Get Mar-2026 Dumps to Pass your PSE-Cortex Exam with 100% Real Questions and Answers
Updated Exam PSE-Cortex Dumps with New Questions
The PSE-Cortex exam is designed to assess the knowledge, skills, and expertise of system engineers who work with the Cortex platform. PSE-Cortex exam covers a range of topics, including Cortex architecture, threat intelligence, automation, orchestration, and integration with other security products. By passing the exam, system engineers can demonstrate their expertise in the Cortex platform and their ability to help organizations implement effective security solutions.
NEW QUESTION # 56
Which Cortex XDR capability allows for the immediate termination of a process discovered during investigation of a security event?
- A. live sensor
- B. live terminal
- C. file explorer
- D. Log stitching
Answer: B
Explanation:
Reference: https://xsoar.pan.dev/docs/reference/playbooks/cortex-xdr---kill-process
NEW QUESTION # 57
Which Cortex XDR capability prevents running malicious files from USB-connected removable equipment?
- A. Agent management
- B. Agent configuration
- C. Restrictions profile
- D. Device customization
Answer: C
Explanation:
The Restrictions profile in Cortex XDR is used to prevent running malicious files from USB-connected removable equipment. This capability helps enhance endpoint security by blocking the execution of unauthorized or malicious files from external devices such as USB drives, reducing the risk of malware spreading through these vectors.
NEW QUESTION # 58
Which feature of Cortex Xpanse allows it to identify previously unknown assets?
- A. Scheduled network scanning
- B. Dynamic asset registration
- C. Continuous internet scanning
- D. Active directory enumeration
Answer: C
NEW QUESTION # 59
Rearrange the steps into the correct order for modifying an incident layout.
Answer:
Explanation:
Explanation:
Correct
NEW QUESTION # 60
In addition to migration and go-live, what are two best-practice steps for migrating from SIEM to Cortex XSIAM? (Choose two.)
- A. Testing
- B. Certification
- C. Execution
- D. Conclusion
Answer: A,D
NEW QUESTION # 61
What does the Cortex XSOAR "Saved by Dbot" widget calculate?
- A. amount of time saved by Dbot's machine learning (ML) capabilities
- B. amount saved in Dollars by using Cortex XSOAR instead of other products
- C. amount of time saved by each playbook task within an incident
- D. amount saved in Dollars according to actions carried out by all users in Cortex XSOAR across all incidents
Answer: D
NEW QUESTION # 62
Why is Premium Customer Success an important part of any Cortex bill of materials?
- A. It provides managed threat hunting.
- B. It provides instructor-led training courses.
- C. It provides expert-led configuration guidance.
- D. It provides full implementation services.
Answer: C
NEW QUESTION # 63
Which service helps uncover attackers wherever they hide by combining world-class threat hunters with Cortex XDR technology that runs on integrated endpoint, network, and cloud data sources?
- A. virtual desktop infrastructure (VDI)
- B. Managed Threat Hunting (MTH)
- C. Cloud Identity Engine (CIE)
- D. Threat Intelligence Platform (TIP)
Answer: B
NEW QUESTION # 64
How does the integration between Cortex Xpanse and Cortex XSOAR benefit security teams?
- A. By enabling automatic incident response actions for internet-based incidents
- B. By enhancing firewall rule management
- C. By providing real-time threat intelligence feeds
- D. By automating endpoint detection and response (EDR) processes
Answer: A
Explanation:
The integration between Cortex Xpanse and Cortex XSOAR benefits security teams by enabling automatic incident response actions for internet-based incidents. This integration allows security teams to automate the detection, investigation, and response to threats identified through internet-facing assets, improving efficiency and reducing response time.
NEW QUESTION # 65
A customer is hesitant to directly connect their network to the Cortex platform due to compliance restrictions.
Which deployment method should the customer use to ensure secure connectivity between their network and the Cortex platform?
