PSE-Cortex Palo Alto Networks System Engineer - Cortex Professional Questions and Answers

Review any PE files that WildFire determined to be malicious

Ensure the latest content updates are installed

Run the VDI conversion tool

Set the memory dumps to manual setting

Gather information about the word processing applications and run them on a Windows XP SP3 VM Determine if any of the applications are vulnerable and run the exploit with an exploitation tool

Run word processing exploits in a latest version of Windows VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities

Run a known 2015 flash exploit on a Windows XP SP3 VM. and run an exploitation tool that acts as a listener Use the results to demonstrate Traps capabilities

Prepare the latest version of Windows VM Gather information about the word processing applications, determine if some of them are vulnerable and prepare a working exploit for at least one of them Execute with an exploitation tool

Must be in a Load-Balancing group with at least another 3 members

It must have port 443 open to allow the Demisto Server to establish a connection

Can be used separately as an engine, only if connected to the Demisto Server directly

Cannot be used separately and does not appear in the in the engines drop-down menu when configuring an integration instance

A group of engines that use an algorithm to efficiently share the workload for integrations

A group of engines that ensure High Availability of Demisto backend databases.

A group of engines that use an algorithm to efficiently share the workload for automation scripts

A group of D2 agents that share processing power across multiple endpoints

Doesn't wait until the indicators are enriched and continues executing the next step

Doesn't wait until the indicators are enriched but populate context data before executing the next

step. Wait until the indicators are enriched but doesn't populate context data before executing the next step.

Wait until the indicators are enriched and populate context data before executing the next step.

Within the TMS, create an agent settings profile and modify the Disk Quota value

It is not possible to configure Cortex Data Lake quota for specific log types.

Go to the Cortex Data Lake App in Cloud Services, then choose Configuration and modify the Threat Quota

Write a GPO for each endpoint agent to check in less often