100% Pass Top-selling PSE-Cortex Exams - New 2021 Palo Alto Networks Pratice Exam
Palo Alto Networks Certification Dumps PSE-Cortex Exam for Full Questions - Exam Study Guide
NEW QUESTION 28
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- B. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- C. Contact support and ask for a security exception.
- D. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
Answer: A,D
NEW QUESTION 29
Which option is required to prepare the VDI Golden Image?
- A. Run the Cortex VDI conversion tool
- B. Configure the Golden Image as a persistent VDI
- C. Use the Cortex XDR VDI tool to obtain verdicts for all PE files
- D. Install the Cortex XOR Agent on the local machine
Answer: C
NEW QUESTION 30
What is the retention requirement for Cortex Data Lake sizing?
- A. number of endpoints
- B. number of VM-Series NGFW
- C. number of days
- D. logs per second
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/set-log-storage-quota
NEW QUESTION 31
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Sub-Play books
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Playbook Tasks
Answer: A,B
NEW QUESTION 32
Which step is required to prepare the VDI Golden Image?
- A. Set the memory dumps to manual setting
- B. Run the VDI conversion tool
- C. Ensure the latest content updates are installed
- D. Review any PE files that WildFire determined to be malicious
Answer: D
NEW QUESTION 33
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 34
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option A
- B. Option C
- C. Option B
- D. Option D
Answer: D
NEW QUESTION 35
How do sub-playbooks affect the Incident Context Data?
- A. When set to private, task outputs automatically get written to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to global, allows parallel task execution.
- D. When set to global, sub-playbook tasks do not have access to the root context
Answer: B
NEW QUESTION 36
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks.com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 37
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The modified scnpt was run in the wrong Docker image
- B. The modified script required a different parameter to run successfully.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - D. The dictionary was defined incorrectly in the second script.
Answer: A
NEW QUESTION 38
Which Cortex XDR capability extends investigations to an endpoint?
- A. Sensors
- B. Causality Chain
- C. Log Stitching
- D. Live Terminal
Answer: C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-conc
NEW QUESTION 39
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Customization
- B. Agent Configuration
- C. Device Control
- D. Agent Management
Answer: C
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 40
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. change the WildFire verdict for a given executable
- C. disable an EPM for a particular process
- D. permit processes to load specific DLLs
Answer: C
NEW QUESTION 41
What are process exceptions used for?
- A. change the WildFire verdict for a given executable
- B. whitelist programs from WildFire analysis
- C. disable an EPM for a particular process
- D. permit processes to load specific DLLs
Answer: B
NEW QUESTION 42
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, sub-playbook tasks do not have access to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to private, task outputs automatically get written to the root context
- D. When set to global, allows parallel task execution.
Answer: A
NEW QUESTION 43
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. !invite Bob
- B. #Bob
- C. @Bob
- D. /invite Bob
Answer: B
NEW QUESTION 44
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?
- A. Cortex XDR Pro Per Endpoint
- B. Cortex XDR Pro per TB
- C. Cortex XDR Prevent
- D. Cortex XDR Endpoint
Answer: D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licen
NEW QUESTION 45
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. registry entry
- B. IP
- C. domain
- D. endpoint hostname
Answer: A,D
NEW QUESTION 46
......
Authentic Best resources for PSE-Cortex Online Practice Exam: https://www.examcost.com/PSE-Cortex-practice-exam.html
PSE-Cortex Test Engine Practice Exam: https://drive.google.com/open?id=1ehj-k94kKl5eYClVupLI2ggS9PFIQqlj
