[Full-Version] 2022 New PSE-Cortex Actual Exam Dumps, Palo Alto Networks Practice Test [Q17-Q32]

20Aug 2022 by admin No Comments

4/5 - (1 vote)

[Full-Version] 2022 New PSE-Cortex Actual Exam Dumps, Palo Alto Networks Practice Test

Study HIGH Quality PSE-Cortex Free Study Guides and Exams Tutorials

Q17. When analyzing logs for indicators, which are used for only BIOC identification’?

observed activity

artifacts

techniques

error messages

Q18. Which option is required to prepare the VDI Golden Image?

Configure the Golden Image as a persistent VDI

Use the Cortex XDR VDI tool to obtain verdicts for all PE files

Install the Cortex XOR Agent on the local machine

Run the Cortex VDI conversion tool

Q19. Which two filter operators are available in Cortex XDR? (Choose two.)

not Contains

< >

Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-c

Q20. If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

Live Sensors

File Explorer

Log Stitching

Live Terminal

Q21. An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?

desktop engineer

SOC manager

SOC analyst IT

operations manager

Q22. Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

endpoint hostname

domain

registry entry

Q23. What is the retention requirement for Cortex Data Lake sizing?

number of endpoints

number of VM-Series NGFW

number of days

logs per second

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/set-log-storage-quota

Q24. The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

Cortex XDR Pro per TB

Cortex XDR Prevent

Cortex XDR Endpoint

Cortex XDR Pro Per Endpoint

Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licen

Q25. How do sub-playbooks affect the Incident Context Data?

When set to private, task outputs do not automatically get written to the root context

When set to private, task outputs automatically get written to the root context

When set to global, allows parallel task execution.

When set to global, sub-playbook tasks do not have access to the root context

Q26. An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?

Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool

Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities

Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities

Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool

Q27. Which two items are stitched to the Cortex XDR causality chain” (Choose two)

firewall alert

SIEM alert

full URL

registry set value

Q28. Which CLI query would bring back Notable Events from Splunk?
A)

B)

C)

D)

Option A

Option B

Option C

Option D

Q29. Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

the relevant shell

The causality group owner

the adversary’s remote process

the chain’s alert initiator

Q30. Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

endpoint hostname

domain

registry entry

Q31. The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS