Prepare With Top Rated High-quality PSE-Cortex Dumps For Success in PSE-Cortex Exam
PSE-Cortex Free Certification Exam Easy to Download PDF Format 2023
NEW QUESTION 34
The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS
- A. The modified scnpt was run in the wrong Docker image
- B. The dictionary was defined incorrectly in the second script.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data" - D. The modified script required a different parameter to run successfully.
Answer: A
NEW QUESTION 35
What are process exceptions used for?
- A. whitelist programs from WildFire analysis
- B. change the WildFire verdict for a given executable
- C. permit processes to load specific DLLs
- D. disable an EPM for a particular process
Answer: A
NEW QUESTION 36
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Playbook Tasks
- B. Playbook Functions
- C. Sub-Play books
- D. Generic Polling Automation Playbook
Answer: B,C
NEW QUESTION 37
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. artifacts
- B. observed activity
- C. error messages
- D. techniques
Answer: B
NEW QUESTION 38
Which two formats are supported by Whitelist? (Choose two)
- A. CSV
- B. STIX
- C. CIDR
- D. Regex
Answer: C,D
NEW QUESTION 39
In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?
- A. enable the docker service
- B. create a "Cortex XSOAR' or "demisto" group and add the "docker" user to this group
- C. disable the Cortex XSOAR service
- D. create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group
Answer: D
NEW QUESTION 40
What is the result of creating an exception from an exploit security event?
- A. White lists the process from Wild Fire analysis
- B. exempts the user from generating events for 24 hours
- C. disables the triggered EPM for the host and process involve
- D. exempts administrators from generating alerts for 24 hours
Answer: C
NEW QUESTION 41
If you have a playbook task that errors out. where could you see the output of the task?
- A. Playbook Editor
- B. /var/log/messages
- C. War Room of the incident
- D. Demisto Audit log
Answer: A
NEW QUESTION 42
How do sub-playbooks affect the Incident Context Data?
- A. When set to private, task outputs automatically get written to the root context
- B. When set to private, task outputs do not automatically get written to the root context
- C. When set to global, sub-playbook tasks do not have access to the root context
- D. When set to global, allows parallel task execution.
Answer: B
NEW QUESTION 43
How many use cases should a POC success criteria document include?
- A. no more than 2
- B. 3 or more
- C. only 1
- D. no more than 5
Answer: A
NEW QUESTION 44
Which task allows the playbook to follow different paths based on specific conditions?
- A. Conditional
- B. Automation
- C. Manual
- D. Parallel
Answer: A
NEW QUESTION 45
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. /invite Bob
- B. @Bob
- C. !invite Bob
- D. #Bob
Answer: D
NEW QUESTION 46
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect Username and Password
- B. incorrect server URL
- C. incorrect appliance port
- D. incorrect instance name
Answer: D
NEW QUESTION 47
How can you view all the relevant incidents for an indicator?
- A. Linked Indicators column in Incident Screen
- B. Related Indicators column in Incident Screen
- C. Related Incidents column in Indicator Screen
- D. Linked Incidents column in Indicator Screen
Answer: C
NEW QUESTION 48
An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?
- A. Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool
- B. Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities
- C. Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities
- D. Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool
Answer: B
NEW QUESTION 49
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. endpoint hostname
- B. IP
- C. registry entry
- D. domain
Answer: B,D
NEW QUESTION 50
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )
- A. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist
- B. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module
- C. Contact support and ask for a security exception.
- D. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
Answer: C
NEW QUESTION 51
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?
- A. Cortex XDR Endpoint
- B. Cortex XDR Prevent
- C. Cortex XDR Pro Per Endpoint
- D. Cortex XDR Pro per TB
Answer: A
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licen
NEW QUESTION 52
An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?
- A. Malware
- B. Uncommon Local Scheduled Task Creation
- C. DNS Tunneling
- D. New Administrative Behavior
Answer: A
NEW QUESTION 53
......
Get 100% Success with Latest Palo Alto Networks Certification PSE-Cortex Exam Dumps: https://www.dumpsvalid.com/PSE-Cortex-still-valid-exam.html
The Best PSE-Cortex Exam Study Material and Preparation Test Question Dumps: https://drive.google.com/open?id=1KkPe87WnsB_F7x6xcgb3LoyH0h5aC4uo