New 2022 PSE-Cortex Dumps for Palo Alto Networks Certification Certified Exam Questions & Answer
Realistic Verified PSE-Cortex exam dumps Q&As - PSE-Cortex Free Update
NEW QUESTION 30
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. SplunkSearch automation
- B. Cortex XSOAR TA App for Splunk
- C. SplunkGO integration
- D. splunk-get-alerts integration command
Answer: B
NEW QUESTION 31
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. quarantine status
- B. attack threat intelligence tag
- C. hostname
- D. Domain/workgroup membership
- E. OS
Answer: C,D,E
NEW QUESTION 32
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. Cortex XSOAR TA App for Splunk
- B. splunk-get-alerts integration command
- C. SplunkSearch automation
- D. SplunkGO integration
Answer: B
NEW QUESTION 33
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
NEW QUESTION 34
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
- B. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
Answer: B
NEW QUESTION 35
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. error messages
- B. techniques
- C. artifacts
- D. observed activity
Answer: D
NEW QUESTION 36
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION 37
How does an "inline" auto-extract task affect playbook execution?
- A. Wait until the indicators are enriched and populate context data before executing the next step.
- B. Doesn't wait until the indicators are enriched but populate context data before executing the next
- C. Doesn't wait until the indicators are enriched and continues executing the next step
- D. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
Answer: A
NEW QUESTION 38
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?
- A. SOC manager
- B. operations manager
- C. SOC analyst IT
- D. desktop engineer
Answer: A
NEW QUESTION 39
When a Demisto Engine is part of a Load-Balancing group it?
- A. Can be used separately as an engine, only if connected to the Demisto Server directly
- B. It must have port 443 open to allow the Demisto Server to establish a connection
- C. Must be in a Load-Balancing group with at least another 3 members
- D. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
Answer: C
NEW QUESTION 40
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. hc-xnet50.traps.paloaltonetworks.com
- B. cc.xnet50traps.paloaltonetworks.com
- C. xnettraps.paloaltonetworks.com
- D. cc-xnet50.traps.paloaltonetworks.com
- E. ch-xnet.traps.paloaltonetworks.com
- F. cc-xnet.traps.paloaltonetworks.com
Answer: D,E,F
NEW QUESTION 41
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect Username and Password
- B. incorrect server URL
- C. incorrect instance name
- D. incorrect appliance port
Answer: A
NEW QUESTION 42
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. =
- B. Is Contained By
- C. Contains
- D. < >
Answer: A,C
NEW QUESTION 43
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. permit processes to load specific DLLs
- C. change the WildFire verdict for a given executable
- D. disable an EPM for a particular process
Answer: D
NEW QUESTION 44
An antivirus refresh project was initiated by the IT operations executive. Who is the best source for discussion about the project's operational considerations'?
- A. endpoint manager
- B. SOC manager
- C. SOC analyst
- D. desktop engineer
Answer: C
NEW QUESTION 45
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: B
NEW QUESTION 46
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. IP
- C. endpoint hostname
- D. registry entry
Answer: A,B
NEW QUESTION 47
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. add paloaltonetworks com to the SSL Decryption Exclusion list
- C. disable SSL decryption
- D. reinstall the root CA certificate
Answer: D
NEW QUESTION 48
Which option describes a Load-Balancing Engine Group?
- A. A group of engines that use an algorithm to efficiently share the workload for automation scripts
- B. A group of engines that ensure High Availability of Demisto backend databases.
- C. A group of engines that use an algorithm to efficiently share the workload for integrations
- D. A group of D2 agents that share processing power across multiple endpoints
Answer: A
NEW QUESTION 49
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: A
NEW QUESTION 50
What is the retention requirement for Cortex Data Lake sizing?
- A. number of endpoints
- B. logs per second
- C. number of days
- D. number of VM-Series NGFW
Answer: C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-corte
NEW QUESTION 51
How does DBot score an indicator that has multiple reputation scores?
- A. uses the most severe score scores
- B. the reputation as undefined
- C. uses the average score
- D. uses the least severe score
Answer: A
NEW QUESTION 52
......
Use Real PSE-Cortex Dumps - 100% Free PSE-Cortex Exam Dumps: https://www.dumpsmaterials.com/PSE-Cortex-real-torrent.html
PSE-Cortex Exam Dumps, Test Engine Practice Test Questions: https://drive.google.com/open?id=16bemgEUWq1PvCy1qrsE9vQqc_Vfj5X31
