Free PSE-Cortex braindumps download (PSE-Cortex exam dumps Free Updated Mar 06, 2024)
PSE-Cortex Dumps for Pass Guaranteed - Pass PSE-Cortex Exam 2024
NEW QUESTION # 34
A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)
- A. Incident Summary
- B. "New"/Edit" Incident Form
- C. Incident Quick View
- D. "Close" Incident Form
Answer: A,C
NEW QUESTION # 35
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?
- A. SOC analyst IT
- B. operations manager
- C. desktop engineer
- D. SOC manager
Answer: D
NEW QUESTION # 36
When a Demisto Engine is part of a Load-Balancing group it?
- A. It must have port 443 open to allow the Demisto Server to establish a connection
- B. Can be used separately as an engine, only if connected to the Demisto Server directly
- C. Must be in a Load-Balancing group with at least another 3 members
- D. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
Answer: C
NEW QUESTION # 37
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
NEW QUESTION # 38
How does an "inline" auto-extract task affect playbook execution?
- A. Doesn't wait until the indicators are enriched but populate context data before executing the next
- B. Wait until the indicators are enriched and populate context data before executing the next step.
- C. Doesn't wait until the indicators are enriched and continues executing the next step
- D. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
Answer: B
NEW QUESTION # 39
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?
- A. Cortex XDR Pro per TB
- B. Cortex XDR Prevent
- C. Cortex XDR Pro Per Endpoint
- D. Cortex XDR Endpoint
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licenses/migrate-your-cortex-xdr-license
NEW QUESTION # 40
In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?
- A. Vendor
- B. Brand
- C. Type
- D. Using
Answer: A
NEW QUESTION # 41
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
- B. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
Answer: B
NEW QUESTION # 42
Which Cortex XDR capability extends investigations to an endpoint?
- A. Log Stitching
- B. Live Terminal
- C. Causality Chain
- D. Sensors
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-conc
NEW QUESTION # 43
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option B
- B. Option A
- C. Option C
- D. Option D
Answer: D
NEW QUESTION # 44
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
- B. Contact support and ask for a security exception.
- C. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- D. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
Answer: A,C
NEW QUESTION # 45
Which two entities can be created as a BIOC? (Choose two.)
- A. file
- B. event log
- C. registry
- D. alert log
Answer: A,C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xdr-indicators/working-with-biocs/create-a-bioc-rule.html
NEW QUESTION # 46
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. !*
- B. not Contains
- C. =>
- D. < >
Answer: A,B
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-c
NEW QUESTION # 47
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. SIEM alert
- B. firewall alert
- C. full URL
- D. registry set value
Answer: B,D
NEW QUESTION # 48
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified (exploit/windows/browser/ms16_051_vbscript) The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
- A. Option B
- B. Option A
- C. Option C
- D. Option D
Answer: D
NEW QUESTION # 49
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- B. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
- C. enable the docker service
- D. disable the Cortex XSOAR service
Answer: B
NEW QUESTION # 50
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- B. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
- C. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
- D. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
Answer: D
NEW QUESTION # 51
Which Cortex XDR capability extends investigations to an endpoint?
- A. Log Stitching
- B. Live Terminal
- C. Causality Chain
- D. Sensors
Answer: A
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-concepts
NEW QUESTION # 52
......
Verified PSE-Cortex dumps Q&As - Pass Guarantee Exam Dumps Test Engine: https://vceplus.practicevce.com/Palo-Alto-Networks/PSE-Cortex-practice-exam-dumps.html