BEST Verified Palo Alto Networks PSE-Cortex Exam Questions (2023) [Q11-Q30]

NO.11 Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)

NO.12 What are two manual actions allowed on War Room entries? (Choose two.)

NO.13 Which Cortex XDR capability extends investigations to an endpoint?

NO.14 A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

NO.15 Rearrange the steps into the correct order for modifying an incident layout.

NO.16 If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?

NO.17 Given the integration configuration and error in the screenshot what is the cause of the problem?

NO.18 A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?

NO.19 Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

NO.20 Which two types of lOCs are available for creation in Cortex XDR? (Choose two.)

NO.21 Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types?
(Choose three.)

NO.22 Cortex XDR can schedule recurring scans of endpoints for malware. Identify two methods for initiating an on-demand malware scan (Choose two )

NO.23 How can you view all the relevant incidents for an indicator?

NO.24 What are two manual actions allowed on War Room entries? (Choose two.)

NO.25 Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?

Which two playbook functionalities allow looping through a group of tasks during playbook execution?
(Choose two.)

NO.26 Which two filter operators are available in Cortex XDR? (Choose two.)

NO.27 A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

NO.28 If you have a playbook task that errors out. where could you see the output of the task?

NO.29 What is the difference between an exception and an exclusion?

NO.30 Which step is required to prepare the VDI Golden Image?