PSE-Cortex Free Practice Test

How does an "inline" auto-extract task affect playbook execution?

1. A. Doesn't wait until the indicators are enriched and continues executing the next step
2. B. Doesn't wait until the indicators are enriched but populate context data before executing the next
3. C. ste
4. D. Wait until the indicators are enriched but doesn't populate context data before executing the next step.
5. E. Wait until the indicators are enriched and populate context data before executing the next step.

Correct Answer: D

If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

1. A. Live Sensors
2. B. File Explorer
3. C. Log Stitching
4. D. Live Terminal

Correct Answer: D

In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

1. A. Vendor
2. B. Type
3. C. Using
4. D. Brand

Correct Answer: A

Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

1. A. Agent Configuration
2. B. Device Control
3. C. Device Customization
4. D. Agent Management

Correct Answer: B
https://live.paloaltonetworks.com/t5/blogs/cortex-xdr-features-introduced-in-december-2019/ba-p/302231

What are process exceptions used for?

1. A. whitelist programs from WildFire analysis
2. B. permit processes to load specific DLLs
3. C. change the WildFire verdict for a given executable
4. D. disable an EPM for a particular process

Correct Answer: D