Palo Alto Networks PSE-Endpoint-Associate Exam Questions Instant Access

Question 1

Which two statements about file hashes are true? (Choose two.)

AWildFire populates ESM Server's cache with hashes of files known from other customers to be malicious.

BThe Traps agent caches the hashes of executable files for which it has verdicts.

CESM Servers send hashes of application data files to WildFire.

DESM Servers send hashes of executable files to WildFire.

Answer : A, C

Question 2

Which two statements about targeted attacks are true? (Choose two.)

AExploits typically target vulnerabilities for which there are no patches.

BTargeted attacks typically employ a combination of software exploits and malware.

CComputer users can protect themselves effectively against targeted attacks by keeping their systems fully patched and their antivirus signature databases up to date.

DAttackers may gather information about their intended victims using social media.

Answer : A, B

Question 3

The administrator uses Restrictions to do what in the ESM Console?

Arestrict which processes will be protected by which EPMs.

Brestrict the execution of executable files.

Crestrict which administrators can set policies.

Drestrict the information displayed to users when the Traps agent blocks an exploit.

Answer : A

Question 4

Which two of the following TLS/SSL configurations are valid in a Traps 3.4 deployment? Choose two correct answers.

AESM Server configured for TLS/SSL; endpoint configured for TLS/SSL

BESM Server NOT configured for TLS/SSL; endpoint configured for TLS/SSL

CESM Server configured for TLS/SSL; endpoint NOT configured for TLS/SSL

DESM Server NOT configured for TLS/SSL; endpoint NOT configured for TLS/SSL

Answer : A, B

Question 5

Which three file types will be uploaded automatically to WildFire for examination? (Choose three.)

AApplication data files that trigger preventions

BExecutables with no previous verdict in the ESM deployment

CExecutables with a verdict overridden by the administrator

DExecutables allowed to run because their publisher is trusted

EExecutables allowed to run by local analysis

FApplication data files opened by the end user

Answer : A, E, F

Question 6

The Traps product and documentation use the terms "malware" and "exploit" in a very specific way. Which two statements are true? (Choose two.)

AExploits attempt to take advantage of a vulnerability in code.

BThe primary vector for exploits is .exe files.

CMalware consists of application data files containing malicious code.

DMalware consists of malicious executable files that do not rely on exploit techniques.

Answer : A, C

Question 7

Which three statements about the trusted publisher mechanism are true? (Choose three.)

AThe trusted-publisher mechanism blocks executables from running unless they are signed by a trusted publisher.

BThe list of trusted publishers is maintained through content updates.

CThe trusted-publisher mechanism takes precedence over verdict overrides by administrators.

DThe trusted-publisher mechanism is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

EThe trusted-publisher mechanism allows trusted signed executables to run without seeking a WildFire verdict.

FNo executable will be affected by the trusted-publisher mechanism unless it is signed by a publisher on a list maintained by Palo Alto Networks.

Answer : B, C, D

Palo Alto Networks PSE Endpoint Associate Accreditation Exam (Traps 4.0) PSE-Endpoint-Associate Exam Questions