Free Palo Alto Networks System Engineer – Cortex Professional Exam PSE-Cortex Exam Practice Test

Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

• IP
  
• endpoint hostname
  
• domain
  
• registry entry
  

What are process exceptions used for?

• whitelist programs from WildFire analysis
  
• permit processes to load specific DLLs
  
• change the WildFire verdict for a given executable
  
• disable an EPM for a particular process
  

Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)

• Define whether a playbook runs automatically when an incident type is encountered
  
• Set reminders for an incident SLA
  
• Add new fields to an incident type
  
• Define the way that incidents of a specific type are displayed in the system
  
• Drop new incidents of the same type that contain similar information
  

Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)

• Security Event
  
• HIP
  
• Correlation
  
• Analytics
  

The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

• add paloaltonetworks com to the SSL Decryption Exclusion list
  
• enable SSL decryption
  
• disable SSL decryption
  
• reinstall the root CA certificate
  

An antivirus refresh project was initiated by the IT operations executive. Who is the best source for discussion about the project's operational considerations'?

• endpoint manager
  
• SOC manager
  
• SOC analyst
  
• desktop engineer
  

Which two entities can be created as a BIOC? (Choose two.)

• file
  
• registry
  
• event log
  
• alert log
  

Which step is required to prepare the VDI Golden Image?

• Review any PE files that WildFire determined to be malicious
  
• Ensure the latest content updates are installed
  
• Run the VDI conversion tool
  
• Set the memory dumps to manual setting
  

An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.What is the safest way to do it?

• The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
  
• The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
  
• The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
  
• The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
  

Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

• Agent Configuration
  
• Device Control
  
• Device Customization
  
• Agent Management