Prepare PSE-Cortex Question Answers - PSE-Cortex Exam Dumps
Real Palo Alto Networks PSE-Cortex Exam Questions [Updated 2021]
NEW QUESTION 35
When a Demisto Engine is part of a Load-Balancing group it?
- A. Can be used separately as an engine, only if connected to the Demisto Server directly
- B. It must have port 443 open to allow the Demisto Server to establish a connection
- C. Must be in a Load-Balancing group with at least another 3 members
- D. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
Answer: C
NEW QUESTION 36
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: B
NEW QUESTION 37
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. add paloaltonetworks com to the SSL Decryption Exclusion list
- C. disable SSL decryption
- D. reinstall the root CA certificate
Answer: D
NEW QUESTION 38
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Playbook Tasks
- B. Sub-Play books
- C. Generic Polling Automation Playbook
- D. Playbook Functions
Answer: B,D
NEW QUESTION 39
Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?
- A. The causality group owner
- B. the adversary's remote process
- C. the chain's alert initiator
- D. the relevant shell
Answer: A
NEW QUESTION 40
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. disable the Cortex XSOAR service
- B. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- C. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
- D. enable the docker service
Answer: B
NEW QUESTION 41
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION 42
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- C. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- D. Contact support and ask for a security exception.
Answer: A,B
NEW QUESTION 43
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Customization
- B. Device Control
- C. Agent Management
- D. Agent Configuration
Answer: B
Explanation:
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 44
Which two entities can be created as a BIOC? (Choose two.)
- A. event log
- B. alert log
- C. registry
- D. file
Answer: C,D
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION 45
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. domain/workgroup membership
- B. OS
- C. presence of Flash executable
- D. hostname
- E. alert root cause
Answer: A,C,E
NEW QUESTION 46
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. permit processes to load specific DLLs
- C. change the WildFire verdict for a given executable
- D. disable an EPM for a particular process
Answer: D
NEW QUESTION 47
How many use cases should a POC success criteria document include?
- A. only 1
- B. 3 or more
- C. no more than 5
- D. no more than 2
Answer: A
NEW QUESTION 48
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: A
NEW QUESTION 49
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Customization
- B. Device Control
- C. Agent Management
- D. Agent Configuration
Answer: B
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 50
A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)
- A. Incident Summary
- B. "Close" Incident Form
- C. Incident Quick View
- D. "New"/Edit" Incident Form
Answer: A,C
NEW QUESTION 51
How does DBot score an indicator that has multiple reputation scores?
- A. uses the most severe score scores
- B. the reputation as undefined
- C. uses the average score
- D. uses the least severe score
Answer: A
NEW QUESTION 52
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. Cortex XSOAR TA App for Splunk
- B. splunk-get-alerts integration command
- C. SplunkSearch automation
- D. SplunkGO integration
Answer: B
NEW QUESTION 53
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
NEW QUESTION 54
......
PSE-Cortex Exam Dumps Pass with Updated 2021: https://www.examtorrent.com/PSE-Cortex-valid-vce-dumps.html
Free PSE-Cortex Exam Dumps to Pass Exam Easily: https://drive.google.com/open?id=1M0J1jSV6CgR9JwTGjMtftlYuUE_ShEi0
