Palo Alto Networks PSE-Cortex Professional PSE-CORTEX Questions & Answers

• Question 51:

  When analyzing logs for indicators, which are used for only BIOC identification'?

  A. observed activity

  B. artifacts

  C. techniques

  D. error messages

  Correct Answer: A

• Question 52:

  "Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?

  A. #Bob

  B. /invite Bob

  C. @Bob

  D. !invite Bob

  Correct Answer: A

• Question 53:

  An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.

  What is the safest way to do it?

  A. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console

  B. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.

  C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.

  D. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console

  Correct Answer: A

• Question 54:

  In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?

  A. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group

  B. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group

  C. disable the Cortex XSOAR service

  D. enable the docker service

  Correct Answer: B

• Question 55:

  During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.

  

  During the service instance provisioning which three DNS host names are created? (Choose three.)

  A. cc-xnet50.traps.paloaltonetworks.com

  B. hc-xnet50.traps.paloaltonetworks.com

  C. cc-xnet.traps.paloaltonetworks.com

  D. cc.xnet50traps.paloaltonetworks.com

  E. xnettraps.paloaltonetworks.com

  F. ch-xnet.traps.paloaltonetworks.com

  Correct Answer: ACF

• Question 56:

  Which option describes a Load-Balancing Engine Group?

  A. A group of engines that use an algorithm to efficiently share the workload for integrations

  B. A group of engines that ensure High Availability of Demisto backend databases.

  C. A group of engines that use an algorithm to efficiently share the workload for automation scripts

  D. A group of D2 agents that share processing power across multiple endpoints

  Correct Answer: C

• Question 57:

  If you have a playbook task that errors out. where could you see the output of the task?

  A. /var/log/messages

  B. War Room of the incident

  C. Demisto Audit log

  D. Playbook Editor

  Correct Answer: D

• Question 58:

  A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

  A. "Close" Incident Form

  B. Incident Summary

  C. Incident Quick View

  D. "New"/Edit" Incident Form

  Correct Answer: BC

• Question 59:

  Which two entities can be created as a BIOC? (Choose two.)

  A. file

  B. registry

  C. event log

  D. alert log

  Correct Answer: AB

  https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html

• Question 60:

  Rearrange the steps into the correct order for modifying an incident layout.

  Select and Place:

  

  Correct Answer: