Is the PSE Cortex practice exam free?

Yes. ExamCademy offers all 119 PSE Cortex practice questions for free with a registered account. No payment needed. Optional supporter features add AI explanations and spaced repetition study tools.

How accurate are the PSE Cortex practice questions?

All PSE Cortex questions are community-created and reviewed by moderators to align with Palo Alto Networks's published exam objectives. The community continuously reports and fixes issues to keep content accurate and up to date.

How should I study for the PSE Cortex exam?

Start by browsing practice questions to identify weak areas. Use spaced repetition (Learn Mode) to focus study time on topics you struggle with. Combine practice questions with official Palo Alto Networks documentation and hands-on experience for best results.

PSE Cortex Practice Exam — Free 119+ Questions

119Practice Questions

3Study Modes

FreeTo Get Started

Sort:

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Page 1 of 5 • Questions 1-25 of 119

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

What does the Cortex XSOAR "Saved by Dbot" widget calculate?

A amount saved in Dollars according to actions carried out by all users in Cortex XSOAR across all incidents
B amount saved in Dollars by using Cortex XSOAR instead of other products
C amount of time saved by each playbook task within an incident
D amount of time saved by Dbot's machine learning (ML) capabilities

Which integration allows searching and displaying Splunk results within Cortex XSOAR?

A SplunkPY integration
B Demisto App for Splunk integration
C XSOAR REST API integration
D Splunk integration

Which two types of indicators of compromise (IOCs) are available for creation in Cortex XDR? (Choose two.)

A registry
B file path
C hash
D hostname

Which two Cortex XSOAR incident type features can be customized under Settings > Advanced > Incident Types? (Choose two.)

A adding new fields to an incident type
B setting reminders for an incident service level agreement (SLA)
C defining whether a playbook runs automatically when an incident type is encountered
D dropping new incidents of the same type that contain similar information

Which two statements apply to widgets? (Choose two.)

A All widgets are customizable.
B Dashboards cannot be shared across an organization.
C A widget can have its own time range that is different from the rest of the dashboard.
D Some widgets cannot be changed.

Which statement applies to a Cortex XSOAR engine that is part of a load-balancing group?

A It must be in a load-balancing group with at least three additional members.
B It must have port 443 open to allow the XSOAR server to establish a connection.
C It does not appear in the in the engine drop-down menu when configuring an integration instance.
D It can be used separately as an engine only if directly connected to the XSOAR server.

Which statement applies to the malware protection flow in Cortex XDR Prevent?

A Local static analysis happens before a WildFire verdict check.
B In the final step, the block list is verified.
C A trusted signed file is exempt from local static analysis.
D Hash comparisons come after local static analysis.

What is the size of the free Cortex Data Lake instance provided to a customer who has activated a TMS tenant, but has not purchased a Cortex Data Lake instance?

A 10 GB
B 1 TB
C 10 TB
D 100 GB

How can Cortex XSOAR save time when a phishing incident occurs?

A It can automatically email staff to warn them about the phishing attack and show them a copy of the email.
B It can automatically respond to the phishing email to unsubscribe from future emails.
C It can automatically purge the email from user mailboxes in which it has not yet opened.
D It can automatically identify every mailbox that received the phish and create corresponding cases for them.

What is a benefit offered by Cortex XSOAR?

A It has the ability to customize the extensible platform to scale to business needs.
B It allows the consolidation of multiple point products into a single integrated service.
C It provides holistic protection across hosts and containers throughout the application lifecycle.
D It enables an end-to-end view of everything in the customer environment that affects digital employee productivity.

Which two methods does the Cortex XDR agent use to identify malware during a scheduled scan? (Choose two.)

A WildFire hash comparison
B heuristic analysis
C signature comparison
D dynamic analysis

A customer agrees to do a 30-day proof of concept (POC) and wants to integrate with a product with which Cortex XSOAR is not currently integrated.
What is the appropriate response to this customer?

