PSE-Cortex-Pro-24 by Palo Alto Networks Actual Free Exam Q&As

Question 1

What is the difference between the intel feed's license quotas of Cortex XSOAR Starter Edition and Cortex XSOAR (SOAR + TIM)?

A. Cortex XSOAR Starter Edition includes up to 5 active feeds and 100 indicators/fetch. B. In Cortex XSOAR (SOAR + TIM), Unit 42 Intelligence is not included. C. In Cortex XSOAR (SOAR + TIM), intelligence detail view and relationships data are not included. D. Cortex XSOAR Started Edition has unlimited access to the Threat Intel Library.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which task allows the playbook to follow different paths based on specific conditions?

A. Manual B. Automation C. Conditional D. Parallel

Discussion 0

Correct Answer: C Vote an answer

Question 3

A Cortex XSOAR customer wants to ingest emails from a single mailbox. The mailbox brings in reported phishing emails and email requests from human resources (HR) to onboard new users. The customer wants to run two separate workflows from this mailbox, one for phishing and one for onboarding.
What will allow Cortex XSOAR to accomplish this in the most efficient way?

A. Use machine learning (ML) to determine incident type. B. Use an incident classifier based on a field in each type of email to classify those containing "Phish Alert" in the subject as phishing and those containing "Onboard Request" as onboarding. C. Create two instances of the email integration and classify one instance as ingesting incidents of type phishing and the other as ingesting incidents of type onboarding. D. Create a playbook to process and determine incident type based on content of the email.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Why is Premium Customer Success an important part of any Cortex bill of materials?

A. It provides expert-led configuration guidance. B. It provides full implementation services. C. It provides managed threat hunting D. It provides instructor-led training courses.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

What are the key capabilities of the ASM for Remote Workers module?

A. Identifying office network vulnerabilities, monitoring remote workforce, and encrypting data B. Gathering endpoint data, conducting internal scans, and automating network configurations C. Monitoring endpoint activity, managing firewall rules, and mitigating cybersecurity threats D. Analyzing global scan data, identifying risky issues on remote networks, and providing internal insights

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

A. SIEM alert B. registry set value C. firewall alert D. full URL

Discussion 0

Correct Answer: C,D Vote an answer

Question 7

In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

A. Type B. Using C. Vendor D. Brand

Discussion 0

Correct Answer: C Vote an answer

Question 8

How can you view all the relevant incidents for an indicator?

A. Related Indicators column in Incident Screen B. Related Incidents column in Indicator Screen C. Linked Incidents column in Indicator Screen D. Linked Indicators column in Incident Screen

Discussion 0

Correct Answer: B Vote an answer

Question 9

A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users.
What would be the appropriate next step in the playbook?

A. Email the CISO to advise that malicious email was found. B. Disable the user's email account. C. Email the user to confirm the reported email was phishing. D. Change the user's password.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 10

In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )

A. domain/workgroup membership B. OS C. alert root cause D. presence of Flash executable E. hostname

Discussion 0

Correct Answer: A,B,E Vote an answer

Question 11

When running a Cortex XSIAM proof of value (POV), why is it important to deploy the Cortex XDR agent?

A. It is used to enforce license compliance. B. It runs automation daybooks on the endpoints. C. It will prevent all threats in the environment. D. It provides telemetry for stitching and analytics.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 12

An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

A. Contact support and ask for a security exception. B. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments C. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist D. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module

Discussion 0

Correct Answer: B,C Vote an answer

Question 13

Which statement applies to the malware protection flow in Cortex XDR Prevent?

A. A trusted signed file is exempt from local static analysis. B. Hash comparisons come after local static analysis. C. In the final step, the block list is verified. D. Local static analysis happens before a WildFire verdict check.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 14

How does a clear understanding of a customer's technical expertise assist in a hand off following the close of an opportunity?

A. It enables customers to prepare for audits so they can demonstrate compliance. B. It enables post-sales teams to tailor their support and training appropriately C. It allows implementation teams to bypass initial scoping exercises D. It helps in assigning additional technical tasks to the customer

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Palo Alto Networks Systems Engineer Professional - Cortex - PSE-Cortex-Pro-24 Exam Practice Test