Free PSE-CORTEX sample questions

Correct answers: Integrations for the email security gateway, sandbox, and firewall.; A Playbook that orchestrates the defined sequence of actions.

To achieve the customer's goal, two core components are necessary. First, you need configured Integrations for each third-party tool involved: the email gateway (to fetch the email), the sandbox (to detonate the URL), and the firewall (to block the URL). Second, you need a Playbook to define the logic and sequence of operations: parse the alert, extract the URL, send it to the sandbox, evaluate the result, and execute conditional actions on the firewall and email gateway. Dashboards and Threat Intelligence Management are valuable but not essential for executing this core automated workflow.

Correct answer: Schedule a knowledge transfer session with the customer's SOC team to review the deployed configuration, policies, and operational workflows.

The most critical step is the knowledge transfer session. This ensures the customer's operational team fully understands their specific deployment, including the configured security policies, alert investigation procedures, and daily management tasks. This direct engagement is far more effective than just providing documentation or support numbers, as it empowers the customer to successfully manage the solution, leading to higher satisfaction and adoption.

Correct answer: Use the standard Windows agent on workstations, the dedicated VDI agent on the golden image for the labs, and the standard Linux agent on servers.

This is the correct approach because it uses the appropriate agent type for each environment. The standard Windows agent is for persistent workstations. For non-persistent VDI environments, Cortex XDR has a specific agent and installation method (using the `--vdi_name` flag) designed to be installed on the golden image. This prevents endpoint identity duplication and licensing issues when new desktops are spun up. The standard Linux agent is correct for the research servers.

Correct answer: True

This statement is true. A primary benefit of Cortex XSIAM is its ability to consolidate multiple disparate security tools (like SIEM, EDR, SOAR, TIP) into one AI-driven platform. This consolidation reduces TCO by eliminating separate licensing costs, infrastructure maintenance, and the need for specialized personnel for each tool, while also improving operational efficiency.

Correct answer: The attribution engine, which uses internet-wide scanning and machine learning to discover and map all assets belonging to the organization.

The core value and capability of Cortex Xpanse that directly addresses this concern is its attribution engine. Xpanse doesn't rely on agent deployment or internal network scanning. Instead, it continuously scans the entire public internet and uses a sophisticated attribution engine to accurately identify and map all assets (known and unknown) that belong to the organization, providing a true 'attacker's view' of the external attack surface.

Correct answer: Deploying a dedicated, firewalled XSOAR engine on a Windows Server within the internal network to run the PowerShell commands.

For security and functionality, it is a best practice to not run sensitive internal integrations directly from the main XSOAR server, especially if it's in a DMZ or cloud environment. The correct approach is to deploy a dedicated XSOAR engine on a hardened Windows Server inside the trusted network. This engine acts as a secure proxy, executing the PowerShell commands locally with the necessary permissions. Network access can be strictly controlled between the main server and this engine, minimizing the attack surface.

Correct answer: The AI-driven analytics engine that stitches together low-and-slow signals into high-fidelity incidents.

The core architectural innovation in XSIAM for reducing alert fatigue is its AI-driven analytics engine. Instead of generating thousands of individual, low-context alerts like a traditional SIEM, XSIAM uses machine learning to analyze and correlate vast amounts of data from different sources. It stitches together disparate, weak signals over time to create a single, high-fidelity incident with a complete narrative. This drastically reduces the number of items an analyst needs to investigate, directly addressing alert fatigue and improving MTTR.

Correct answer: "By preventing a single ransomware incident, Cortex XDR can provide a positive ROI by avoiding costs associated with downtime, recovery efforts, potential ransom payments, and regulatory fines, which often exceed the solution's cost."

This statement directly ties the product's capability (preventing ransomware) to a clear, compelling financial outcome (positive ROI). It quantifies the value by listing the specific, high-impact costs of a breach (downtime, recovery, fines) that the hospital would avoid. This is a much stronger business value proposition than generic statements about alerts or features, as it speaks directly to the C-level concern of financial risk.

Correct answer: Cortex XSIAM, as it provides a unified, AI-driven platform combining next-gen SIEM, EDR, and SOAR capabilities in a single cloud-hosted solution.

Cortex XSIAM is the ideal solution for this scenario. It directly meets all of the customer's requirements: 1) It consolidates visibility by ingesting data from endpoints, cloud, and network sources. 2) Its core function is to use AI to correlate data and automate investigations, reducing manual effort for the small team. 3) It is a cloud-native, hosted solution, eliminating infrastructure overhead. 4) It provides a scalable foundation for a modern SOC. Proposing separate XDR and XSOAR instances would create integration overhead and not fully address the core issue of alert fatigue in the same way XSIAM's AI-driven incident creation does.

Correct answer: The Malware Protection profile applied to the endpoint is in 'Report' mode instead of 'Block' mode.

For testing purposes, especially during initial deployment or a POV, it's common to set protection profiles to 'Report' (or 'Detect') mode. This allows the agent to log malicious events without taking a preventive action that might disrupt business operations. In this mode, the agent would detect the EICAR file but would not block its creation or generate a prevention alert. To test the blocking capability, the profile must be switched to 'Block' mode.