- A. Syslog collector
- B. Elasticsearch
- C. Broker VM
- D. Windows Event Collector
Answer: C
NEW QUESTION # 66
A customer has purchased Cortex Data Lake storage with the following configuration, which requires 2 TB of Cortex Data Lake to order:
support for 300 total Cortex XDR clients all forwarding Cortex XDR data with 30-day retention storage for higher fidelity logs to support Cortex XDR advanced analytics The customer now needs 1000 total Cortex XDR clients, but continues with 300 clients forwarding Cortex XDR data with 30-day retention.
What is the new total storage requirement for Cortex Data Lake storage to order?
- A. 4 TB
- B. 8 TB
- C. 16 TB
- D. 2 TB
Answer: D
Explanation:
Cortex Data Lake (now known as Strata Logging Service in some contexts, but still referred to as Cortex Data Lake for XDR purposes) is the cloud-based storage solution that supports Cortex XDR by storing endpoint telemetry, logs, and analytics data. The customer's storage needs depend on the number of Cortex XDR clients, the subset forwarding data, the retention period, and the type of data stored (e.g., higher fidelity logs for advanced analytics). Let's break down the problem step-by-step to determine the new storage requirement.
Initial Configuration:
* Total Cortex XDR Clients: 300
* Clients Forwarding Cortex XDR Data: 300 (all clients are forwarding data)
* Retention Period: 30 days
* Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics
* Initial Storage Ordered: 2 TB
This configuration implies that 2 TB was sufficient to support 300 clients, all forwarding data, with a 30-day retention period, including the additional storage needed for advanced analytics logs.
New Configuration:
* Total Cortex XDR Clients: 1,000
* Clients Forwarding Cortex XDR Data: 300 (unchanged from the initial setup)
* Retention Period: 30 days (unchanged)
* Additional Requirement: Storage for higher fidelity logs to support Cortex XDR advanced analytics (unchanged) The key change is the increase in total Cortex XDR clients from 300 to 1,000, but the number of clients forwarding data remains 300, and the retention period and analytics requirements are unchanged. We need to determine how this affects the storage requirement.
Cortex Data Lake Storage Sizing for Cortex XDR:
Palo Alto Networks provides sizing guidelines for Cortex Data Lake based on the number of endpoints forwarding data, the retention period, and the type of data stored. The storage requirement is primarily driven by:
* Clients Forwarding Data: Only the endpoints actively sending telemetry to Cortex Data Lake (e.g., Cortex XDR Pro endpoints with enhanced data collection) contribute significantly to storage needs.
* Retention Period: The number of days data is retained directly scales the storage requirement.
* Data Type: Higher fidelity logs for advanced analytics (e.g., XDR Pro features like behavioral analytics) increase storage per endpoint compared to basic logs.
* Cortex XDR Prevent: Provides basic endpoint protection with minimal data forwarding (e.g., alerts only), typically included in a 30-day retention baseline with minimal storage impact.
* Cortex XDR Pro: Includes enhanced endpoint data collection (e.g., process execution, network activity) for advanced analytics, significantly increasing storage needs when enabled.
The problem states that all 300 initial clients were forwarding data, and the same 300 continue to do so in the new setup, with support for advanced analytics. This suggests these are likely Cortex XDR Pro clients, as Pro is required for full telemetry and analytics capabilities.
Storage Calculation:
Palo Alto Networks doesn't publish exact per-endpoint storage figures publicly, but we can infer the requirement from the initial configuration and industry benchmarks:
* Initial Setup (300 Clients, 30 Days, 2 TB):
* 2 TB supports 300 clients forwarding data for 30 days with advanced analytics.
* Per client, this approximates to:2 TB÷300 clients=0.00667 TB/client2 \, \text{TB} \div 300 \, \text
{clients} = 0.00667 \, \text{TB/client} 2TB÷300clients=0.00667TB/client or 6.67 GB per client for 30 days with higher fidelity logs.
* This aligns with typical XDR Pro storage estimates, where enhanced data collection (e.g., 5-10 GB per endpoint per 30 days) is common depending on activity levels and analytics features.
* New Setup (1,000 Total Clients, 300 Forwarding, 30 Days):
* Clients Forwarding Data: Still 300, unchanged.
* Retention: Still 30 days, unchanged.
* Analytics Logs: Still required, unchanged.
