9 Single choice

Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

  1. A

    the relevant shell

  2. B

    The causality group owner

  3. C

    the adversary's remote process

  4. D

    the chain's alert initiator

Show answer and explanation

Correct answer: B

Question 10 Single choice

Which deployment type supports installation of an engine on Windows, Mac OS.
and Linux?

  1. A

    RPM

  2. B

    SH

  3. C

    DEB

  4. D

    ZIP

Show answer and explanation

Correct answer: D

Explanation

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-configure-demisto-engines/create-a-new-engine.html