PSE-Cortex-Pro-24 Exam Training Practice Tests (Palo Alto Networks Systems Engineer Professional

Question 1

A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users.
What would be the appropriate next step in the playbook?

A. Disable the user's email account. B. Email the user to confirm the reported email was phishing. C. Change the user's password. D. Email the CISO to advise that malicious email was found.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

When preparing for a Cortex XSOAR proof of value (POV), which task should be performed before the evaluation is requested?

A. Building out an executive-IeveI proposal detailing the product capabilities B. Ensuring that the customer has single sign-on (SSO) configured in their environment C. Gathering a list of the different integrations that will need to be configured D. Planning for every different use case the customer has for the solution

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

When a Demisto Engine is part of a Load-Balancing group it?

A. Can be used separately as an engine, only if connected to the Demisto Server directly B. It must have port 443 open to allow the Demisto Server to establish a connection C. Must be in a Load-Balancing group with at least another 3 members D. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance

Correct Answer: B

Question 4

Within Cortex XSIAM, how does the integration of Attack Surface Management (ASM) provide a unified approach to security event management that traditional SIEMs typically lack?

A. By manually correlating of ASM data with security events B. By enriching incidents with ASM data for all internet-facing assets C. By offering dashboards on ASM data within the management console D. By providing a queryable dataset of ASM data for threat hunting

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Which two Cortex XSOAR incident type features can be customized under Settings > Advanced > Incident Types? (Choose two.)

A. defining whether a playbook runs automatically when an incident type is encountered B. adding new fields to an incident type C. dropping new incidents of the same type that contain similar information D. setting reminders for an incident service level agreement

Correct Answer: A,B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

What is the difference between an exception and an exclusion?

A. An exclusion is based on rules and exceptions are based on alerts. B. An exclusion does not exist C. An exception is based on rules and exclusions are on alerts D. An exception does not exist

Correct Answer: C

Question 7

Which statement applies to the differentiation of Cortex XDR from security information and event management (SIEM)?

A. Cortex XDR requires a large and diverse team of analysts and up to several weeks for simple actions like creating an alert. B. Cortex XDR allows just logging into the console and out of the box the events were blocked as a proactive approach. C. SIEM has been entirely designed and built as cloud-native, with the ability to stitch together cloud logs, on-premises logs, third-party logs, and endpoint logs. D. SIEM has access to raw logs from agents, where Cortex XDR traditionally only gets alerts.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

Which Cortex XSIAM license is required if an organization needs to protect a cloud Kubernetes host?

A. Identity Threat Detection and Response B. Cortex XSIAM Enterprise Plus C. Attack Surface Management D. Cortex XSIAM Enterprise

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

What does DBot use to score an indicator that has multiple reputation scores?

A. most severe score B. least severe score C. undefined score D. average score

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only Which use case should be used for the POC?

A. ServiceNow B. either C. neither D. phishing

Correct Answer: D

Question 11

What are two manual actions allowed on War Room entries? (Choose two.)

A. Mark as artifact B. Mark as scheduled entry C. Mark as note D. Mark as evidence

Correct Answer: C,D

Question 12

What is a key difference between audit users and full users in Cortex XSOAR?

A. Audit users can run scripts and playbooks, while full users can only view reports. B. Audit users have read-only permission, white full users have read-write permission. C. Full users can only view dashboards, while audit users can investigate incidents. D. Audit users can only view incidents, while full users can edit system components.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Palo Alto Networks Systems Engineer Professional - Cortex - PSE-Cortex-Pro-24 Exam Practice Test