PSE Cortex Professional Practice Test

These questions are part of the practice quiz. Start practicing

• What is the result of creating an exception from an exploit security event?
• What type of data does the Cortex XSOAR "Saved by Dbot" feature primarily analyze?
• What is the significance of programmatic access in PSE Cortex?
• What is the retention requirement for Cortex Data Lake sizing?
• Which of the following is a challenge associated with data integration in PSE Cortex?
• In what way can anomaly detection algorithms benefit a business using PSE Cortex?
• Which three Demisto Incident type features can be customized under Settings > Advanced > Incident Types?
• In Cortex XSOAR, what is the purpose of the War Room?
• Which two items are connected to the Cortex XDR causality chain?
• Which two methods does the Cortex XDR agent use to identify malware during a scheduled scan?
• What benefits do machine learning algorithms provide in PSE Cortex?
• What mechanism allows the assignment of access rights to users in Cortex XDR?
• What action should be taken if Cortex XDR Agents are not communicating with the Management Console?
• Which Cortex XDR capability extends investigations to an endpoint?
• What is a data lake in relation to PSE Cortex?
• A General Purpose Dynamic Section can be added to which two layouts for incident types?
• What role does data visualization play in PSE Cortex?
• What is a significant benefit of using PSE Cortex for process automation?
• In Cortex XSOAR, what feature allows teams to collaborate on investigations effectively?
• An adversary attempts to communicate with malware on a network. What Cortex XDR Analytics alert will this activity likely trigger?
• Which feature is provided by the Indicators of Compromise (IOC) in Cortex XDR?
• In the context of PSE Cortex, what does “data ingestion” refer to?
• What is the size of the free Cortex Data Lake instance provided to a customer who has activated a TMS tenant?
• Which Cortex XDR license is required for endpoint detection and response (EDR) data collection capabilities?
• Which items are used specifically for BIOC identification?
• Which step is required to prepare the virtual desktop infrastructure (VDI) golden image?
• Which of the following best describes the purpose of the Load-Balancing Engine Group?
• Which Linux OS command will manually load Docker images onto the Cortex XSOAR server in an air-gapped environment?
• What is a benefit of user entity behavior analysis (UEBA) over security information and event management (SIEM)?
• Which method is utilized by Cortex XSOAR for managing security incidents efficiently?
• What types of data sources can be connected to PSE Cortex?
• What is stream processing?
• What differentiates a data warehouse from a data lake?
• How does PSE Cortex assist in automating business processes?
• What is the safest way for an admin to test Cortex XDR's ability to protect users from a known flash player exploit?
• What is the result of creating an exception from an exploit security event in Cortex XDR?
• How do collaboration tools within PSE Cortex enhance project outcomes?
• In what way can businesses leverage PSE Cortex for competitive advantage?
• Which two formats are supported by whitelist?
• Which two playbook functionalities allow looping through a group of tasks during playbook execution?
• What type of task allows the playbook to follow different paths based on specific conditions?
• What role does the live terminal play in threat hunting in Cortex XDR?
• Which statement applies to the malware protection flow in Cortex XDR Prevent?
• Which solution profiles network behavior metadata, allowing effective operation regardless of communication protocols?
• The Cortex XDR management service requires which other Palo Alto Networks product?
• What is the correct command to set up a listening address for a meterpreter payload?
• What method blocks a malicious IP address from C2 traffic without needing firewall configuration changes?
• What is the main difference between an exception and an exclusion?
• Where is the output of the task visible when a playbook task errors out?
• Which option describes the primary function of a playbook in Cortex XSOAR?
• Which statement applies to a Cortex XSOAR engine that is part of a load-balancing group?
• Describe a common use case for predictive analytics in PSE Cortex.
• Which integration enables the retrieval and display of SPLUNK results within Cortex XSOAR?
• What is the role of cloud computing in PSE Cortex?
• What is the correct response if a customer wants to integrate a product that Cortex XSOAR currently does not support during a 30-day proof of concept?
• Where can all the relevant incidents for an indicator be viewed?
• What is the most efficient way for Cortex XSOAR to handle separate workflows for phishing and onboarding emails from a single mailbox?
• Which two entities can be created as a behavioral indicator of compromise (BIOC)?
• What does DBot consider when scoring an indicator?
• What functionality does Cortex XDR provide in terms of endpoint protection?
• Which source provides data for Cortex XDR?
• What action allows Cortex XSOAR to access Docker in an air-gapped environment?
• How does PSE Cortex support experimentation in data-driven projects?
• Which task setting allows context output to a specific key?
• In what way does PSE Cortex facilitate A/B testing in marketing?
• Why is updating machine learning models critical in PSE Cortex?
• Why is tracking data lineage important for organizations using PSE Cortex?
