[Dec-2021] Feel Palo Alto Networks PSE-Cortex Dumps PDF Will likely be The best Option
PSE-Cortex exam torrent Palo Alto Networks study guide
NEW QUESTION 17
Which step is required to prepare the VDI Golden Image?
- A. Set the memory dumps to manual setting
- B. Run the VDI conversion tool
- C. Ensure the latest content updates are installed
- D. Review any PE files that WildFire determined to be malicious
Answer: D
NEW QUESTION 18
How do sub-playbooks affect the Incident Context Data?
- A. When set to private, task outputs automatically get written to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to global, allows parallel task execution.
- D. When set to global, sub-playbook tasks do not have access to the root context
Answer: B
NEW QUESTION 19
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. full URL
- B. firewall alert
- C. SIEM alert
- D. registry set value
Answer: A,B
NEW QUESTION 20
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. change the WildFire verdict for a given executable
- C. disable an EPM for a particular process
- D. permit processes to load specific DLLs
Answer: C
NEW QUESTION 21
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as note
- B. Mark as evidence
- C. Mark as scheduled entry
- D. Mark as artifact
Answer: A,B
NEW QUESTION 22
What is the difference between an exception and an exclusion?
- A. An exception is based on rules and exclusions are on alerts
- B. An exclusion does not exist
- C. An exception does not exist
- D. An exclusion is based on rules and exceptions are based on alerts.
Answer: A
NEW QUESTION 23
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- B. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- C. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- D. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
Answer: B
NEW QUESTION 24
How many use cases should a POC success criteria document include?
- A. no more than 2
- B. no more than 5
- C. 3 or more
- D. only 1
Answer: D
NEW QUESTION 25
Which two entities can be created as a BIOC? (Choose two.)
- A. alert log
- B. file
- C. registry
- D. event log
Answer: B,C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION 26
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
- B. disable the Cortex XSOAR service
- C. enable the docker service
- D. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
Answer: A
NEW QUESTION 27
Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)
- A. Correlation
- B. Security Event
- C. Analytics
- D. HIP
Answer: B,C
NEW QUESTION 28
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Sub-Play books
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Playbook Tasks
Answer: A,B
NEW QUESTION 29
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. xnettraps.paloaltonetworks.com
- B. cc-xnet50.traps.paloaltonetworks.com
- C. ch-xnet.traps.paloaltonetworks.com
- D. cc-xnet.traps.paloaltonetworks.com
- E. cc.xnet50traps.paloaltonetworks.com
- F. hc-xnet50.traps.paloaltonetworks.com
Answer: B,C,D
NEW QUESTION 30
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. xnettraps.paloaltonetworks.com
- B. cc-xnet50.traps.paloaltonetworks.com
- C. ch-xnet.traps.paloaltonetworks.com
- D. cc-xnet.traps.paloaltonetworks.com
- E. cc.xnet50traps.paloaltonetworks.com
- F. hc-xnet50.traps.paloaltonetworks.com
Answer: B,C,D
NEW QUESTION 31
A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)
- A. "New"/Edit" Incident Form
- B. "Close" Incident Form
- C. Incident Quick View
- D. Incident Summary
Answer: C,D
NEW QUESTION 32
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. !*
- C. < >
- D. =>
Answer: A,B
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-c
NEW QUESTION 33
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Sub-Play books
- B. Playbook Functions
- C. Generic Polling Automation Playbook
- D. Playbook Tasks
Answer: A,C
NEW QUESTION 34
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Tell them custom integrations are not created as part of the POC
- B. Extend the POC window to allow the solution architects to build it
- C. Agree to build the integration as part of the POC
- D. Tell them we can build it with Professional Services.
Answer: B
NEW QUESTION 35
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect instance name
- B. incorrect appliance port
- C. incorrect server URL
- D. incorrect Username and Password
Answer: A
NEW QUESTION 36
The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?
- A. enable SSL decryption
- B. reinstall the root CA certificate
- C. add paloaltonetworks com to the SSL Decryption Exclusion list
- D. disable SSL decryption
Answer: B
NEW QUESTION 37
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. techniques
- B. artifacts
- C. observed activity
- D. error messages
Answer: C
NEW QUESTION 38
......
Use Valid New PSE-Cortex Test Notes & PSE-Cortex Valid Exam Guide: https://www.trainingdump.com/Palo-Alto-Networks/PSE-Cortex-practice-exam-dumps.html
PSE-Cortex Actual Questions Answers PDF 100% Cover Real Exam Questions: https://drive.google.com/open?id=1uTw-MH-gwL_N295p9KvQAxhI1gGUICGQ