Palo Alto Networks PSE Cortex Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE Cortex
- Exam Name: Palo Alto Networks System Engineer - Cortex Professional
- Certification Provider: Palo Alto Networks
- Latest update: Oct 21,2026
A customer agrees to do a 30-day proof of concept (POC) and wants to integrate with a product with which Cortex XSOAR is not currently integrated.
What is the appropriate response to the customer?
a. Extend the POC window to allow the solution architects to build it
b. Explain that custom integrations are not included in the POC
c. Explain that it can be built by Professional Services, but it will take an additional 30 days
d. Agree to build the integration as part of the POC
Which statement applies to the malware protection flow in Cortex XDR Prevent?
a. Hash comparisons come after local static analysis
b. In the final step, the block list is verified
c. Local static analysis happens before a WildFire verdict check
d. A trusted signed file is exempt from local static analysis
Which process is the causality chain does the Cortex XDR agent identify as triggering an event sequence?
a. Adversary’s remote process
b. Chain’s alert initiator
c. Causality group owner
d. Relevant shell
Which command is used to add Cortex XSOAR "User1" to an investigation from the War Room?
- A . #Invite User1
- B . @User1
- C . #User1
- D . !Invite User1
Which two playbook functionalities allow looping through a group of tasks during playbook execution? (Choose two)
- A . Subplaybooks
- B . Playbook functions
- C . Common Polling Playbooks
- D . Playbook tasks
Which two filter operators are available in Cortex XDR? (Choose two)
a. =
b. Contains
c. Is Contained By
d. < >
Where is the output of the task visible when a playbook task errors out?
- A . /var/log/messages
- B . Playbook editor
- C . War Room of the incident
- D . XSOAR audit log
Which two manual actions are allowed on War Room entries? (Choose two)
- A . Mark as scheduled entry
- B . Mark as note
- C . Mark as artifact
- D . Mark as evidence
Which two types of Indicators of Compromise (IOCs) are available for creation in Cortex XDR? (Choose one)
- A . Internet Protocol (IP)
- B . Endpoint hostname
- C . Registry entry
- D . Domain
A customer wants the main Cortex XSOAR server installed in one site and wants to integrate with three other technologies in a second site
What communications are required between the two sites if the customer wants to install a Cortex XSOAR engine in the second site?
a. The Cortex XSOAR server at the first site must be able to initiate a connection to the Cortex XSOAR engine at the second site
b. All connectivity is initiated from the Cortex XSOAR server on the first site via a managed cloud proxy
c. Dedicated site-to-site virtual private network (VPN) is required for the Cortex XSOAR server at the first site to initiate a connection to the Cortex XSOAR engine at the second site
d. The Cortex XSOAR engine at the first site must be able to initiate a connection to the Cortex XSOAR server at the second site