Palo Alto Networks PSE-ENDPOINT Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-ENDPOINT Online Questions & Answers

• Question 1:

  An ESM server's SSL certificate needs two Enhanced Key Usage purposes: Client Authentication and ________________

  A. Server Authentication
  B. File Recovery
  C. IP Security User
  D. IP Security Tunnel Termination
  A. Server Authentication

• Question 2:

  Which software category is most likely to cause a conflict with the Traps agent?

  A. Exploit prevention software
  B. Web browser software
  C. Web meeting and collaboration software
  D. Full disk encryption software
  A. Exploit prevention software

• Question 3:

  When planning to test a software exploit using a Metasploit module, what two options should be considered about the victim host to ensure success?

  A. USB port version of the victim host
  B. Speed and make of the victim's RAM
  C. software version of the target application
  D. platform, architecture, and patch level of the victim host
  A. USB port version of the victim host
  C. software version of the target application

• Question 4:

  Which two are valid optional parameters when upgrading Traps agent from the ESM console using Upgrade from path? (Choose two.)

  A. Conditions
  B. Processes
  C. ESM Server
  D. Target Objects
  E. Features
  A. Conditions
  D. Target Objects

• Question 5:

  Which set of modules must be loaded and configured when using Metasploit?

  A. Attacker, payload
  B. Exploit, payload
  C. Exploit, malware
  D. Malware, host
  C. Exploit, malware

• Question 6:

  Once an administrator has successfully instated a Content Update, how is the Content Update applied to endpoint?

  A. After Installation on the ESM, an Agent License renewal is required in order to trigger relevant updates.
  B. After installation on the ESM, relevant updates occur at the next Heartbeat communication from each endpoint.
  C. Installation of a Content Update triggers a proactive push of the update by the ESM server to all endpoints with licensed Traps Agents within the Domain.
  D. The Traps Agent must be reinstalled on the endpoint in order to apply the content update. Existing Agents will not be able to take advantage of content updates.
  B. After installation on the ESM, relevant updates occur at the next Heartbeat communication from each endpoint.

• Question 7:

  Which two enhanced key usage purposes are necessary when creating an SSL certificate for an ESM server? (Choose two.)

  A. File Recovery
  B. Server Authentication
  C. Client Authentication
  D. Key Recovery
  B. Server Authentication
  C. Client Authentication

• Question 8:

  An Administrator has identified an EPM-triggered false positive and has used the Create Rule button from within the relevant entry in the Security Events > Preventions > Exploits tab. What is the result of the created rule?

  A. The new rule stops all EPM injection into the faulted process.
  B. The new rule stops all EPM injection into processes on the machine on which the prevention was triggered.
  C. The new rule excludes the endpoint from Traps protection.
  D. The new rule will include the EPM that raised the prevention, the process that triggered the prevention, the machine on which the prevention was triggered, and a descriptive name for the rule.
  B. The new rule stops all EPM injection into processes on the machine on which the prevention was triggered.

• Question 9:

  An administrator can check which two indicators to verity that Traps for Mac is running correctly on an installed endpoint? (Choose two.)

  A. Use cytool from the command line interface to display the running Traps agent services.
  B. In the Activity Monitor, verify that CyveraSecvice is running
  C. Ping other Traps agents from the macOS agent
  D. Verity that the Traps agent icon is displayed on the macOS finder bar.
  B. In the Activity Monitor, verify that CyveraSecvice is running
  D. Verity that the Traps agent icon is displayed on the macOS finder bar.

• Question 10:

  A retail company just purchased Traps for its 8,000 endpoints. Many of its users work remotely. The company is not using any VPN solution, but would still like to manage all endpoints regardless where they are. Which two aspects should be part of the recommendation? (Choose two.)

  A. As each ESM Core server can handle up to 30,000 endpoints, use at least 1 ESM Core server internally and 1 ESM core server in the DMZ for external endpoints.
  B. Placing an ESM Core server in the DMZ or in a cloud hosting service allows external endpoints to connect to it, even without a VPN client.
  C. Protection for remote endpoints is currently not supported. Since the ESM servers can only be installed in an internal network, endpoints without VPN will not be able to connect to it.
  D. If there is no connection to the ESM Core server, Traps agents automatically connect to WildFire and endpoints are fully protected. No additional ESM Core servers are needed.
  A. As each ESM Core server can handle up to 30,000 endpoints, use at least 1 ESM Core server internally and 1 ESM core server in the DMZ for external endpoints.
  B. Placing an ESM Core server in the DMZ or in a cloud hosting service allows external endpoints to connect to it, even without a VPN client.