[Jan-2022] Pass PSE-Cortex Exam in First Attempt UpdatedPSE-Cortex Pass4cram Exam Question
Palo Alto Networks Certification Dumps PSE-Cortex Exam for Full Questions - Exam Study Guide
NEW QUESTION 35
Which Cortex XDR capability extends investigations to an endpoint?
- A. Sensors
- B. Causality Chain
- C. Log Stitching
- D. Live Terminal
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts
NEW QUESTION 36
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 37
Which two formats are supported by Whitelist? (Choose two)
- A. Regex
- B. STIX
- C. CIDR
- D. CSV
Answer: C,D
NEW QUESTION 38
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. hostname
- B. presence of Flash executable
- C. OS
- D. alert root cause
- E. domain/workgroup membership
Answer: B,D,E
NEW QUESTION 39
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. !invite Bob
- B. #Bob
- C. @Bob
- D. /invite Bob
Answer: B
NEW QUESTION 40
Which task allows the playbook to follow different paths based on specific conditions?
- A. Automation
- B. Parallel
- C. Manual
- D. Conditional
Answer: D
NEW QUESTION 41
How does DBot score an indicator that has multiple reputation scores?
- A. the reputation as undefined
- B. uses the most severe score scores
- C. uses the least severe score
- D. uses the average score
Answer: B
NEW QUESTION 42
How does an "inline" auto-extract task affect playbook execution?
- A. Wait until the indicators are enriched and populate context data before executing the next step.
- B. Doesn't wait until the indicators are enriched and continues executing the next step
- C. Doesn't wait until the indicators are enriched but populate context data before executing the next
- D. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
Answer: A
NEW QUESTION 43
In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?
- A. Using
- B. Vendor
- C. Brand
- D. Type
Answer: B
NEW QUESTION 44
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. the local console
- B. Endpoint > Endpoint Management
- C. Response > Action Center
- D. Telnet
Answer: C,D
NEW QUESTION 45
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)
- A. Drop new incidents of the same type that contain similar information
- B. Define whether a playbook runs automatically when an incident type is encountered
- C. Add new fields to an incident type
- D. Set reminders for an incident SLA
- E. Define the way that incidents of a specific type are displayed in the system
Answer: A,B,E
NEW QUESTION 46
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Sub-Play books
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Playbook Tasks
Answer: A,B
NEW QUESTION 47
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. !invite Bob
- B. /invite Bob
- C. @Bob
- D. #Bob
Answer: C
NEW QUESTION 48
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
- A. Live Terminal
- B. File Explorer
- C. Live Sensors
- D. Log Stitching
Answer: A
NEW QUESTION 49
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks.com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 50
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The modified scnpt was run in the wrong Docker image
- B. The modified script required a different parameter to run successfully.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - D. The dictionary was defined incorrectly in the second script.
Answer: A
NEW QUESTION 51
Which option is required to prepare the VDI Golden Image?
- A. Run the Cortex VDI conversion tool
- B. Configure the Golden Image as a persistent VDI
- C. Use the Cortex XDR VDI tool to obtain verdicts for all PE files
- D. Install the Cortex XOR Agent on the local machine
Answer: C
NEW QUESTION 52
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. artifacts
- B. techniques
- C. observed activity
- D. error messages
Answer: B
NEW QUESTION 53
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. registry entry
- C. IP
- D. endpoint hostname
Answer: A,C
NEW QUESTION 54
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Contact support and ask for a security exception.
- B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- C. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- D. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
Answer: A
NEW QUESTION 55
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
NEW QUESTION 56
Which step is required to prepare the VDI Golden Image?
- A. Set the memory dumps to manual setting
- B. Review any PE files that WildFire determined to be malicious
- C. Run the VDI conversion tool
- D. Ensure the latest content updates are installed
Answer: A
NEW QUESTION 57
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. !*
- C. < >
- D. =>
Answer: A,B
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html
NEW QUESTION 58
......
Authentic Best resources for PSE-Cortex Online Practice Exam: https://www.pass4cram.com/PSE-Cortex_free-download.html
Get the superior quality PSE-Cortex Dumps with explanations waiting just for you, get it now: https://drive.google.com/open?id=1uuFrZQdT98cm4t9VqBN6CCMRF5iwV_Ra