Pass4guide PSE-Cortex Dumps PDF - 100% Passing Guarantee
PSE-Cortex Braindumps Real Exam Updated on Nov 01, 2021 with 60 Questions
NEW QUESTION 36
Which two formats are supported by Whitelist? (Choose two)
- A. CSV
- B. CIDR
- C. STIX
- D. Regex
Answer: A,B
NEW QUESTION 37
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, allows parallel task execution.
- B. When set to private, task outputs automatically get written to the root context
- C. When set to global, sub-playbook tasks do not have access to the root context
- D. When set to private, task outputs do not automatically get written to the root context
Answer: C
NEW QUESTION 38
How can you view all the relevant incidents for an indicator?
- A. Related Incidents column in Indicator Screen
- B. Linked Indicators column in Incident Screen
- C. Linked Incidents column in Indicator Screen
- D. Related Indicators column in Incident Screen
Answer: A
NEW QUESTION 39
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
- A. Playbook Tasks
- B. Sub-Play books
- C. Generic Polling Automation Playbook
- D. Playbook Functions
Answer: B,C
NEW QUESTION 40
Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )
- A. Endpoint > Endpoint Management
- B. the local console
- C. Response > Action Center
- D. Telnet
Answer: C,D
NEW QUESTION 41
What is the retention requirement for Cortex Data Lake sizing?
- A. number of endpoints
- B. logs per second
- C. number of days
- D. number of VM-Series NGFW
Answer: C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/set-log-storage-quota
NEW QUESTION 42
How many use cases should a POC success criteria document include?
- A. only 1
- B. 3 or more
- C. no more than 5
- D. no more than 2
Answer: A
NEW QUESTION 43
When a Demisto Engine is part of a Load-Balancing group it?
- A. Can be used separately as an engine, only if connected to the Demisto Server directly
- B. It must have port 443 open to allow the Demisto Server to establish a connection
- C. Must be in a Load-Balancing group with at least another 3 members
- D. Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance
Answer: C
NEW QUESTION 44
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. =
- B. Is Contained By
- C. Contains
- D. < >
Answer: A,C
NEW QUESTION 45
How does an "inline" auto-extract task affect playbook execution?
- A. Wait until the indicators are enriched and populate context data before executing the next step.
- B. Doesn't wait until the indicators are enriched but populate context data before executing the next
- C. Doesn't wait until the indicators are enriched and continues executing the next step
- D. step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
Answer: A
NEW QUESTION 46
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
1 - Navigate to Settings > Advanced > Incident Types
2 - Select the incident type you want to customize the layout view for
3 - Edit the layout
4 - Select the Edit Layout option
5 - Navigate to Settings > Layout Builder
NEW QUESTION 47
How do sub-playbooks affect the Incident Context Data?
- A. When set to global, allows parallel task execution.
- B. When set to private, task outputs automatically get written to the root context
- C. When set to global, sub-playbook tasks do not have access to the root context
- D. When set to private, task outputs do not automatically get written to the root context
Answer: D
NEW QUESTION 48
When analyzing logs for indicators, which are used for only BIOC identification'?
- A. error messages
- B. observed activity
- C. artifacts
- D. techniques
Answer: D
NEW QUESTION 49
Which two items are stitched to the Cortex XDR causality chain'' (Choose two)
- A. registry set value
- B. SIEM alert
- C. firewall alert
- D. full URL
Answer: A,C
NEW QUESTION 50
An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?
- A. The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.
- B. The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console
- C. The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.
- D. The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console
Answer: B
NEW QUESTION 51
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
- A. /invite Bob
- B. !invite Bob
- C. #Bob
- D. @Bob
Answer: C
NEW QUESTION 52
An antivirus refresh project was initiated by the IT operations executive. Who is the best source for discussion about the project's operational considerations'?
- A. endpoint manager
- B. SOC manager
- C. SOC analyst
- D. desktop engineer
Answer: C
NEW QUESTION 53
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)
- A. Playbook Tasks
- B. Sub-Play books
- C. Generic Polling Automation Playbook
- D. Playbook Functions
Answer: B,D
NEW QUESTION 54
Which step is required to prepare the VDI Golden Image?
- A. Review any PE files that WildFire determined to be malicious
- B. Ensure the latest content updates are installed
- C. Set the memory dumps to manual setting
- D. Run the VDI conversion tool
Answer: C
NEW QUESTION 55
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)
- A. domain
- B. IP
- C. endpoint hostname
- D. registry entry
Answer: A,B
NEW QUESTION 56
Given the integration configuration and error in the screenshot what is the cause of the problem?
- A. incorrect server URL
- B. incorrect instance name
- C. incorrect appliance port
- D. incorrect Username and Password
Answer: B
NEW QUESTION 57
Which CLI query would bring back Notable Events from Splunk?
A)
B)
C)
D)
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
NEW QUESTION 58
Which Cortex XDR capability extends investigations to an endpoint?
- A. Live Terminal
- B. Causality Chain
- C. Log Stitching
- D. Sensors
Answer: C
Explanation:
Explanation
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-conc
NEW QUESTION 59
Which two filter operators are available in Cortex XDR? (Choose two.)
- A. not Contains
- B. =>
- C. !*
- D. < >
Answer: A,C
Explanation:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/use-cortex-xdr/manage-tables.html
NEW QUESTION 60
......
PSE-Cortex Dumps With 100% Verified Q&As - Pass Guarantee or Full Refund: https://www.pass4guide.com/PSE-Cortex-exam-guide-torrent.html
Latest PSE-Cortex PDF Dumps & Real Tests Free Updated Today: https://drive.google.com/open?id=1CcDIM9zLsflczHGoLIr4yqW-P7eaDxX5