• Which two Cortex XSOAR incident type features can be customized under the settings?
• What is the primary function of Cortex XDR?
• What is the purpose of a data schema in PSE Cortex?
• How does DBot score an indicator that has multiple reputation scores?
• If you have a playbook task that errors out, where could you see the output of the task?
• Which type of log is ingested natively in Cortex XDR Pro per TB?
• In an EDR project initiated by a CISO, which resource would likely have the most influence?
• Which two areas of Cortex XDR are used for threat hunting activities?
• What allows the use of predefined roles to assign access rights to Cortex XDR users?
• Which of the following best describes the role of the Cortex SOC Orchestrator?
• What are process exceptions used for in a security context?
• Which programming languages are primarily supported by PSE Cortex?
• How does Cortex XDR Prevent enhance malware protection?
• Which alert type is considered critical for immediate attention in a Cortex XDR environment?
• What is the significance of API management in PSE Cortex?
• Which metrics are important for assessing the effectiveness of analytics initiatives in PSE Cortex?
• Which type of investigations can be conducted using Cortex XDR?
• Which process does the Cortex XDR agent identify as triggering an event sequence?
• In the context of cybersecurity, what does EPM stand for?
• Which Cortex XDR Analytics alert would likely be triggered by an adversary trying to communicate with malware in your network?
• Which log type would be crucial for investigating potential malware breaches?
• How does the Cortex Data Lake enhance the capabilities of Cortex XDR?
• How do machine learning algorithms enhance operations in PSE Cortex?
• Why are ethical considerations important in data analytics with PSE Cortex?
• What does the term “data lineage” refer to in PSE Cortex?
• What are “data silos,” and how do they impact organizations?
• Which integration allows data to be pushed from Cortex XSOAR into Splunk?
• What does the Cortex XSOAR "Saved by Dbot" widget calculate?
• What impact does real-time analytics have on business operations using PSE Cortex?
• Which capability does Cortex XDR provide for data visualization during investigations?
• What is a common application of time series analysis in PSE Cortex?
• Which deployment type supports installation of an engine on Windows, Mac OS, and Linux?
• How does PSE Cortex ensure data security during processing?
• How can data storytelling enhance the use of insights within PSE Cortex?
• Which of the commands can be used to analyze an automated script's behavior in response to changes?
• In network security, what does the term "DNS Tunneling" refer to?
• The customer has indicated they need EDR collection capabilities. Which Cortex XDR license is required?
• What scenario would benefit from using Cortex XSOAR's case management feature?
• How does the PSE Cortex enable real-time data processing?
• What key insight does the ETL process provide in PSE Cortex?
• A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users. What would be the appropriate next step in the playbook?
• What is a key component of configuring a reverse_tcp meterpreter payload?
• Which integration allows searching and displaying Splunk results within Cortex XSOAR?
• Which two log types should be configured for firewall forwarding to the Cortex Data Lake for use by Cortex XDR?
• Why is data governance essential for organizations using PSE Cortex?
• Which process does the Cortex XDR agent identify as triggering an event sequence?
• Which service helps uncover attackers wherever they hide by combining world-class threat hunters with Cortex XDR technology?
• What is one key benefit of using real-time analytics in business decision-making?
• What distinguishes structured data from unstructured data?
• What is an effective strategy for managing log data in Cortex Data Lake?
• Which two items are stitched to the Cortex XDR causality chain?
• When configuring Cortex XDR logging, which log type is crucial for monitoring multiple endpoint events?
• What does feature engineering in data analytics involve?
• Why is reputation scoring important in the Threat Intelligence Module of Cortex XSOAR?
• Which method is commonly used to evaluate data integration challenges in PSE Cortex?
• When integrating with Splunk, what will allow you to push alerts into Cortex XSOAR via the REST API?
• What are some benefits of deploying machine learning models in production with PSE Cortex?
• Which protocol is commonly used for secure communication in a Cortex environment?
• How can PSE Cortex enhance customer segmentation efforts?
• Which component provides a comprehensive view of an attack's root cause or delivery point?
• In Cortex XDR, which role does Managed Threat Hunting (MTH) serve?
• What are two capabilities of a War Room?
• What is the primary function of the PSE Cortex platform?
• What are the key principles of machine learning relevant to PSE Cortex?
• What key benefit does the Cortex XDR platform offer for threat detection?
• How can Cortex XSOAR save time when a phishing incident occurs?
• What is a key benefit of using machine learning within Cortex XSOAR?
• How does an "inline" auto-extract task affect playbook execution?
• What challenge is commonly faced during the implementation of PSE Cortex?
• What makes data lakes advantageous in PSE Cortex?
• Why is continuous learning important in deploying machine learning models with PSE Cortex?
