Palo Alto Networks PSE-Endpoint-Associate Exam Questions Instant Access

Question 1

Which two statements about file hashes are true? (Choose two.)

AWildFire populates ESM Server's cache with hashes of files known from other customers to be malicious.

BThe Traps agent caches the hashes of executable files for which it has verdicts.

CESM Servers send hashes of application data files to WildFire.

DESM Servers send hashes of executable files to WildFire.

Answer : A, C

Question 2

The Traps product and documentation use the terms "malware" and "exploit" in a very specific way. Which two statements are true? (Choose two.)

AExploits attempt to take advantage of a vulnerability in code.

BThe primary vector for exploits is .exe files.

CMalware consists of application data files containing malicious code.

DMalware consists of malicious executable files that do not rely on exploit techniques.

Answer : A, C

Question 3

In the Traps product, what does the term ''Service Protection'' mean?

Athe protection of a specified process

Bthe ability of one ESM Server to take over for another

Cthe protection of a process running on a Windows Server system

Dthe ability of the Traps agent to make itself tamper-proof

Answer : A

Question 4

Which two statements about advanced cyberthreats are true? (Choose two.)

AIt is very common for attacks to use previously unknown malware.

BA zero-day vulnerability is defined as a security flaw of which the vulnerable product's vendor has no prior awareness.

CIt is impractical to protect against zero-day attacks.

DA zero-day vulnerability is defined as a security flaw of which the vulnerable product's customers have no prior awareness.

Answer : B, D

Question 5

Traps endpoints send which three items directly to the ESM Server over port 2125 by default? (Choose three.)

ARequests for software update packages

BVerdict requests

CWildFire malware reports

DExploit prevention dumps

EPrevention events

FHeartbeats

Answer : A, C, E

Question 6

A user receives an email with an attached data file containing an exploit. What is it's likely effect? (Choose two.)

AThe exploit can work only if a corresponding application is installed on the user's system.

BThe exploit can do damage only if it downloads a piece of malware.

CThe exploit can work only if it begins with a buffer overflow.

DThe exploit might be launched merely by previewing the attachment.

Answer : A, B

Question 7

What can a Traps content update include? (Choose three.)

ANew EPMs

BUpdates to the local-analysis model

CNew trusted root certificates

DNew default policy rules

ENew trusted publishers

FNew Traps endpoint drivers

Answer : B, C, D

Palo Alto Networks PSE Endpoint Associate Accreditation Exam (Traps 4.0) PSE-Endpoint-Associate Exam Questions