PSE-Cortex Braindumps Real Exam Updated on Apr 09, 2022 with 60 Questions [Q19-Q40]

Rate this post

PSE-Cortex Braindumps Real Exam Updated on Apr 09, 2022 with 60 Questions

Latest PSE-Cortex PDF Dumps & Real Tests Free Updated Today

NO.19 The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS

The modified scnpt was run in the wrong Docker image

The modified script required a different parameter to run successfully.

The dictionary was defined incorrectly in the second script.

The modified script attempted to access a dictionary key that did not exist in the dictionary named
“data”

NO.20 Which step is required to prepare the VDI Golden Image?

Review any PE files that WildFire determined to be malicious

Ensure the latest content updates are installed

Run the VDI conversion tool

Set the memory dumps to manual setting

NO.21 Which step is required to prepare the VDI Golden Image?

Review any PE files that WildFire determined to be malicious

Ensure the latest content updates are installed

Run the VDI conversion tool

Set the memory dumps to manual setting

NO.22 If you have a playbook task that errors out. where could you see the output of the task?

/var/log/messages

War Room of the incident

Demisto Audit log

Playbook Editor

NO.23 Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )

Response > Action Center

the local console

Telnet

Endpoint > Endpoint Management

NO.24 A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

Extend the POC window to allow the solution architects to build it

Tell them we can build it with Professional Services.

Tell them custom integrations are not created as part of the POC

Agree to build the integration as part of the POC

NO.25 How does DBot score an indicator that has multiple reputation scores?

uses the most severe score scores

the reputation as undefined

uses the average score

uses the least severe score

NO.26 How can you view all the relevant incidents for an indicator?

Linked Incidents column in Indicator Screen

Linked Indicators column in Incident Screen

Related Indicators column in Incident Screen

Related Incidents column in Indicator Screen

NO.27 When a Demisto Engine is part of a Load-Balancing group it?

Must be in a Load-Balancing group with at least another 3 members

It must have port 443 open to allow the Demisto Server to establish a connection

Can be used separately as an engine, only if connected to the Demisto Server directly

Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance

NO.28 An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

With the Malware Security profile, disable the “Prevent Malicious Child Process Execution” module

Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist

In the Cortex XDR security event, review the specific parent process, child process, and command line arguments

Contact support and ask for a security exception.

NO.29 An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?

desktop engineer

SOC manager

SOC analyst IT

operations manager

NO.30 Which two items are stitched to the Cortex XDR causality chain” (Choose two)

firewall alert

SIEM alert

full URL

registry set value

NO.31 Which two filter operators are available in Cortex XDR? (Choose two.)

< >

Contains

Is Contained By

NO.32 A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

“Close” Incident Form

Incident Summary

Incident Quick View

“New”/Edit” Incident Form

NO.33 If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?

1 TB

10 GB

100 GB

10 TB

NO.34 Which two formats are supported by Whitelist? (Choose two)

Regex

STIX

CSV

CIDR

NO.35 How many use cases should a POC success criteria document include?

only 1

3 or more

no more than 5

no more than 2

NO.36 Whichfour types of Traps logs are stored within Cortex Data Lake?

Threat, Config, System,Data

Threat, Config, System, Analytic

Threat, Monitor. System, Analytic

Threat, Config, Authentication, Analytic

NO.37 Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

Agent Configuration

Device Control

Device Customization

Agent Management

https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231

NO.38 Which task allows the playbook to follow different paths based on specific conditions?

Conditional

Automation

Manual

Parallel

NO.39 A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

Extend the POC window to allow the solution architects to build it

Tell them we can build it with Professional Services.

Tell them custom integrations are not created as part of the POC

Agree to build the integration as part of the POC

NO.40 Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?

RPM

DEB

ZIP

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/engines/install-deploy-and-configure-demisto-engines/create-a-new-engine.html

Loading …