Palo Alto Networks PSE-ENDPOINT Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-ENDPOINT Online Questions & Answers

• Question 31:

  The administrator has added the following whitelist to the WildFire Executable Files policy.

  *\mysoftware.exe

  What will be the result of this whitelist?

  A. users will not be able to run mysoftware.exe.
  B. mysoftware.exe will be uploaded to WildFire for analysis
  C. mysoftware.exe will not be analyzed by WildFire regardless of the file location.
  D. mysoftware.exe will not be analyzed by WildFire, but only if executed from the C drive.
  B. mysoftware.exe will be uploaded to WildFire for analysis

• Question 32:

  A company wants to implement a new Virtual Desktop Infrastructure (VDI) in which the endpoints are protected with Traps. It must select a VDI platform that is supported by Palo Alto Networks for Traps use. Which two platform are supported? (Choose two.)

  A. Citrix XenDesktop
  B. VMware Horizon View
  C. Listeq
  D. Nimboxx
  A. Citrix XenDesktop
  B. VMware Horizon View

• Question 33:

  A large manufacturer is planning to roll out Traps to 75,000 endpoints. Their environment consists of three major sites with 24,000 endpoints each, plus about 3,000 remote endpoints in smaller remote locations using always-on VPN

  connections to a single one of the major sites. The customer wants to minimize network traffic between the major sites, but all endpoints have internet access. The customer is looking for a centrally managed solution with common reporting

  and management for all endpoints in the environment.

  Which design option would be appropriate for this environment?

  A. Place the Traps database. ESM Console and two ESM core servers in the large site hosting the VPN gateway, and force all endpoints to use VPN at all times.
  B. Place the Traps database, ESM Console and seven ESM core servers in a public-cloud environment where the ESM Core servers are accessible from the internet.
  C. Place a Traps database, ESM Console and an ESM core server in each of the three large sites.
  D. Place the Traps database and ESM Console in one of the major sites, and one ESM core server in each of the three major sites.
  D. Place the Traps database and ESM Console in one of the major sites, and one ESM core server in each of the three major sites.

• Question 34:

  The administrator has downloaded the Traps_macOS_4.x.x.zip file. What are the next steps needed to successfully install the Traps 4.x for macOS agent?

  A. Push the Traps_macOS_4.x.x.zip to the target endpoint(s), unzip it, and execute Traps.pkg
  B. Unzip the Traps_macOS_4.x.x.zip, push the Traps pkg file to the target endpoint(s) and execute Traps.pkg
  C. Create a one time action to install the Traps_macOS_4.x.x.zip file on the target endpoint(s)
  D. Create an installation package using Traps_macOS_4.x.x on ESM, download the installationpackage.zip, push the installationpackage.zip to target endpoint(s), unzip it, and execute Traps.pkg
  D. Create an installation package using Traps_macOS_4.x.x on ESM, download the installationpackage.zip, push the installationpackage.zip to target endpoint(s), unzip it, and execute Traps.pkg

• Question 35:

  A deployment contains some machines that are not part of the domain. The Accounting and Sales departments are two of these.

  How can a policy of WildFire notification be applied to Accounting, and a policy of WildFire prevention be applied to Sales, while not affecting any other WildFire policies?

  A. Create the rules and use the Objects tab to add Accounting and Sales to each rule they should apply to.
  B. Create a condition for an application found on an Accounting machine. Use that condition for the Accounting groups rule, and create the rule tor Sales without any conditions.
  C. Create two rules for WildFire: one for prevention, and one for notification. Make sure the Accounting rule is numbered higher.
  D. Create group-specific registry entries on endpoints. Use these registry entries to create conditions for the WildFire rules.
  C. Create two rules for WildFire: one for prevention, and one for notification. Make sure the Accounting rule is numbered higher.

• Question 36:

  From the ESM console, which two ways can an administrator verify that their installed macOS agents are functional? (Choose two.)

  A. Click the Settings Tab > Agent > Installation Package to view the agents installed.
  B. Click the Dashboard Tab, and refer to the Computer Distribution and Version window
  C. Click the Monitor Tab > Agent > Health. Sort by OS and look for the macOS endpoints
  D. Click the Monitor Tab > Data Retrieval
  A. Click the Settings Tab > Agent > Installation Package to view the agents installed.
  C. Click the Monitor Tab > Agent > Health. Sort by OS and look for the macOS endpoints

• Question 37:

  What is the default interval for Traps agents to communicate via heartbeat to the ESM?

  A. Every 1 Minute
  B. Every 1 Hour
  C. Every 1 Day
  D. Every 1 year
  B. Every 1 Hour

• Question 38:

  Assume a Child Process Protection rule exists for powershell.exe in Traps v 4.0. Among the items on the blacklist is ipconfig.exe. How can an administrator permit powershell.exe to execute ipconfig.exe without altering the rest of the blacklist?

  A. add ipconfig.exe to the Global Child Processes Whitelist, under Restriction settings.
  B. Uninstall and reinstall the traps agent.
  C. Create a second Child Process Protection rule for powershell.exe to whitelist ipconfig.exe.
  D. Remove ipconfig.exe from the rule's blacklist.
  A. add ipconfig.exe to the Global Child Processes Whitelist, under Restriction settings.

• Question 39:

  An administrator is testing an exploit that is expected to be blocked by the JIT Mitigation EPM protecting the viewer application in use. No prevention occurs, and the attack is successful. In which two ways can the administrator determine the reason for the missed prevention? (Choose two.)

  A. Check in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application
  B. Check if a Just-In-Time debugger is installed on the system
  C. Check that the Traps libraries are injected into the application
  D. Check that all JIT Mitigation functions are enabled in the HKLM\SYSTEM\Cyvera\Policy\Organization\Process\Default registry key
  A. Check in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application
  C. Check that the Traps libraries are injected into the application

• Question 40:

  A customer plans to test the malware prevention capabilities of Traps. It has defined this policy. Local analysis is enabled Quarantining of malicious files is enabled Files are to be uploaded to WildFire

  No executables have been whitelisted or blacklisted in the ESM Console Hash Control screen. Malware sample A has a verdict of Malicious in the WildFire service. Malware sample B is unknown to WildFire. Which behavior will result?

  A. WildFire will block sample A as known malware; sample B will be blocked as an unknown binary while the file is analyzed by WildFire for a final verdict.
  B. Hash Control already knows sample A locally in the endpoint cache and will block it. Sample B will not be blocked by WildFire, but will be blocked by the local analysis engine.
  C. WildFire will block sample A as known malware, and sample B will compromise the endpoint because it is new and ESM Server has not obtained the required signatures.
  D. WildFire will block sample A as known malware; sample B will not be blocked by WildFire, but will be evaluated by the local analysis engine and will or will not be blocked, based on its verdict, until WildFire analysis determines the final verdict.
  D. WildFire will block sample A as known malware; sample B will not be blocked by WildFire, but will be evaluated by the local analysis engine and will or will not be blocked, based on its verdict, until WildFire analysis determines the final verdict.