Free Palo Alto Networks System Engineer – Cortex Professional Exam PSE-Cortex Exam Practice Test

What is the difference between an exception and an exclusion?

• An exception is based on rules and exclusions are on alerts
  
• An exclusion is based on rules and exceptions are based on alerts.
  
• An exception does not exist
  
• An exclusion does not exist
  

Which option is required to prepare the VDI Golden Image?

• Configure the Golden Image as a persistent VDI
  
• Use the Cortex XDR VDI tool to obtain verdicts for all PE files
  
• Install the Cortex XOR Agent on the local machine
  
• Run the Cortex VDI conversion tool
  

Which option describes a Load-Balancing Engine Group?

• A group of engines that use an algorithm to efficiently share the workload for integrations
  
• A group of engines that ensure High Availability of Demisto backend databases.
  
• A group of engines that use an algorithm to efficiently share the workload for automation scripts
  
• A group of D2 agents that share processing power across multiple endpoints
  

Which task allows the playbook to follow different paths based on specific conditions?

• Conditional
  
• Automation
  
• Manual
  
• Parallel
  

Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

• firewall alert
  
• SIEM alert
  
• full URL
  
• registry set value
  

When a Demisto Engine is part of a Load-Balancing group it?

• Must be in a Load-Balancing group with at least another 3 members
  
• It must have port 443 open to allow the Demisto Server to establish a connection
  
• Can be used separately as an engine, only if connected to the Demisto Server directly
  
• Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
  

How many use cases should a POC success criteria document include?

• only 1
  
• 3 or more
  
• no more than 5
  
• no more than 2
  

The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

• Cortex XDR Pro per TB
  
• Cortex XDR Prevent
  
• Cortex XDR Endpoint
  
• Cortex XDR Pro Per Endpoint
  

How does an 'inline' auto-extract task affect playbook execution?

• Doesn't wait until the indicators are enriched and continues executing the next step
  
• Doesn't wait until the indicators are enriched but populate context data before executing the next
  
• step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
  
• Wait until the indicators are enriched and populate context data before executing the next step.
  

What are two manual actions allowed on War Room entries? (Choose two.)

• Mark as artifact
  
• Mark as scheduled entry
  
• Mark as note
  
• Mark as evidence