Palo Alto Networks Certification PSE-Cortex Practice Test Engine Try These 60 Exam Questions [Q12-Q28]

QUESTION 12
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?

QUESTION 13
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation – Step 2 of 2 window.

During the service instance provisioning which three DNS host names are created? (Choose three.)

QUESTION 14
The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

QUESTION 15
Which two filter operators are available in Cortex XDR? (Choose two.)

QUESTION 16
Which task allows the playbook to follow different paths based on specific conditions?

QUESTION 17
A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

QUESTION 18
“Bob” is a Demisto user. Which command is used to add ‘Bob” to an investigation from the War Room CLI?

QUESTION 19
When analyzing logs for indicators, which are used for only BIOC identification’?

QUESTION 20
Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?

QUESTION 21
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

QUESTION 22
What are two manual actions allowed on War Room entries? (Choose two.)

QUESTION 23
When a Demisto Engine is part of a Load-Balancing group it?

QUESTION 24
Which two formats are supported by Whitelist? (Choose two)

QUESTION 25
Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

QUESTION 26
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

QUESTION 27
An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?

QUESTION 28
An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )