How to pass PSE Cortex Certification Exam?

1. An EDR project was initiated by a CISO.

Which resource will likely have the most heavy influence on the project?

2. A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.

Where would the user configure the ratio of storage for each log type?

3. The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console.

What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

4. In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

5. A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified

(exploit/windows/browser/ms16_051_vbscript)

The description and current configuration of the exploit are as follows;

What is the remaining configuration?

A)

B)

C)

D)

6. Which task allows the playbook to follow different paths based on specific conditions?

7. Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?

8. What is the retention requirement for Cortex Data Lake sizing?

9. An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network.

Which Cortex XDR Analytics alert is this activity most likely to trigger'?

10. Which step is required to prepare the VDI Golden Image?

11. Which Cortex XDR capability extends investigations to an endpoint?

12. In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?

13. The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only.

Which use case should be used for the POC?

14. Which two entities can be created as a BIOC? (Choose two.)

15. How does DBot score an indicator that has multiple reputation scores?