PSE-Cortex

PSE-Cortex practice questions, page 3 of 5, with answer review and explanations.

Question 11

What allows the use of predetermined Palo Alto Networks roles to assign access rights to Cortex XDR users?

  1. role-based access control (RBAC)
  2. cloud identity engine (CIE)
  3. endpoint groups
  4. restrictions security profile

Question 12

Which two actions are required to add indicators to the whitelist? (Choose two.)

  1. Click "New Whitelisted Indicator" in the Whitelist page.
  2. Upload an external file named "whitelist" to the Whitelist page.
  3. Upload an external file named "whitelist" to the Indicators page.
  4. Select the indicators and click "Delete and Whitelist" in the Indicators page.

Question 13

Which playbook feature allows concurrent execution of tasks?

  1. parallel tasks
  2. automation tasks
  3. manual tasks
  4. conditional tasks

Question 14

Which two Cortex XSOAR incident type features can be customized under Settings > Advanced > Incident Types? (Choose two.)

  1. adding new fields to an incident type
  2. setting reminders for an incident service level agreement (SLA)
  3. defining whether a playbook runs automatically when an incident type is encountered
  4. dropping new incidents of the same type that contain similar information

Question 15

What are two reasons incident investigation is needed in Cortex XDR? (Choose two.)

  1. No solution will stop every attack requiring further investigation of activity.
  2. Insider Threats may not be blocked and initial activity may go undetected.
  3. Analysts need to acquire forensic artifacts of malware that has been blocked by the XDR agent.
  4. Detailed reports are needed for senior management to justify the cost of XDR.