Pass Palo Alto Networks Palo Alto Networks System Engineer - Cortex Professional Exam in First Attempt Guaranteed Updated Dump from TestPassKing!
Pass PSE-Cortex Exam with 60 Questions - Verified By TestPassKing
NEW QUESTION 34
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. full URL
- B. SIEM alert
- C. firewall alert
- D. registry set value
Answer: A,C
NEW QUESTION 35
A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)
- A. Incident Quick View
- B. "Close" Incident Form
- C. Incident Summary
- D. "New"/Edit" Incident Form
Answer: A,C
NEW QUESTION 36
What are process exceptions used for?
- A. change the WildFire verdict for a given executable
- B. permit processes to load specific DLLs
- C. disable an EPM for a particular process
- D. whitelist programs from WildFire analysis
Answer: C
NEW QUESTION 37
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. enable the docker service
- B. disable the Cortex XSOAR service
- C. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- D. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
Answer: C
NEW QUESTION 38
Whichfour types of Traps logs are stored within Cortex Data Lake?
- A. Threat, Config, System, Analytic
- B. Threat, Config, Authentication, Analytic
- C. Threat, Config, System,Data
- D. Threat, Monitor. System, Analytic
Answer: C
NEW QUESTION 39
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect server URL
- B. incorrect Username and Password
- C. incorrect appliance port
- D. incorrect instance name
Answer: B
NEW QUESTION 40
Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?
- A. Device Control
- B. Device Customization
- C. Agent Configuration
- D. Agent Management
Answer: A
Explanation:
Explanation
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231
NEW QUESTION 41
An antivirus refresh project was initiated by the IT operations executive. Who is the best source for discussion about the project's operational considerations'?
- A. endpoint manager
- B. desktop engineer
- C. SOC analyst
- D. SOC manager
Answer: C
NEW QUESTION 42
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. SplunkGO integration
- B. SplunkSearch automation
- C. Cortex XSOAR TA App for Splunk
- D. splunk-get-alerts integration command
Answer: D
NEW QUESTION 43
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The dictionary was defined incorrectly in the second script.
- B. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - C. The modified scnpt was run in the wrong Docker image
- D. The modified script required a different parameter to run successfully.
Answer: C
NEW QUESTION 44
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- B. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- C. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
- D. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
Answer: D
NEW QUESTION 45
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
- A. xnettraps.paloaltonetworks.com
- B. cc-xnet50.traps.paloaltonetworks.com
- C. hc-xnet50.traps.paloaltonetworks.com
- D. cc.xnet50traps.paloaltonetworks.com
- E. ch-xnet.traps.paloaltonetworks.com
- F. cc-xnet.traps.paloaltonetworks.com
Answer: B,E,F
NEW QUESTION 46
When a Demisto Engine is part of a Load-Balancing group it?
- A. It must have port 443 open to allow the Demisto Server to establish a connection
- B. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
- C. Must be in a Load-Balancing group with at least another 3 members
- D. Can be used separately as an engine, only if connected to the Demisto Server directly
Answer: B
NEW QUESTION 47
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect server URL
- B. incorrect appliance port
- C. incorrect instance name
- D. incorrect Username and Password
Answer: C
NEW QUESTION 48
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?
- A. Tell them we can build it with Professional Services.
- B. Tell them custom integrations are not created as part of the POC
- C. Agree to build the integration as part of the POC
- D. Extend the POC window to allow the solution architects to build it
Answer: D
NEW QUESTION 49
How can you view all the relevant incidents for an indicator?
- A. Related Indicators column in Incident Screen
- B. Linked Indicators column in Incident Screen
- C. Related Incidents column in Indicator Screen
- D. Linked Incidents column in Indicator Screen
Answer: C
NEW QUESTION 50
What is the retention requirement for Cortex Data Lake sizing?
- A. logs per second
- B. number of days
- C. number of endpoints
- D. number of VM-Series NGFW
Answer: B
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-corte
NEW QUESTION 51
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Generic Polling Automation Playbook
- B. Playbook Functions
- C. Sub-Play books
- D. Playbook Tasks
Answer: A,C
NEW QUESTION 52
Which step is required to prepare the VDI Golden Image?
- A. Ensure the latest content updates are installed
- B. Review any PE files that WildFire determined to be malicious
- C. Set the memory dumps to manual setting
- D. Run the VDI conversion tool
Answer: B
NEW QUESTION 53
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)
- A. Add new fields to an incident type
- B. Set reminders for an incident SLA
- C. Define whether a playbook runs automatically when an incident type is encountered
- D. Define the way that incidents of a specific type are displayed in the system
- E. Drop new incidents of the same type that contain similar information
Answer: C,D,E
NEW QUESTION 54
......
Penetration testers simulate PSE-Cortex exam: https://www.testpassking.com/PSE-Cortex-exam-testking-pass.html
Free Test Engine For Palo Alto Networks System Engineer - Cortex Professional Certification Exams: https://drive.google.com/open?id=1KwDYTlcy67lkFTAeLCaL6RXeFCgs6x09