* Storage is driven by the 300 clients forwarding data, not the total number of clients. The additional 700 clients (1,000 - 300 = 700) are not forwarding data, suggesting they might be on Cortex XDR Prevent licenses or not fully activated for data collection, contributing negligible storage (e.g., only alerts, which are minimal).
Thus, the storage requirement remains:
300clients×6.67GB/client=2,001GB#2TB
References:
Cortex XDR Documentation: Indicates that storage is calculated based on endpoints with data collection enabled, not total agents (e.g., docs-cortex.paloaltonetworks.com).
Cortex Data Lake Sizing: Palo Alto's sizing tools (e.g., Strata Logging Service Estimator) emphasize active data sources and retention, not total licenses.
Industry Norms: XDR solutions typically require 5-15 GB per endpoint per 30 days for advanced analytics, consistent with the 2 TB for 300 clients.
NEW QUESTION # 67
The images show two versions of the same automation script and the results they produce when executed in Demisto.
What are two possible causes of the exception thrown in the second Image? (Choose two.)
- A. The modified scnpt was run in the wrong Docker image.
- B. The dictionary was defined incorrectly in the second script.
- C. The modified script attempted to access a dictionary key that did not exist in the dictionary named
"data". - D. The modified script required a different parameter to run successfully.
Answer: C,D
NEW QUESTION # 68
Which source provides data for Cortex XDR?
- A. Cisco ACI
- B. Amazon Alexa rank indicator
- C. VMware NSX
- D. Linux endpoints
Answer: D
NEW QUESTION # 69
Which service helps identify attackers by combining world-class threat intelligence with Cortex XSIAM technology?
- A. Managed Threat Hunting
- B. Threat Intelligence Platform
- C. Virtual Desktop Infrastructure
- D. Cloud Identity Engine
Answer: A
Explanation:
Managed Threat Hunting combines world-class threat intelligence with Cortex XSIAM (Extended Security Intelligence and Automation Management) technology to help identify attackers. This service provides proactive threat hunting capabilities, allowing security teams to detect advanced threats and respond to potential attacks with the help of expert analysts and automated tools.
NEW QUESTION # 70
The Cortex XDR management service requires which other Palo Alto Networks product?
- A. Cortex XSOAR
- B. Cortex Data Lake
- C. Panorama
- D. Directory Sync
Answer: B
Explanation:
Reference: https://www.paloaltonetworks.com/cortex/cortex-xdr
NEW QUESTION # 71
Which resource can a customer use to ensure that the Cortex XDR agent will operate correctly on their CentOS 07 servers?
- A. Compatibility Matrix
- B. LIVEcommunity
- C. Administrator Guide
- D. Release Notes
Answer: A
NEW QUESTION # 72
What are two ways a customer can configure user authentication access Cortex Xpanse? (Choose two.)
- A. RADIUS
- B. SAML
- C. Customer Support Portal
- D. Secure Shell (SSH)
Answer: B,C
NEW QUESTION # 73
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
- A. alert root cause
- B. presence of Flash executable
- C. hostname
- D. domain/workgroup membership
- E. OS
Answer: A,B,D
NEW QUESTION # 74
Which solution profiles network behavior metadata, not payloads and files, allowing effective operation regardless of encrypted or unencrypted communication protocols, like HTTPS?
- A. Security Information and Event Management (SIEM)
- B. endpoint protection platform (EPP)
- C. endpoint detection and response (EDR)
- D. Network Detection and Response (NDR)
Answer: D
Explanation:
Reference: https://www.paloaltonetworks.com/cyberpedia/what-is-network-detection-and-response
NEW QUESTION # 75
......
The PSE-Cortex certification exam is a certification program offered by Palo Alto Networks for system engineers who specialize in the Cortex platform. PSE-Cortex exam is designed to test the candidate's knowledge and skills in configuring, managing and troubleshooting the Cortex platform. The PSE-Cortex certification is recognized globally and is highly valued in the industry.
100% Pass Guarantee for PSE-Cortex Exam Dumps with Actual Exam Questions: https://torrentvce.pass4guide.com/PSE-Cortex-dumps-questions.html