PSE-CORTEX Online Practice Questions and Answers

The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console.What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

A. add paloaltonetworks.com to the SSL Decryption Exclusion list

B. enable SSL decryption

C. disable SSL decryption

D. reinstall the root CA certificate

What is the result of creating an exception from an exploit security event?

A. White lists the process from Wild Fire analysis

B. exempts the user from generating events for 24 hours

C. exempts administrators from generating alerts for 24 hours

D. disables the triggered EPM for the host and process involve

Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)

A. Security Event

B. HIP

C. Correlation

D. Analytics

How do sub-playbooks affect the Incident Context Data?

A. When set to private, task outputs do not automatically get written to the root context

B. When set to private, task outputs automatically get written to the root context

C. When set to global, allows parallel task execution.

D. When set to global, sub-playbook tasks do not have access to the root context

What method does the Traps agent use to identify malware during a scheduled scan?

A. Heuristic analysis

B. Local analysis

C. Signature comparison

D. WildFire hash comparison and dynamic analysis

The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

A. Cortex XDR Pro per TB

B. Cortex XDR Prevent

C. Cortex XDR Endpoint

D. Cortex XDR Pro Per Endpoint

An Administrator is alerted to a Suspicious Process Creation security event from multiple users.

The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

A. With the Malware Security profile, disable the "Prevent Malicious Child Process Execution" module

B. Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist

C. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments

D. Contact support and ask for a security exception.

Which step is required to prepare the VDI Golden Image?

A. Review any PE files that WildFire determined to be malicious

B. Ensure the latest content updates are installed

C. Run the VDI conversion tool

D. Set the memory dumps to manual setting

Which CLI query would bring back Notable Events from Splunk?

A. ! splunk-search query=" `notable` | head 3"

B. ! splunk-search query=" 'notable' | head 3"

C. ! splunk-search query="*"

D. ! splunk-search query="* | head 3"

What is the retention requirement for Cortex Data Lake sizing?

A. number of endpoints

B. number of VM-Series NGFW

C. number of days

D. logs per second