Palo Alto Networks System Engineer - Cortex Professional

Question 1

Which two formats are supported by Whitelist? (Choose two)

A. CIDR

B. Regex

C. STIX

D. CSV

Correct Answer: A,B

Question 2

What is the primary function of an engine in Cortex XSOAR?

A. To execute playbooks, scripts, commands, and integrations

B. To manage multiple Cortex XSOAR tenants

C. To store and manage incident data, remediation plans, and documentation

D. To provide a user interface for security analysts

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Which option is required to prepare the VDI Golden Image?

A. Use the Cortex XDR VDI tool to obtain verdicts for all PE files

B. Install the Cortex XOR Agent on the local machine

C. Run the Cortex VDI conversion tool

D. Configure the Golden Image as a persistent VDI

Correct Answer: A

Question 4

A customer wants the main Cortex XSOAR server installed in one site and wants to integrate with three other technologies in a second site.
What communications are required between the two sites if the customer wants to install a Cortex XSOAR engine in the second site?

A. The Cortex XSOAR engine at the first site must be able to initiate a connection to the Cortex XSOAR server at the second site.

B. All connectivity is initiated from the Cortex XSOAR server on the first site via a managed cloud proxy.

C. The Cortex XSOAR server at the first site must be able to initiate a connection to the Cortex XSOAR engine at the second site.

D. Dedicated site-to-site virtual private network (VPN) is required for the Cortex XSOAR server at the first site to initiate a connection to the Cortex XSOAR engine at the second site.

Correct Answer: A

Question 5

Which two entities can be created as a BIOC? (Choose two.)

A. file

B. registry

C. alert log

D. event log

Correct Answer: A,B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

A. Live Terminal

B. Live Sensors

C. Log Stitching

D. File Explorer

Correct Answer: A

Question 7

A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?

A. Go to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota

B. Within the TMS, create an agent settings profile and modify the Disk Quota value

C. It is not possible to configure Cortex Data Lake quota for specific log types.

D. Write a GPO for each endpoint agent to check in less often

Correct Answer: A

Question 8

A Cortex XSOAR customer wants to ingest emails from a single mailbox. The mailbox brings in reported phishing emails and email requests from human resources (HR) to onboard new users. The customer wants to run two separate workflows from this mailbox, one for phishing and one for onboarding.
What will allow Cortex XSOAR to accomplish this in the most efficient way?

A. Use an incident classifier based on a field in each type of email to classify those containing "Phish Alert" in the subject as phishing and those containing "Onboard Request" as onboarding.

B. Use machine learning (ML) to determine incident type.

C. Create two instances of the email integration and classify one instance as ingesting incidents of type phishing and the other as ingesting incidents of type onboarding.

D. Create a playbook to process and determine incident type based on content of the email.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Which Cortex XDR capability extends investigations to an endpoint?

A. Live Terminal

B. Sensors

C. Log Stitching

D. Causality Chain

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which statement applies to the malware protection flow in Cortex XDR Prevent?

A. Hash comparisons come after local static analysis.

B. A trusted signed file is exempt from local static analysis.

C. In the final step, the block list is verified.

D. Local static analysis happens before a WildFire verdict check.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 11

Which technology allows a customer to integrate Cortex Xpanse with third-party applications or services, assets, and IP ranges while leveraging investigation capabilities?

A. REST API
D KPI

B. Webhook

C. POSTMAN

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 12

What method does the Traps agent use to identify malware during a scheduled scan?

A. Local analysis

B. Heuristic analysis

C. WildFire hash comparison and dynamic analysis

D. Signature comparison

Correct Answer: C

Question 13

A Cortex XSOAR customer wants to send a survey to users asking them to input their manager's email for a training use case so the manager can receive status reports on the employee's training. However, the customer is concerned users will provide incorrect information to avoid sending status updates to their manager.
How can Cortex XSOAR most efficiently sanitize user input prior to using the responses in the playbook?

A. Create a task that sends the survey responses to the analyst via email. If the responses are incorrect, the analyst fills out the correct response in the survey.

B. Create a manual task to ask the analyst to validate the survey response in the platform.

C. Create a sub-playbook and import a list of manager emails into XSOAR. Use a conditional task comparison to check if the response matches an email on the list. If no matches are found, loop the sub- playbook and send the survey back to the user until a match is found.

D. Create a conditional task comparison to check if the response contains a valid email address.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 14

What is the primary mechanism for the attribution of attack surface data in Cortex Xpanse?

A. Active scanning with network-installed agents

B. Scanning from public internet data sources

C. Dark web monitoring

D. Customer-provided asset inventory lists

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 15

What is the result of creating an exception from an exploit security event?

A. White lists the process from Wild Fire analysis

B. disables the triggered EPM for the host and process involve

C. exempts administrators from generating alerts for 24 hours

D. exempts the user from generating events for 24 hours

Correct Answer: B

Palo Alto Networks System Engineer - Cortex Professional - PSE-Cortex Exam Practice Test

Latest Update

Useful Links

Contact Us