Palo Alto Networks PSE-CORTEX Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-CORTEX Online Questions & Answers

• Question 11:

  What are two manual actions allowed on War Room entries? (Choose two.)

  A. Mark as artifact
  B. Mark as scheduled entry
  C. Mark as note
  D. Mark as evidence
  A. Mark as artifact

• Question 12:

  "Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?

  A. #Bob
  B. /invite Bob
  C. @Bob
  D. !invite Bob
  A. #Bob

• Question 13:

  An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.

  What is the safest way to do it?

  A. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
  B. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
  C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
  D. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
  A. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console

• Question 14:

  An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?

  A. desktop engineer
  B. SOC manager
  C. SOC analyst IT
  D. operations manager
  B. SOC manager

• Question 15:

  Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)

  A. Security Event
  B. HIP
  C. Correlation
  D. Analytics
  A. Security Event
  D. Analytics

• Question 16:

  When analyzing logs for indicators, which are used for only BIOC identification'?

  A. observed activity
  B. artifacts
  C. techniques
  D. error messages
  A. observed activity

• Question 17:

  What method does the Traps agent use to identify malware during a scheduled scan?

  A. Heuristic analysis
  B. Local analysis
  C. Signature comparison
  D. WildFire hash comparison and dynamic analysis
  D. WildFire hash comparison and dynamic analysis

• Question 18:

  Which task allows the playbook to follow different paths based on specific conditions?

  A. Conditional
  B. Automation
  C. Manual
  D. Parallel
  C. Manual

• Question 19:

  Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

  A. the relevant shell
  B. The causality group owner
  C. the adversary's remote process
  D. the chain's alert initiator
  B. The causality group owner

• Question 20:

  Rearrange the steps into the correct order for modifying an incident layout.

  Select and Place: