Pass the Paloalto Networks PSE-Cortex Professional PSE-Cortex-Pro-24 Questions and answers with ValidTests

Exam PSE-Cortex-Pro-24 Premium Access

View all detail and faqs for the PSE-Cortex-Pro-24 exam

Go to Exam

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Questions # 21:

What is a benefit of user entity behavior analytics (UEBA) over security information and event management (SIEM)?

Options:

SIEMs supports only agentless scanning, not agent-based workload protection across VMs, containers/Kubernetes.

UEBA can add trusted signers of Windows or Mac processes to a whitelist in the Endpoint Security Manager (ESM) Console.

SIEMs have difficulty detecting unknown or advanced security threats that do not involve malware, such as credential theft.

UEBA establishes a secure connection in which endpoints can be routed, and it collects and forwards logs and files for analysis.

Expert Solution

Questions # 22:

A Cortex XSOAR customer wants to send a survey to users asking them to input their manager's email for a training use case so the manager can receive status reports on the employee's training. However, the customer is concerned users will provide incorrect information to avoid sending status updates to their manager.

How can Cortex XSOAR most efficiently sanitize user input prior to using the responses in the playbook?

Options:

Create a task that sends the survey responses to the analyst via email. If the responses are incorrect, the analyst fills out the correct response in the survey.

Create a manual task to ask the analyst to validate the survey response in the platform.

Create a sub-playbook and import a list of manager emails into XSOAR. Use a conditional task comparison to check if the response matches an email on the list. If no matches are found, loop the sub-playbook and send the survey back to the user until a match is found.

Create a conditional task comparison to check if the response contains a valid email address.

Expert Solution

Questions # 23:

Which playbook feature allows concurrent execution of tasks?

Options:

parallel tasks

automation tasks

manual tasks

conditional tasks

Expert Solution

Questions # 24:

What does Cortex Xpanse ingest from XDR endpoints?

Options:

MAC addresses

User-agent data

Public IP addresses

Hostnames

Expert Solution

Questions # 25:

What are process exceptions used for?

Options:

whitelist programs from WildFire analysis

permit processes to load specific DLLs

change the WildFire verdict for a given executable

disable an EPM for a particular process

Expert Solution

Questions # 26:

Which feature of Cortex XSIAM displays an entire picture of an attack, including the originating process or delivery point?

Options:

Sample analysis

Correlation rule

Causality View

Automation playbook

Expert Solution

Questions # 27:

An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.

What is the safest way to do it?

Options:

The administrator should attach a copy of the weapomzed flash file to an email, send the email to a selected group of employees, and monitor the Events tab on the Cortex XDR console

The administrator should use the Cortex XDR tray icon to confirm his corporate laptop is fully protected then open the weaponized flash file on his machine, and monitor the Events tab on the Cortex XDR console.

The administrator should create a non-production Cortex XDR test environment that accurately represents the production environment, introduce the weaponized flash file, and monitor the Events tab on the Cortex XDR console.

The administrator should place a copy of the weaponized flash file on several USB drives, scatter them around the office and monitor the Events tab on the Cortex XDR console

Expert Solution

Questions # 28:

The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

Options:

add paloaltonetworks com to the SSL Decryption Exclusion list

enable SSL decryption

disable SSL decryption

reinstall the root CA certificate

Expert Solution

Questions # 29:

Which command is used to add Cortex XSOAR "User1" to an investigation from the War Room command-line interface (CLI)?

Options:

/invite User1

#User1

@User1

!invite User1

Expert Solution

Questions # 30:

A customer wants the main Cortex XSOAR server installed in one site and wants to integrate with three other technologies in a second site.

What communications are required between the two sites if the customer wants to install a Cortex XSOAR engine in the second site?

Options:

The Cortex XSOAR server at the first site must be able to initiate a connection to the Cortex XSOAR engine at the second site.

All connectivity is initiated from the Cortex XSOAR server on the first site via a managed cloud proxy.

Dedicated site-to-site virtual private network (VPN) is required for the Cortex XSOAR server at the first site to initiate a connection to the Cortex XSOAR engine at the second site.

The Cortex XSOAR engine at the first site must be able to initiate a connection to the Cortex XSOAR server at the second site.

Expert Solution

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Pre-Summer Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: validbest

Pass the Paloalto Networks PSE-Cortex Professional PSE-Cortex-Pro-24 Questions and answers with ValidTests

Exam PSE-Cortex-Pro-24 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options: