PSE-Cortex Dumps Updated Mar 06, 2024 Practice Test and 60 unique questions
2024 Latest 100% Exam Passing Ratio - PSE-Cortex Dumps PDF
The PSE-Cortex exam is an advanced-level certification that covers topics related to administering and troubleshooting the Cortex platform. PSE-Cortex exam is designed to test the candidate's understanding of Cortex functionalities and features, as well as their ability to configure and deploy Cortex applications.
NEW QUESTION # 23
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as scheduled entry
- B. Mark as evidence
- C. Mark as artifact
- D. Mark as note
Answer: B,D
NEW QUESTION # 24
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- B. disable the Cortex XSOAR service
- C. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
- D. enable the docker service
Answer: A
NEW QUESTION # 25
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. error messages
- C. artifacts
- D. observed activity
Answer: D
NEW QUESTION # 26
When a Demisto Engine is part of a Load-Balancing group it?
- A. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- B. Must be in a Load-Balancing group with at least another 3 members
- C. It must have port 443 open to allow the Demisto Server to establish a connection
- D. Can be used separately as an engine, only if connected to the Demisto Server directly
Answer: B
NEW QUESTION # 27
How does DBot score an indicator that has multiple reputation scores?
- A. the reputation as undefined
- B. uses the most severe score scores
- C. uses the least severe score
- D. uses the average score
Answer: B
NEW QUESTION # 28
If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?
- A. 1 TB
- B. 100 GB
- C. 10 TB
- D. 10 GB
Answer: A
NEW QUESTION # 29
How many use cases should a POC success criteria document include?
- A. 3 or more
- B. only 1
- C. no more than 5
- D. no more than 2
Answer: D
NEW QUESTION # 30
A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?
- A. Write a GPO for each endpoint agent to check in less often
- B. It is not possible to configure Cortex Data Lake quota for specific log types.
- C. Go to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota
- D. Within the TMS, create an agent settings profile and modify the Disk Quota value
Answer: C
NEW QUESTION # 31
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. /invite Bob
- B. #Bob
- C. !invite Bob
- D. @Bob
Answer: D
NEW QUESTION # 32
Which two entities can be created as a BIOC? (Choose two.)
- A. file
- B. registry
- C. alert log
- D. event log
Answer: A,B
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION # 33
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION # 34
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option C
- B. Option A
- C. Option D
- D. Option B
Answer: C
NEW QUESTION # 35
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. disable an EPM for a particular process
- C. change the WildFire verdict for a given executable
- D. permit processes to load specific DLLs
Answer: A
NEW QUESTION # 36
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Tell them custom integrations are not created as part of the POC
- B. Extend the POC window to allow the solution architects to build it
- C. Tell them we can build it with Professional Services.
- D. Agree to build the integration as part of the POC
Answer: B
NEW QUESTION # 37
Which two entities can be created as a BIOC? (Choose two.)
- A. file
- B. registry
- C. alert log
- D. event log
Answer: A,B
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd
NEW QUESTION # 38
......
Verified PSE-Cortex dumps Q&As - 100% Pass from ExamTorrent: https://www.examtorrent.com/PSE-Cortex-valid-vce-dumps.html
Pass Exam With Full Sureness - PSE-Cortex Dumps with 60 Questions: https://drive.google.com/open?id=1M0J1jSV6CgR9JwTGjMtftlYuUE_ShEi0
