PSE-Cortex

PSE-Cortex practice questions, page 2 of 5, with answer review and explanations.

Question 6

Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)

  1. playbook functions
  2. sub-playbooks
  3. GenericPolling playbooks
  4. playbook tasks

Question 7

Cortex XSOAR has extracted a malicious Internet Protocol (IP) address involved in command-and-control (C2) traffic. What is the best method to block this IP from communicating with endpoints without requiring a configuration change on the firewall?

  1. Have XSOAR automatically add the IP address to a threat intelligence management (TIM) malicious IP list to elevate priority of future alerts.
  2. Have XSOAR automatically add the IP address to a deny rule in the firewall.
  3. Have XSOAR automatically add the IP address to an external dynamic list (EDL) used by the firewall.
  4. Have XSOAR automatically create a NetOps ticket requesting a configuration change to the firewall to block the IP.

Question 8

Which integration allows searching and displaying Splunk results within Cortex XSOAR?

  1. SplunkPY integration
  2. Demisto App for Splunk integration
  3. XSOAR REST API integration
  4. Splunk integration

Question 9

Which two types of indicators of compromise (IOCs) are available for creation in Cortex XDR? (Choose two.)

  1. registry
  2. file path
  3. hash
  4. hostname

Question 10

A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users. What would be the appropriate next step in the playbook?

  1. Email the CISO to advise that malicious email was found.
  2. Disable the user's email account.
  3. Email the user to confirm the reported email was phishing.
  4. Change the user's password.