Palo Alto Networks PSE Cortex Practice Exams
Last updated on Oct 21,2026- Exam Code: PSE Cortex
- Exam Name: Palo Alto Networks System Engineer - Cortex Professional
- Certification Provider: Palo Alto Networks
- Latest update: Oct 21,2026
What is the result of creating an exception from an exploit security event in Cortex XDR?
- A . Triggered exploit protection module for the host and process involved is disabled
- B . User is exempt from generating events for 24 hours
- C . Process from WildFire analysis is whitelisted
- D . Administrators are exempt from generating alerts for 24 hours
What are two reasons incident investigation is needed in Cortex XDR? (Choose two)
a. Insider Threats may not be blocked and initial activity may go undetected
b. Detailed reports are needed for senior management to justify the cost of XDR
c. No solution will stop every attack requiring further investigation of activity
d. Analyst need to acquire forensic artifacts of malware that has been blocked by the XDR agent
Which two entities can be created as a behavioral indicator of compromise (BIOC)? (Choose two)
a. Network
b. Event alert
c. Data
d. process
A Cortex XSOAR customer wants to ingest from a single mailbox. The mailbox brings in reported phishing emails and email requests from human resources (HR) to onboard new users. The customer wants to run two separate workflows from this mailbox, one for phishing and one for onboarding.
What will allow Cortex XSOAR to accomplish this in the most efficient way?
a. Usee machine learning (ML) to determine incident type
b. Create two instances of the email integration and classily one instance as ingesting incidents of type phishing and the other as ingesting incidents of type boarding
c. Use an incident classifier based on field in each type of email to classify those containing “Phish Alert” in the subject as phishing and those containing “Onboard Request” as onboarding
d. Create a playbook to process and determine incident type based on content of the email
Which attack method is a result of techniques designed to gain access through vulnerabilities in the code of an operating system (OS) or application?
a. Malware
b. Exploit
c. Ransomware
d. phishing
An adversary attempts to communicate with malware running on a network in order to control malware activities or to exfiltrate data from the network.
What Cortex XDR Analytics alert will this activity most likely trigger?
a. Uncommon local scheduled task creation
b. Malware
c. New administrative behavior
d. DNS Tunneling