A Agree to build the integration as part of the POC.
B Explain that custom integrations are not included in the POC.
C Extend the POC window to allow the solution architects to build it.
D Explain that it can be built by Professional Services, but it will take an additional 30 days.

A Cortex XSOAR customer has a phishing use case in which a playbook has been implemented with one of the steps blocking a malicious URL found in an email reported by one of the users.
What would be the appropriate next step in the playbook?

A Email the CISO to advise that malicious email was found.
B Disable the user's email account.
C Email the user to confirm the reported email was phishing.
D Change the user's password.

Which step is required to prepare the virtual desktop infrastructure (VDI) golden image?

A Run the VDI conversion tool.
B Ensure the latest content updates are installed.
C Review any portable executable (PE) files WildFire determined to be malicious.
D Set the memory dumps to manual setting.

Which two areas of Cortex XDR are used for threat hunting activities? (Choose two.)

A indicators of compromise (IOC) rules
B query builder
C live terminal
D host insights module

A customer has purchased Cortex Data Lake storage with the following configuration, which requires 2 TB of Cortex Data Lake to order: support for 300 total Cortex XDR clients all forwarding Cortex XDR data with 30-day retention storage for higher fidelity logs to support Cortex XDR advanced analytics
The customer now needs 1000 total Cortex XDR clients, but continues with 300 clients forwarding Cortex XDR data with 30-day retention.
What is the new total storage requirement for Cortex Data Lake storage to order?

A 16 TB
B 4 TB
C 8 TB
D 2 TB

Which action allows Cortex XSOAR to access Docker in an air-gapped environment where the Docker page was manually installed after the Cortex XSOAR installation?

A Create a "docker" group and add the "Cortex XSOAR" or "demisto" user to this group.
B Create a "Cortex XSOAR" or "demisto" group and add the "docker" user to this group.
C Enable the Docker service.
D Disable the Cortex XSOAR service.

A customer wants the main Cortex XSOAR server installed in one site and wants to integrate with three other technologies in a second site.
What communications are required between the two sites if the customer wants to install a Cortex XSOAR engine in the second site?

A The Cortex XSOAR server at the first site must be able to initiate a connection to the Cortex XSOAR engine at the second site.
B All connectivity is initiated from the Cortex XSOAR server on the first site via a managed cloud proxy.
C Dedicated site-to-site virtual private network (VPN) is required for the Cortex XSOAR server at the first site to initiate a connection to the Cortex XSOAR engine at the second site.
D The Cortex XSOAR engine at the first site must be able to initiate a connection to the Cortex XSOAR server at the second site.

On a multi-tenanted v6.2 Cortex XSOAR server, which path leads to the server.log for "Tenant1"?

A /var/log/demisto/acc_Tenant1/server.log
B /var/log/demisto/Tenant1/server.log
C /var/lib/demisto/acc_Tenant1/server.log
D /var/lib/demisto/server.log

What are two capabilities of a War Room? (Choose two.)

A create widgets for an investigation
B create playbooks for orchestration
C act as an audit trail for an investigation
D run ad-hoc automation commands

Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two.)

A playbook functions
B sub-playbooks
C GenericPolling playbooks
D playbook tasks

Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

A causality group owner
B chain's alert initiator
C adversary's remote process
D relevant shell

Which source provides data for Cortex XDR?

A VMware NSX
B Amazon Alexa rank indicator
C Cisco ACI
D Linux endpoints

Which two manual actions are allowed on War Room entries? (Choose two.)

A mark as note
B mark as scheduled entry
C mark as evidence
D mark as artifact

How do sub-playbooks affect the Incident Context Data?

A When set to private, task outputs do not automatically get written to the root context.
B When set to global, sub-playbook tasks do not have access to the root context.
C When set to global, parallel task execution is allowed.
D When set to private, task outputs are automatically written to the root context.

PSE CortexPreview

About the PSE Cortex Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

PSE CortexPreview

About the PSE Cortex Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25