PSE-Cortex Free Practice Test

If you have a playbook task that errors out. where could you see the output of the task?

1. A. /var/log/messages
2. B. War Room of the incident
3. C. Demisto Audit log
4. D. Playbook Editor

Correct Answer: B

In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )

1. A. alert root cause
2. B. hostname
3. C. domain/workgroup membership
4. D. OS
5. E. presence of Flash executable

Correct Answer: BCD

Which two entities can be created as a BIOC? (Choose two.)

1. A. file
2. B. registry
3. C. event log
4. D. alert log

Correct Answer: AB
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/cortex-xd

How do sub-playbooks affect the Incident Context Data?

1. A. When set to private, task outputs do not automatically get written to the root context
2. B. When set to private, task outputs automatically get written to the root context
3. C. When set to global, allows parallel task execution.
4. D. When set to global, sub-playbook tasks do not have access to the root context

Correct Answer: A

Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)

1. A. Security Event
2. B. HIP
3. C. Correlation
4. D. Analytics

Correct Answer: AB