Steps Necessary To Pass The PSE-Cortex Exam from Training Expert Actual4Exams
Valid Way To Pass Palo Alto Networks Certification's PSE-Cortex Exam
NEW QUESTION 31
When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
- A. SplunkSearch automation
- B. Cortex XSOAR TA App for Splunk
- C. SplunkGO integration
- D. splunk-get-alerts integration command
Answer: B
NEW QUESTION 32
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
- A. Live Terminal
- B. Log Stitching
- C. Live Sensors
- D. File Explorer
Answer: A
NEW QUESTION 33
Which Cortex XDR capability extends investigations to an endpoint?
- A. Live Terminal
- B. Causality Chain
- C. Log Stitching
- D. Sensors
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts
NEW QUESTION 34
What are two manual actions allowed on War Room entries? (Choose two.)
- A. Mark as evidence
- B. Mark as artifact
- C. Mark as note
- D. Mark as scheduled entry
Answer: B
NEW QUESTION 35
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect Username and Password
- B. incorrect server URL
- C. incorrect instance name
- D. incorrect appliance port
Answer: A
NEW QUESTION 36
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?
- A. DEB
- B. SH
- C. ZIP
- D. RPM
Answer: C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-config
NEW QUESTION 37
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The modified scnpt was run in the wrong Docker image
- B. The modified script required a different parameter to run successfully.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - D. The dictionary was defined incorrectly in the second script.
Answer: A
NEW QUESTION 38
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- C. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- D. Contact support and ask for a security exception.
Answer: A,B
NEW QUESTION 39
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
NEW QUESTION 40
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. SIEM alert
- B. firewall alert
- C. full URL
- D. registry set value
Answer: B,C
NEW QUESTION 41
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. =>
- C. !*
- D. < >
Answer: A,C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html
NEW QUESTION 42
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)
- A. Add new fields to an incident type
- B. Define the way that incidents of a specific type are displayed in the system
- C. Drop new incidents of the same type that contain similar information
- D. Set reminders for an incident SLA
- E. Define whether a playbook runs automatically when an incident type is encountered
Answer: B,D,E
NEW QUESTION 43
A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?
- A. Within the TMS, create an agent settings profile and modify the Disk Quota value
- B. Go to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota
- C. It is not possible to configure Cortex Data Lake quota for specific log types.
- D. Write a GPO for each endpoint agent to check in less often
Answer: B
NEW QUESTION 44
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Contact support and ask for a security exception.
- B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- C. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- D. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
Answer: A
NEW QUESTION 45
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?
- A. Cortex XDR Endpoint
- B. Cortex XDR Pro per TB
- C. Cortex XDR Prevent
- D. Cortex XDR Pro Per Endpoint
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licen
NEW QUESTION 46
......
All PSE-Cortex Dumps and Palo Alto Networks System Engineer - Cortex Professional Training Courses: https://www.actual4exams.com/PSE-Cortex-valid-dump.html