The New PSE-Cortex 2023 Updated Verified Study Guides & Best Courses
Authentic PSE-Cortex Exam Dumps PDF - 2023 Updated
The Palo Alto Networks PSE-Cortex is an industry-recognized certification exam aimed at validating the knowledge and skills of network professionals in the area of security operations. The exam is designed to gauge an individual's competence in deploying, configuring, and troubleshooting Cortex XDR, Palo Alto Networks' signature detection and response solution. Candidates who pass the PSE-Cortex exam are considered experts in Cortex XDR, and they can help organizations to maximize their investment in the product, optimize security operations, and mitigate risks in a timely and effective manner.
NEW QUESTION # 13
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- B. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
- C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
Answer: A
NEW QUESTION # 14
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as scheduled entry
- B. Mark as artifact
- C. Mark as evidence
- D. Mark as note
Answer: B
NEW QUESTION # 15
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. < >
- C. !*
- D. =>
Answer: A,C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html
NEW QUESTION # 16
A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?
- A. It is not possible to configure Cortex Data Lake quota for specific log types.
- B. Within the TMS, create an agent settings profile and modify the Disk Quota value
- C. Go to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota
- D. Write a GPO for each endpoint agent to check in less often
Answer: C
NEW QUESTION # 17
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. IP
- B. endpoint hostname
- C. domain
- D. registry entry
Answer: B,D
NEW QUESTION # 18
In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?
- A. Using
- B. Vendor
- C. Brand
- D. Type
Answer: B
NEW QUESTION # 19
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Functions
- C. Sub-Play books
- D. Playbook Tasks
Answer: B,C
NEW QUESTION # 20
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
- B. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- C. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- D. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
Answer: B
NEW QUESTION # 21
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
- A. hostname
- B. quarantine status
- C. attack threat intelligence tag
- D. Domain/workgroup membership
- E. OS
Answer: A,B,E
NEW QUESTION # 22
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Contact support and ask for a security exception.
- B. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- C. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- D. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
Answer: B,D
NEW QUESTION # 23
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. the local console
- B. Telnet
- C. Response > Action Center
- D. Endpoint > Endpoint Management
Answer: B,C
NEW QUESTION # 24
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. SplunkSearch automation
- B. splunk-get-alerts integration command
- C. Cortex XSOAR TA App for Splunk
- D. SplunkGO integration
Answer: B
NEW QUESTION # 25
What are process exceptions used for?
- A. disable an EPM for a particular process
- B. whitelist programs from WildFire analysis
- C. permit processes to load specific DLLs
- D. change the WildFire verdict for a given executable
Answer: B
NEW QUESTION # 26
The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. reinstall the root CA certificate
- B. add paloaltonetworks.com to the SSL Decryption Exclusion list
- C. enable SSL decryption
- D. disable SSL decryption
Answer: A
NEW QUESTION # 27
What is the result of creating an exception from an exploit security event?
- A. exempts the user from generating events for 24 hours
- B. White lists the process from Wild Fire analysis
- C. disables the triggered EPM for the host and process involve
- D. exempts administrators from generating alerts for 24 hours
Answer: C
NEW QUESTION # 28
......
Get Prepared for Your PSE-Cortex Exam With Actual 60 Questions: https://www.actual4dumps.com/PSE-Cortex-study-material.html
Valid PSE-Cortex Test Answers Full-length Practice Certification Exams: https://drive.google.com/open?id=1gryrat1uBs4pUPESl5pby2RNMhhYkYMC