A Fully Updated 2025 PSE-Cortex Exam Dumps – PDF Questions and Testing Engine [Q61-Q81]

Rate this post

A Fully Updated 2025 PSE-Cortex Exam Dumps – PDF Questions and Testing Engine

Easy Success Palo Alto Networks PSE-Cortex Exam in First Try

Q61. On a multi-tenanted v6.2 Cortex XSOAR server, which path leads to the server.log for “Tenant1”?

/var/log/demisto/acc_Tenant1/server.log

/var/log/demisto/Tenant1/server.log

/var/lib/demisto/acc_Tenant1/server.log

/var/lib/demisto/server.log

Q62. When initiated, which Cortex XDR capability allows immediate termination of the process or whole process tree on an anomalous process discovered during investigation of a security event?

file explorer

log stitching

live sensors

live terminal

Q63. Which playbook functionality allows grouping of tasks to create functional building blocks?

playbook features

sub-playbooks

conditional tasks

manual tasks

Q64. What does DBot use to score an indicator that has multiple reputation scores?

most severe score

undefined score

average score

least severe score

Reference: https://xsoar.pan.dev/docs/integrations/dbot

Q65. The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS

The modified scnpt was run in the wrong Docker image

The modified script required a different parameter to run successfully.

The dictionary was defined incorrectly in the second script.

The modified script attempted to access a dictionary key that did not exist in the dictionary named “data”

Q66. A Cortex XDR Pro administrator is alerted to a suspicious process creation security event from multiple users who believe these events are false positives.
Which two steps should be taken confirm the false positives and create an exception? (Choose two.)

Within the Malware Security profile, disable the Prevent Malicious Child Process Execution module.

Contact support and ask for a security exception.

Within the Malware Security profile, add the specific parent process, child process, and command line argument to the child process whitelist.

In the Cortex XDR security event, review the specific parent process, child process, and command line arguments.

Q67. What allows the use of predetermined Palo Alto Networks roles to assign access rights to Cortex XDR users?

Restrictions security profile

Cloud identity engine (CIE)

Endpoint groups

role-based access control (RBAC)

Q68. When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?

splunk-get-alerts integration command

Cortex XSOAR TA App for Splunk

SplunkSearch automation

SplunkGO integration

Q69. Which statement applies to a Cortex XSOAR engine that is part of a load-balancing group?

It must be in a load-balancing group with at least three additional members.

It must have port 443 open to allow the XSOAR server to establish a connection.

It does not appear in the in the engine drop-down menu when configuring an integration instance.

It can be used separately as an engine only if directly connected to the XSOAR server.

Q70. Which statement applies to the differentiation of Cortex XDR from security information and event management (SIEM)?

SIEM has access to raw logs from agents, where Cortex XDR traditionally only gets alerts.

Cortex XDR allows just logging into the console and out of the box the events were blocked as a proactive approach.

Cortex XDR requires a large and diverse team of analysts and up to several weeks for simple actions like creating an alert.

SIEM has been entirely designed and built as cloud-native, with the ability to stitch together cloud logs, on-premises logs, third-party logs, and endpoint logs.

Q71. What does DBot use to score an indicator that has multiple reputation scores?

most severe score scores

undefined score

average score

least severe score

Q72. Approximately how many Cortex XSOAR marketplace integrations exist?

Between 1-400

Between 400-700

Between 700-2000

Over 2000

There are between 700-2000 integrations available on the Cortex XSOAR marketplace. This extensive range of integrations allows users to connect with various third-party applications, services, and tools, helping to automate and streamline security operations.

Q73. What is the primary purpose of Cortex XSIAM’s machine learning led design?

To group alerts into incidents for manual analysis

To facilitate alert and log management without automation

To effectively handle the bulk of incidents through automation

To rely heavily on human-driven detection and remediation

Q74. What is a benefit offered by Cortex XSOAR?

It provides advanced customization capabilities.

It provides real-time protection across hosts and containers.

It enables consolidation of multiple point products into a single integrated service.

It enables a comprehensive view of the customer environment with regard to digital employee productivity.

Reference: https://www.exclusive-networks.com/uk/wp-content/uploads/sites/28/2021/07/cortex-xsoar- DATASHEET.pdf

Q75. What is the retention requirement for Cortex Data Lake sizing?

number of endpoints

number of VM-Series NGFW

number of days

logs per second

Explanation
https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-corte

Q76. An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

With the Malware Security profile, disable the “Prevent Malicious Child Process Execution” module

Within the Malware Security profile add the specific parent process, child process, and command line argument to the child process whitelist

In the Cortex XDR security event, review the specific parent process, child process, and command line arguments

Contact support and ask for a security exception.

Q77. Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR? (Choose two)

Security Event

HIP

Correlation

Analytics

Q78. Which solution profiles network behavior metadata, not payloads and files, allowing effective operation regardless of encrypted or unencrypted communication protocols, like HTTPS?

endpoint protection platform (EPP)

Security Information and Event Management (SIEM)

endpoint detection and response (EDR)

Network Detection and Response (NDR)

Q79. If you have a playbook task that errors out. where could you see the output of the task?

/var/log/messages

War Room of the incident

Demisto Audit log

Playbook Editor

Q80. Which task setting allows context output to a specific key?

extend context

stop on errors