[Feb 22, 2022] PSE-Cortex Exam Dumps PDF Updated Dump from BootcampPDF Guaranteed Success
Pass Your Palo Alto Networks Exam with PSE-Cortex Exam Dumps
NEW QUESTION 27
What method does the Traps agent use to identify malware during a scheduled scan?
- A. Signature comparison
- B. WildFire hash comparison and dynamic analysis
- C. Local analysis
- D. Heuristic analysis
Answer: B
NEW QUESTION 28
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
- A. the adversary's remote process
- B. the chain's alert initiator
- C. The causality group owner
- D. the relevant shell
Answer: C
NEW QUESTION 29
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Functions
- C. Playbook Tasks
- D. Sub-Play books
Answer: B,D
NEW QUESTION 30
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
- A. Live Terminal
- B. Live Sensors
- C. Log Stitching
- D. File Explorer
Answer: A
NEW QUESTION 31
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. error messages
- B. techniques
- C. artifacts
- D. observed activity
Answer: D
NEW QUESTION 32
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. the local console
- B. Telnet
- C. Response > Action Center
- D. Endpoint > Endpoint Management
Answer: C,D
NEW QUESTION 33
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: B
NEW QUESTION 34
Which two entities can be created as a BIOC? (Choose two.)
- A. registry
- B. alert log
- C. event log
- D. file
Answer: A,D
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION 35
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Tasks
- C. Sub-Play books
- D. Playbook Functions
Answer: A,C
NEW QUESTION 36
When a Demisto Engine is part of a Load-Balancing group it?
- A. Can be used separately as an engine, only if connected to the Demisto Server directly
- B. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- C. It must have port 443 open to allow the Demisto Server to establish a connection
- D. Must be in a Load-Balancing group with at least another 3 members
Answer: B
NEW QUESTION 37
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. quarantine status
- B. Domain/workgroup membership
- C. attack threat intelligence tag
- D. OS
- E. hostname
Answer: A,D,E
NEW QUESTION 38
Which four types of Traps logs are stored within Cortex Data Lake?
- A. Threat, Config, Authentication, Analytic
- B. Threat, Monitor. System, Analytic
- C. Threat, Config, System, Analytic
- D. Threat, Config, System, Data
Answer: C
NEW QUESTION 39
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option B
- B. Option C
- C. Option A
- D. Option D
Answer: D
NEW QUESTION 40
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- B. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- C. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- D. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
Answer: C
NEW QUESTION 41
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. IP
- B. domain
- C. endpoint hostname
- D. registry entry
Answer: A,B
NEW QUESTION 42
Which two entities can be created as a BIOC? (Choose two.)
- A. registry
- B. alert log
- C. event log
- D. file
Answer: A,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 43
How many use cases should a POC success criteria document include?
- A. no more than 5
- B. only 1
- C. no more than 2
- D. 3 or more
Answer: B
NEW QUESTION 44
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks.com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 45
......
New Real PSE-Cortex Exam Dumps Questions: https://examcollection.bootcamppdf.com/PSE-Cortex-exam-actual-tests.html