• How does PSE Cortex utilize anomaly detection?
• Which command is used to add "User1" to an investigation from the War Room in Cortex XSOAR?
• What is the command to add a user named "Bob" to an investigation from the War Room CLI?
• How does PSE Cortex approach data integration?
• How is “model accuracy” defined in machine learning?
• Which method allows for the integration of additional services with Cortex XSOAR?
• What steps should an administrator take to confirm false positives in a security event?
• What command is used to add a user to an investigation in the War Room of Cortex XSOAR?
• What is the primary purpose of a threat intelligence management (TIM) list?
• What does the term “Big Data” encompass in PSE Cortex?
• What is a key function of the Cloud Identity Engine (CIE) in Cortex?
• In Cortex XDR Prevent, which three criteria can be used for dynamic endpoint grouping?
• What is a benefit of user entity behavior analytics (UEBA) over security information and event management (SIEM)?
• How do sub-playbooks affect the incident context data in Cortex XDR?
• What type of data is typically classified as unstructured?
• What does the Cortex XSOAR "Saved by DBot" widget calculate?
• Which two playbook functionalities allow looping through a group of tasks during playbook execution?
• During TMS instance activation, which three DNS host names are created?
• How does Cortex XSOAR expedite the handling of a phishing incident?
• What might indicate an issue in integration configuration related to user access?
• Who is the best source for discussing the operational considerations of an antivirus refresh project?
• How can an admin best ensure compliance with security policies?
• Which feature enhances experimentation in data-driven projects with PSE Cortex?
• Which option describes Load-Balancing Engine Group?
• What is the best method to block a malicious IP address involved in command-and-control (C2) traffic without changing the firewall configuration?
• What are two reasons incident investigation is needed in Cortex XDR?
• How does PSE Cortex ensure data governance?
• What connectivity is required between two sites for Cortex XSOAR to function with an engine in a different location?
• Which alert indicates possible data exfiltration or communication with malware?
• Where can a user configure the ratio of storage for each log type in Cortex Data Lake?
• What is a benefit offered by Cortex XSOAR?
• What is a primary way PSE Cortex promotes teamwork among data teams?
• In the DBot context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?
• A customer has purchased Cortex Data Lake storage with the following configuration: Support for 300 Cortex XDR clients forwarding data with 30-day retention. What is the new total storage requirement for 1000 total Cortex XDR clients?
• What is the function of WildFire analysis in Cortex?
• What are common tools used in PSE Cortex for data analysis?
• Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan?
• What does data normalization aim to achieve in PSE Cortex?
• Which entities can be created as a BIOC?
• What could be a reason for exceptions thrown in an automation script?
• What is a use case for natural language processing in PSE Cortex?
• What is a significant factor for user experience in PSE Cortex applications?
• Which two types of indicators of compromise (IOCs) can be created in Cortex XDR?
• What does ETL stand for, and why is it vital in PSE Cortex?
• What role do algorithms play in data science within PSE Cortex?
• What is the purpose of the external dynamic list (EDL) in Cortex XSOAR?
• Which two types of Indicators of Compromise (IOCs) can be created in Cortex XDR?
• Cortex XDR external data ingestion processes ingest data from which sources?
• What is the primary purpose of endpoint management in Cortex XDR?
• What is the effect of data silos in organizations?
• Which two manual actions are allowed on War Room entries?
• How do analytics dashboards contribute to decision-making in PSE Cortex?
• What does model retraining in the context of PSE Cortex involve?
• What is the difference between an exception and an exclusion?
• What role does machine learning play in fraud detection using PSE Cortex?
• Which two statements apply to widgets?
• Which two methods can be used to initiate an on-demand malware scan in Cortex XDR?
• What is the purpose of anomaly detection algorithms in PSE Cortex?
• Which Cortex XDR agent capability prevents loading malicious files from USB-connected removable equipment?
• When a Demisto Engine is part of a Load-Balancing group, it?
• Why is user authentication crucial in PSE Cortex?
• Which method is used for third-party network data consumption?
• Which playbook feature allows concurrent execution of tasks?
• What is the result of creating an exception from an exploit security event?
• What facilitates user adoption of data-driven solutions in PSE Cortex applications?
• Which attack method is designed to gain access through vulnerabilities in the code of an operating system or application?
• What is the function of the "Acknowledge" command in the Cortex XSOAR War Room?
• What should a Cortex XDR Pro administrator do to confirm false positives in a suspicious process creation security event?
• Which statement applies to a Cortex XSOAR engine in a load-balancing group?
• What is a primary goal of PSE Cortex's data integration capabilities?
• What is a key characteristic of unstructured data?
• Which feature allows for automated remediation of incidents in Cortex XSOAR?