Palo Alto Networks PSE-Endpoint-Associate Exam Practice Test Instant Access

Question 1

How does an administrator make a Tech Support File?

AClick the 'Create ZIP' button on the Logs page in ESM Console

BClick the 'Generate' button on the Settings page in ESM Console

CUse dbconfig on ESM Server

DUse cytool on the endpoint

Answer : B

Question 2

Traps endpoints send which three items directly to the ESM Server over port 2125 by default? (Choose three.)

ARequests for software update packages

BVerdict requests

CWildFire malware reports

DExploit prevention dumps

EPrevention events

FHeartbeats

Answer : A, C, E

Question 3

Which three statements about the trusted publisher mechanism are true? (Choose three.)

AThe trusted-publisher mechanism blocks executables from running unless they are signed by a trusted publisher.

BThe list of trusted publishers is maintained through content updates.

CThe trusted-publisher mechanism takes precedence over verdict overrides by administrators.

DThe trusted-publisher mechanism is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

EThe trusted-publisher mechanism allows trusted signed executables to run without seeking a WildFire verdict.

FNo executable will be affected by the trusted-publisher mechanism unless it is signed by a publisher on a list maintained by Palo Alto Networks.

Answer : B, C, D

Question 4

Which two statements about troubleshooting installation and upgrade problems are true? (Choose two.)

AA common cause of ESM Server installation problems is the failure to confirm connectivity to WildFire before running the installer.

BA common cause of Traps endpoint agent installation problems is the failure to configure the SSL option correctly.

CESM Server services will shut down if they are not licensed within 24 hours of being started.

DUse MSIEXEC with appropriate flags to get more logging detail at installation time.

Answer : A, B

Question 5

The administrator uses Restrictions to do what in the ESM Console?

Arestrict which processes will be protected by which EPMs.

Brestrict the execution of executable files.

Crestrict which administrators can set policies.

Drestrict the information displayed to users when the Traps agent blocks an exploit.

Answer : A

Question 6

What does ROP stand for?

AReturn-Oriented Programming

BRules of Prevention

CRestriction on Process

DRetained Original Process

Answer : A

Question 7

By default, where are log entries for the ESM Server and the ESM Console stored?

AIn XML-formatted text files on the server

BIn flat text files on the server

CIn a connected SIEM system

DIn Panorama

EIn the Windows event log on the server

Answer : A

Palo Alto Networks PSE Endpoint Associate Accreditation Exam (Traps 4.0) PSE-Endpoint-Associate Exam Practice Test