Palo Alto Networks PSE Cortex Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE Cortex
- Exam Name: Palo Alto Networks System Engineer - Cortex Professional
- Certification Provider: Palo Alto Networks
- Latest update: Oct 21,2026
What is a benefit offered by Cortex XSOAR?
a. It enables an end-to-end view of everything in the customer environment that affects digital employee productivity
b. It provides holistic protection across hosts and containers throughout the application lifecycle
c. It has the ability to customize the extensible platform to scale to business needs
d. It allows the consolidation of multiple point products into a single integrated service
What does the Cortex XSOAR “Saved by Dbot” widget calculate?
- A . Amount saved in Dollars by using Cortex XSOAR over other products
- B . Time saved by each playbook task within an incident
- C . Time saved by Dbot’s ML capabilities
- D . Dollars saved according to actions by all users in Cortex XSOAR across all incidents
Which two actions are required to add indicators to the whitelist? (Choose two)
- A . Select the indicators and click “Delete and Whitelist” in the Indicators page
- B . Upload an external file named “whitelist” to the Indicators page
- C . Upload an external file named “whitelist” to the Whitelist page
- D . Click “New Whitelisted Indicator” in the Whitelist page
Which task setting allows context output to a specific key?
a. Extend context
b. Task output
c. Stop on errors
d. tags
What is a benefit of user entity behavior analytics (UEBA) over security information and event management (SIEM)?
- A . UEBA can add trusted signers to a whitelist
- B . UEBA establishes a secure connection for log and file collection
- C . SIEMs struggle to detect unknown or advanced threats like credential theft
- D . SIEM supports only agentless scanning
How does DBot score an indicator that has multiple reputation scores?
- A . most severe score scores
- B . reputation as undefined
- C . average score
- D . least severe score
Which Cortex XDR agent capability prevents loading malicious files from USB-connected removable equipment?
a. Device control
b. Agent management
c. Agent configuration
d. Device customization
Where can all the relevant incidents for an indicator be viewed?
a. Linked indicators column in incident screen
b. Linked incidents column in indicator screen
c. Related incidents column in indicator screen
d. Related indicators column in incident screen
What is the result of creating an exception from an exploit security event?
a. Triggered exploit protection module (EPM) for the host and process involved is disabled
b. User is exempt from generating events for 24 hours
c. Process from WildFire analysis is whitelisted
d. Administrators are exempt from generating alerts for 24 hours
Cortex XDR external data ingestion processes ingest data from which sources?
a. Windows event logs only
b. Windows event logs, syslogs, and custom external sources
c. Windows event logs and syslogs only
d. Syslogs only