Which playbook functionality allows grouping of tasks to create functional building blocks?
The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only Which use case should be used for the POC?
What are two ways Cortex XSIAM monitors for issues with data ingestion? (Choose two.)
A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users.
What would be the appropriate next step in the playbook?
Which statement applies to the differentiation of Cortex XDR from security information and event management (SIEM)?
Which feature in Cortex XSIAM extends analytics detections to all mapped network and authentication data?
The Cortex XDR management service requires which other Palo Alto Networks product?
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)
Which three Demisto incident type features can be customized under Settings > Advanced > Incident Types? (Choose three.)
What method does the Traps agent use to identify malware during a scheduled scan?
A Cortex XSIAM customer is unable to access their Cortex XSIAM tenant.
Which resource can the customer use to validate the uptime of Cortex XSIAM?
During the TMS instance activation, a tenant (Customer) provides the following information for the fields in the Activation - Step 2 of 2 window.
During the service instance provisioning which three DNS host names are created? (Choose three.)
Which two methods does the Cortex XDR agent use to identify malware during a scheduled scan? (Choose two.)
Given the exception thrown in the accompanying image by the Demisto REST API integration, which action would most likely solve the problem?
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)
Cortex XSOAR has extracted a malicious Internet Protocol (IP) address involved in command-and-control (C2) traffic.
What is the best method to block this IP from communicating with endpoints without requiring a configuration change on the firewall?
Which two Cortex XSOAR incident type features can be customized under Settings > Advanced > Incident Types? (Choose two.)
Given the integration configuration and error in the screenshot what is the cause of the problem?
What is the difference between the intel feed’s license quotas of Cortex XSOAR Starter Edition and Cortex XSOAR (SOAR + TIM)?
Which two troubleshooting steps should be taken when an integration is failing to connect? (Choose two.)
What is a requirement when integrating Cortex XSIAM or Cortex XDR with other Palo Alto Networks products?
A customer has purchased Cortex XSOAR and has a need to rapidly stand up the product in their environment. The customer has stated that their internal staff are currently occupied with other projects.
Which Palo Alto Networks service offering should be recommended to the customer?
What should be configured for a Cortex XSIAM customer who wants to automate the response to certain alerts?
If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?
When preparing for a Cortex XSOAR proof of value (POV), which task should be performed before the evaluation is requested?
In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )
When preparing the golden image in a Cortex XDR Virtual Desktop Infrastructure (VDI) deployment, which step is required?
Which integration allows searching and displaying Splunk results within Cortex XSOAR?
"Bob" is a Demisto user. Which command is used to add 'Bob" to an investigation from the War Room CLI?
Which statement best describes the benefits of the combination of Prisma Cloud, Cortex Xpanse, and partner services?
On a multi-tenanted v6.2 Cortex XSOAR server, which path leads to the server.log for "Tenant1"?
Which attack method is a result of techniques designed to gain access through vulnerabilities in the code of an operating system (OS) or application?
A test for a Microsoft exploit has been planned. After some research Internet Explorer 11 CVE-2016-0189 has been selected and a module in Metasploit has been identified
(exploit/windows/browser/ms16_051_vbscript)
The description and current configuration of the exploit are as follows;
What is the remaining configuration?
A)
B)
C)
D)
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 18 Aug 2025
