Palo Alto Networks PSE Cortex Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE Cortex
- Exam Name: Palo Alto Networks System Engineer - Cortex Professional
- Certification Provider: Palo Alto Networks
- Latest update: Oct 21,2026
What are two capabilities of a War Room? (Choose two)
a. Run ad-hoc automation commands
b. Create widgets for an investigation
c. Act as an audit trail for an investigation
d. Create playbooks for orchestration
How do sub-playbooks affect the incident Context Data?
a. When set to global, sub-playbook tasks do not have access to the root context
b. When set to private, task outputs do not automatically get written to the root context
c. When set to global, parallel task execution is allowed
d. When set to private, task outputs are automatically written to the root context
Which method is used for third-party network data consumption?
a. File reader to the /var/log/messagers file on the device
b. Open Database Connectivity (OOBC) connection to network device database
c. Common Event Format (CEF) via broker Syslog module
d. Scripts library from the action center
How can Cortex XSOAR save time when a phishing incident occurs?
- A . Automatically identify and create cases for every mailbox that received the phish
- B . Automatically email staff to warn about the phishing attack
- C . Automatically purge the email from unopened mailboxes
- D . Automatically respond to the phishing email to unsubscribe
How can Cortex XSOAR save time when a phishing incident occurs?
a. It can automatically identify every mailbox that received the phish and create corresponding cases for them
b. It can automatically email staff to warn them about the phishing attack and show them a copy of the email
c. It can automatically purge the email from user mailboxes in which it has not yet opened
d. It can automatically respond to the phishing email to unsubscribe from future emails
Which product enables the discovery, exchange, and contribution of security automation playbooks, built into Cortex XSOAR?
a. XSOAR Marketplace
b. XSOAR Threat Intelligence Platform (TIP)
c. XSOAR Automated Systems
d. XSOAR Ticketing Systems
Which two manual actions are allowed on War Room entries? (Choose two)
a. Mark as scheduled entry
b. Mark as note
c. Mark as artifact
d. Mark as evidence
What is the size of the free Cortex Data Lake instance provided to a customer who has activated a TMS tenant, but has not purchased a Cortex Data Lake instance?
a. 10 TB
b. 1 TB
c. 100 GB
d. 10 GB
Which two types of indicators of compromise (IOCs) are available for creation in Cortex XDR?
a. Registry
b. Hostname
c. Hash
d. File path
A Cortex XDR Pro administrator is alerted to a suspicious process creation security event from multiple users who believe these events are false positives.
Which two steps should be taken confirm the false positives and create an exception? (Choose two)
a. In the Cortex XDR security event, review the specific parent process, child process, and command line arguments
b. Contact support and ask for a security exception
c. Within the Malware Security profile, add the specific parent process, child process, and command line argument to the child process whitelist
d. Within the Malware Security profile, disable the Prevent Malicious Child Process Execution module