Palo Alto Networks PSE-Cortex Professional PSE-CORTEX Questions & Answers

• Question 21:

  Which two filter operators are available in Cortex XDR? (Choose two.)

  A. < >

  B. Contains

  C. =

  D. Is Contained By

  Correct Answer: BC

• Question 22:

  Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

  A. IP

  B. endpoint hostname

  C. domain

  D. registry entry

  Correct Answer: BD

• Question 23:

  An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?

  A. Uncommon Local Scheduled Task Creation

  B. Malware

  C. New Administrative Behavior

  D. DNS Tunneling

  Correct Answer: B

• Question 24:

  An Administrator is alerted to a Suspicious Process Creation security event from multiple users.

  The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

  A. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module

  B. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist

  C. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments

  D. Contact support and ask for a security exception.

  Correct Answer: D

• Question 25:

  A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

  A. Extend the POC window to allow the solution architects to build it

  B. Tell them we can build it with Professional Services.

  C. Tell them custom integrations are not created as part of the POC

  D. Agree to build the integration as part of the POC

  Correct Answer: A

• Question 26:

  If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.

  Palo Alto Networks will provide the customer with a free instance

  What size is this free Cortex Data Lake instance?

  A. 1 TB

  B. 10 GB

  C. 100 GB

  D. 10 TB

  Correct Answer: A

• Question 27:

  The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

  A. Cortex XDR Pro per TB

  B. Cortex XDR Prevent

  C. Cortex XDR Endpoint

  D. Cortex XDR Pro Per Endpoint

  Correct Answer: C

  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licenses/migrate-your-cortex-xdr-license

• Question 28:

  The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only Which use case should be used for the POC?

  A. phishing

  B. either

  C. ServiceNow

  D. neither

  Correct Answer: A

• Question 29:

  In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )

  A. alert root cause

  B. hostname

  C. domain/workgroup membership

  D. OS

  E. presence of Flash executable

  Correct Answer: ACE

• Question 30:

  How can you view all the relevant incidents for an indicator?

  A. Linked Incidents column in Indicator Screen

  B. Linked Indicators column in Incident Screen

  C. Related Indicators column in Incident Screen D. Related Incidents column in Indicator Screen

  Correct Answer: B