Try Free Palo Alto Networks PSE Cortex Practice Exam Questions

test2022-08-18T06:12:46+00:00

Want to pass Palo Alto Networks PSE Cortex exam? FreeTestShare PSE Cortex Practice Exam Questions will take away your nervousness and help you finish the exam with a lot of important professional information. We provide PSE Cortex Practice Exam Questions that will help you pass your Palo Alto Networks System Engineer – Cortex Professional exam on your first attempt. This PSE Cortex Practice Exam Questions will help you comprehend the most recent and hot topics.You will be able to pass the PSE Cortex exam with flying colors if you use our practice questions and answers.

To check how prepared you are, take a free PSE Cortex practice exam right now!

Page 1 of 2

1. When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?

splunk-get-alerts integration command

Cortex XSOAR TA App for Splunk

SplunkSearch automation

SplunkGO integration

2. How does DBot score an indicator that has multiple reputation scores?

uses the most severe score scores

the reputation as undefined

uses the average score

uses the least severe score

3. How do sub-playbooks affect the Incident Context Data?

When set to private, task outputs do not automatically get written to the root context

When set to private, task outputs automatically get written to the root context

When set to global, allows parallel task execution.

When set to global, sub-playbook tasks do not have access to the root context

4. The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

add paloaltonetworks com to the SSL Decryption Exclusion list

enable SSL decryption

disable SSL decryption

reinstall the root CA certificate

5. In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?

create a “docker” group and add the "Cortex XSOAR" or "demisto" user to this group

create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group

disable the Cortex XSOAR service

enable the docker service

6. Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

firewall alert

SIEM alert

full URL

registry set value

7. Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)

Define whether a playbook runs automatically when an incident type is encountered

Set reminders for an incident SLA

Add new fields to an incident type

Define the way that incidents of a specific type are displayed in the system

Drop new incidents of the same type that contain similar information

8. How many use cases should a POC success criteria document include?

only 1

3 or more

no more than 5

no more than 2

9. In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

Domain/workgroup membership

quarantine status

hostname

attack threat intelligence tag

10. How does an "inline" auto-extract task affect playbook execution?

Doesn't wait until the indicators are enriched and continues executing the next step

Doesn't wait until the indicators are enriched but populate context data before executing the next

step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.

Wait until the indicators are enriched and populate context data before executing the next step.

Page 2 of 2

11. Which two entities can be created as a BIOC? (Choose two.)

file

registry

event log

alert log

12. Which two filter operators are available in Cortex XDR? (Choose two.)

< >

Contains

Is Contained By

13. A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

"Close" Incident Form

Incident Summary

Incident Quick View

"New"/Edit" Incident Form

14. Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)

Security Event

HIP

Correlation

Analytics

15. An Administrator is alerted to a Suspicious Process Creation security event from multiple users.

The users believe that these events are false positives.

Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module

Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist

In the Cortex XDR security event, review the specific parent process, child process, and command line arguments

Contact support and ask for a security exception.