PSE-Cortex practice test

1. Question 1 · 1

   What does the Cortex XSOAR "Saved by Dbot" widget calculate?

   Choose one answer.

   • amount saved in Dollars according to actions carried out by all users in Cortex XSOAR across all incidents
   • amount saved in Dollars by using Cortex XSOAR instead of other products
   • amount of time saved by each playbook task within an incident
   • amount of time saved by Dbot's machine learning (ML) capabilities

2. Question 2 · 1

   A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users. What would be the appropriate next step in the playbook?

   Choose one answer.

   • Email the CISO to advise that malicious email was found.
   • Disable the user's email account.
   • Email the user to confirm the reported email was phishing.
   • Change the user's password.

3. Question 3 · 1

   A customer has purchased Cortex XDR and requires phone support for the product. Which Palo Alto Networks offering would fulfill this need?

   Choose one answer.

   • Platinum Success
   • Premium Success
   • Diamond Success
   • Standard Success

4. Question 4 · 1

   What allows the use of predetermined Palo Alto Networks roles to assign access rights to Cortex XDR users?

   Choose one answer.

   • role-based access control (RBAC)
   • cloud identity engine (CIE)
   • endpoint groups
   • restrictions security profile

5. Question 5 · 1

   Which two actions are required to add indicators to the whitelist? (Choose two.)

   Choose all answers that apply.

   • Click "New Whitelisted Indicator" in the Whitelist page.
   • Upload an external file named "whitelist" to the Whitelist page.
   • Upload an external file named "whitelist" to the Indicators page.
   • Select the indicators and click "Delete and Whitelist" in the Indicators page.

6. Question 6 · 1

   Which playbook feature allows concurrent execution of tasks?

   Choose one answer.

   • parallel tasks
   • automation tasks
   • manual tasks
   • conditional tasks

7. Question 7 · 1

   Which two Cortex XSOAR incident type features can be customized under Settings > Advanced > Incident Types? (Choose two.)

   Choose all answers that apply.

   • adding new fields to an incident type
   • setting reminders for an incident service level agreement (SLA)
   • defining whether a playbook runs automatically when an incident type is encountered
   • dropping new incidents of the same type that contain similar information

8. Question 8 · 1

   What are two reasons incident investigation is needed in Cortex XDR? (Choose two.)

   Choose all answers that apply.

   • No solution will stop every attack requiring further investigation of activity.
   • Insider Threats may not be blocked and initial activity may go undetected.
   • Analysts need to acquire forensic artifacts of malware that has been blocked by the XDR agent.
   • Detailed reports are needed for senior management to justify the cost of XDR.

9. Question 9 · 1

   Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

   Choose one answer.

   • causality group owner
   • chain's alert initiator
   • adversary's remote process
   • relevant shell

10. Question 10 · 1

    Which two statements apply to widgets? (Choose two.)

    Choose all answers that apply.

    • All widgets are customizable.
    • Dashboards cannot be shared across an organization.
    • A widget can have its own time range that is different from the rest of the dashboard.
    • Some widgets cannot be changed.

11. Question 11 · 1

    Which source provides data for Cortex XDR?

    Choose one answer.

    • VMware NSX
    • Amazon Alexa rank indicator
    • Cisco ACI
    • Linux endpoints

12. Question 12 · 1

    Which two manual actions are allowed on War Room entries? (Choose two.)

    Choose all answers that apply.

    • mark as note
    • mark as scheduled entry
    • mark as evidence
    • mark as artifact

13. Question 13 · 1

    Which Cortex XDR agent capability prevents loading malicious files from USB-connected removable equipment?

    Choose one answer.

    • agent management
    • device control
    • agent configuration
    • device customization

14. Question 14 · 1

    What does DBot use to score an indicator that has multiple reputation scores?

    Choose one answer.

    • most severe score
    • undefined score
    • average score
    • least severe score

15. Question 15 · 1

    Which statement applies to a Cortex XSOAR engine that is part of a load-balancing group?

    Choose one answer.

    • It must be in a load-balancing group with at least three additional members.
    • It must have port 443 open to allow the XSOAR server to establish a connection.
    • It does not appear in the in the engine drop-down menu when configuring an integration instance.
    • It can be used separately as an engine only if directly connected to the XSOAR server.

Paid access to all 45 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.