Palo Alto Networks PSE-CORTEX Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-CORTEX Online Questions & Answers

• Question 41:

  Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

  A. firewall alert
  B. SIEM alert
  C. full URL
  D. registry set value
  A. firewall alert
  D. registry set value

• Question 42:

  In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )

  A. alert root cause
  B. hostname
  C. domain/workgroup membership
  D. OS
  E. presence of Flash executable
  A. alert root cause
  C. domain/workgroup membership
  E. presence of Flash executable

• Question 43:

  How does DBot score an indicator that has multiple reputation scores?

  A. uses the most severe score scores
  B. the reputation as undefined
  C. uses the average score
  D. uses the least severe score
  A. uses the most severe score scores

• Question 44:

  The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.)

  A. The modified scnpt was run in the wrong Docker image
  B. The modified script required a different parameter to run successfully.
  C. The dictionary was defined incorrectly in the second script.
  D. The modified script attempted to access a dictionary key that did not exist in the dictionary named "data"
  A. The modified scnpt was run in the wrong Docker image

• Question 45:

  How can you view all the relevant incidents for an indicator?

  A. Linked Incidents column in Indicator Screen
  B. Linked Indicators column in Incident Screen
  C. Related Indicators column in Incident Screen
  D. Related Incidents column in Indicator Screen
  B. Linked Indicators column in Incident Screen

• Question 46:

  Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)

  A. Define whether a playbook runs automatically when an incident type is encountered
  B. Set reminders for an incident SLA
  C. Add new fields to an incident type
  D. Define the way that incidents of a specific type are displayed in the system
  E. Drop new incidents of the same type that contain similar information
  A. Define whether a playbook runs automatically when an incident type is encountered
  D. Define the way that incidents of a specific type are displayed in the system
  E. Drop new incidents of the same type that contain similar information

• Question 47:

  Which Cortex XDR capability extends investigations to an endpoint?

  A. Log Stitching
  B. Causality Chain
  C. Sensors
  D. Live Terminal
  A. Log Stitching

• Question 48:

  An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?

  A. Uncommon Local Scheduled Task Creation
  B. Malware
  C. New Administrative Behavior
  D. DNS Tunneling
  B. Malware

• Question 49:

  Which two formats are supported by Whitelist? (Choose two)

  A. Regex
  B. STIX
  C. CSV
  D. CIDR
  C. CSV
  D. CIDR

• Question 50:

  In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

  A. Domain/workgroup membership
  B. quarantine status
  C. hostname
  D. OS
  E. attack threat intelligence tag
  A. Domain/workgroup membership
  C. hostname
  D. OS