Palo Alto Networks System Engineer Professional - Cortex Exam Questions

Here you have the best Palo Alto Networks PSE-Cortex practice exam questions.

Some things you may want to keep in mind about this practice exam questions:

You have 38 total questions to study from
Each page has 5 questions, making a total of 8 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on September 13, 2024

Question 1 of 38

What does the Cortex XSOAR "Saved by Dbot" widget calculate?

A.

amount saved in Dollars according to actions carried out by all users in Cortex XSOAR across all incidents

B.

amount saved in Dollars by using Cortex XSOAR instead of other products

C.

amount of time saved by each playbook task within an incident

D.

amount of time saved by Dbot's machine learning (ML) capabilities

Correct Answer: D

The Cortex XSOAR 'Saved by Dbot' widget calculates the amount of time saved by Dbot's machine learning (ML) capabilities. This widget helps to understand the efficiency and time-optimization benefits gained from the automation and intelligence provided by Dbot within the Cortex XSOAR platform.

Question 2 of 38

How do sub-playbooks affect the Incident Context Data?

A.

When set to private, task outputs do not automatically get written to the root context.

B.

When set to global, sub-playbook tasks do not have access to the root context.

C.

When set to global, parallel task execution is allowed.

D.

When set to private, task outputs are automatically written to the root context.

Correct Answer: A

When a sub-playbook is set to private, task outputs do not automatically get written to the root context. This means that the outputs from the tasks within the sub-playbook are isolated and will not interfere with or modify the main incident context data directly. This mechanism helps to control the scope and impact of the playbook’s execution, ensuring that only relevant data is shared with the root context as needed.

Question 3 of 38

Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)

A.

playbook functions

B.

sub-playbooks

C.

GenericPolling playbooks

D.

playbook tasks

Correct Answer: CD

GenericPolling playbooks are designed to repeatedly execute a set of tasks until a specific condition is met, allowing continuous monitoring or periodic checks as needed. Playbook tasks can be configured with conditions to loop through a group of tasks based on previous task outcomes, facilitating repeated executions within the same playbook. Thus, both options fulfill the requirement of allowing looping through a group of tasks during playbook execution.

Question 4 of 38

Cortex XSOAR has extracted a malicious Internet Protocol (IP) address involved in command-and-control (C2) traffic.

What is the best method to block this IP from communicating with endpoints without requiring a configuration change on the firewall?

A.

Have XSOAR automatically add the IP address to a threat intelligence management (TIM) malicious IP list to elevate priority of future alerts.

B.

Have XSOAR automatically add the IP address to a deny rule in the firewall.

C.

Have XSOAR automatically add the IP address to an external dynamic list (EDL) used by the firewall.

D.

Have XSOAR automatically create a NetOps ticket requesting a configuration change to the firewall to block the IP.

Correct Answer: C

The best method to block an IP address involved in command-and-control (C2) traffic without requiring a configuration change on the firewall is to have XSOAR automatically add the IP address to an external dynamic list (EDL) used by the firewall. EDLs are lists that can be dynamically updated and referenced by firewall policies to block or allow traffic. This method allows the firewall to automatically update its blocking rules based on the latest threat intelligence without needing manual configuration changes.

Question 5 of 38

Which integration allows searching and displaying Splunk results within Cortex XSOAR?

A.

SplunkPY integration

B.

Demisto App for Splunk integration

C.

XSOAR REST API integration

D.

Splunk integration

Correct Answer: D

The correct integration for searching and displaying Splunk results within Cortex XSOAR is the Splunk integration. The Splunk integration in Cortex XSOAR is designed to interact with Splunk, allowing users to search for data and fetch results directly from Splunk into Cortex XSOAR. While other integrations might exist, they serve different purposes or functionalities that are not specifically about searching and displaying Splunk results within Cortex XSOAR.