Palo Alto Networks PSE-ENDPOINT Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-ENDPOINT Online Questions & Answers

• Question 21:

  An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded. The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them. How should an administrator perform this evaluation?

  A. Run a known 2015 flash exploit on a Windows XP SP3 VM, and run an exploitation tool that acts as a listener. Use the results to demonstrate Traps capabilities.
  B. Run word processing exploits in a Windows 7 VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities.
  C. Prepare a Windows 7 VM. Gather information about the word processing applications, determine if some of them are vulnerable, and prepare a working exploit for at least one of them. Execute with an exploitation tool.
  D. Gather information about the word processing applications and run them on a Windows XP SP3 VM. Determine if any of the applications are vulnerable and run the exploit with an exploitation tool.
  A. Run a known 2015 flash exploit on a Windows XP SP3 VM, and run an exploitation tool that acts as a listener. Use the results to demonstrate Traps capabilities.

• Question 22:

  Files are not getting a WildFire verdict.

  What is one way to determine whether there is a BITS issue?

  A. Check the upload status in the hash control screen.
  B. Run a telnet command between Traps agent and ESM Server on port 2125.
  C. Use PowerShell to test upload using HTTP POST method.
  D. Initiate a "Send support file" from the agent.
  C. Use PowerShell to test upload using HTTP POST method.

• Question 23:

  An administrator receives a number of email alerts indicating WildFire has prevented a malicious activity. All the prevention events refer to launching an Install Wizard that has received a benign verdict from WildFire. All prevention events are reported on a subset of endpoints, that have recently been migrated Mom another Traps deployment. Which two troubleshooting actions are relevant to this investigation? (Choose two.)

  A. Check that the servers xml file has been cleared on the migrated endpoints.
  B. Check that the ClientInfoHash tag has been cleared on the migrated endpoints.
  C. Check that the actions xml file has not been cleared on the migrated endpoints.
  D. Check that the WildFire cache has been cleared on the migrated endpoints.
  A. Check that the servers xml file has been cleared on the migrated endpoints.
  D. Check that the WildFire cache has been cleared on the migrated endpoints.

• Question 24:

  An administrator is installing ESM Core 4.0. The SQL Server is running on a non-standard port (36418). The database connection validation is failing. The administrator has entered the following information: Server Name: Servername\Instance Database: TrapsDB User Name: Domain\Account

  What is causing the failure?

  A. The database name "TrapsDB" is unsupported
  B. The instance name should not be specified
  C. The non-standard port needs to be specified in the format TrapsDB,36418
  D. The destination port cannot be configured during installation
  B. The instance name should not be specified

• Question 25:

  There are two custom policy rules in ESM Console. Policy rule number 1000 turns ROP off for winword.exe. Policy rule number 1001 turns ROP on for winword.exe What is the ROP module status for winword.exe?

  A. Due to the collision in the policy rules, ROP is enabled in notification mode.
  B. The lower numbered policy rule takes precedence. ROP is off for winword.exe
  C. The higher numbered policy rule takes precedence. ROP is on for winword.exe
  D. The default policy rule takes precedence over both policy rules 1000 and 1001 and disables ROP for winword.exe
  B. The lower numbered policy rule takes precedence. ROP is off for winword.exe

• Question 26:

  The ESM policy is set to upload unknowns to WildFire. However, when an unknown is executed the Upload status in ESM Console never displays "Upload in progress", and the verdict remains local analysis or unknown. Even clicking the upload button and checking in does not resolve the Issue. A line in the log file suggests not being able to download a file from "https:/ESMSERVER/BitsUploads/... to C:\ProgramData\Cyvera\Temp\..."

  Which solution fixes this problem?

  A. Restart BITS service on the endpoint
  B. Restart BITS service on ESM
  C. Remove and reinstall all the agents without SSL
  D. In the ESM Console, use the FQDN in multi ESM
  B. Restart BITS service on ESM

• Question 27:

  In a scenario where winword.exe, Microsoft Word application, is behaving abnormally, how would the administrator verify if Traps DLLs are injected to the process?

  A. Run 'cytool policy winword.exe
  B. Use Process Explore to find Traps DLLs injected to the process
  C. Open the add-ins tab in Word's options to find Traps add-in
  D. Use 'Ninja mode' in the policy editing screen in the ESM to find winword.exe
  B. Use Process Explore to find Traps DLLs injected to the process

• Question 28:

  A company discovers through the agent health display in ESM Console that a certain Traps agent is not communicating with ESM Server. Administrators suspect that the problem relates to TLS/SSL. Which troubleshooting step determines if this is an SSL issue?

  A. From the agent run the command: telnet (hostname) (port)
  B. Check that the Traps service is running
  C. From the agent run the command: ping (hostname)
  D. Browse to the ESM hostname from the affected agent
  D. Browse to the ESM hostname from the affected agent

• Question 29:

  Which version of .NET Framework is required as a prerequisite when installing Traps agent on Windows 7?

  A. .NET Framework 4.5
  B. .NET Framework 3.5.1
  C. .NET Framework 2.0
  D. .NET Framework 4.0
  B. .NET Framework 3.5.1

• Question 30:

  A customer has an environment with the following: 1,000 agents communicating over SSL with two servers - one containing the ESM Server and another one where the ESM Console is installed BitsUploads resides on the ESM Console server

  ESM Server and Console are using the default pods tor communication In a scenario where a file is failing to be uploaded from macOS, which three reasons could be directly related to the failure? (Choose three.)

  A. Traps agent is not able to check in with the ESM Server
  B. The rate of upload is lower than 100Kb/S
  C. The BITS address in the ESM is incorrect
  D. Port 2125 is blocked on the server which hosts BitsUploads
  E. Port 443 is blocked on the server which hosts BitsUploads
  A. Traps agent is not able to check in with the ESM Server
  C. The BITS address in the ESM is incorrect
  E. Port 443 is blocked on the server which hosts BitsUploads