Palo Alto Networks PSE-Endpoint-Associate Exam Questions Instant Access

Question 1

A user receives an email that has piece of malware as an attachment. Choose the true statement.

AThe piece of malware can work only if a corresponding application is on the user's system.

BThe piece of malware can do damage only if it makes a connection to a command-and-control server.

CThe piece of malware can work only if it begins with a buffer overflow.

DThe piece of malware can work only if the user opens the attachment.

Answer : C

Question 2

Which three file types will be uploaded automatically to WildFire for examination? (Choose three.)

AApplication data files that trigger preventions

BExecutables with no previous verdict in the ESM deployment

CExecutables with a verdict overridden by the administrator

DExecutables allowed to run because their publisher is trusted

EExecutables allowed to run by local analysis

FApplication data files opened by the end user

Answer : A, E, F

Question 3

Which statement about Malware verdicts is true?

AIf WildFire is not available when the active ESM server tries to reach it for a verdict on a file, the endpoint will get a verdict from local analysis.

BIf the ESM server is not available when the Traps agent tries to reach it for a verdict on a file, the file status is marked as Benign.

CThe end user can use the Traps console to override a verdict of Malicious.

DLocal analysis verdicts take precedence over WildFire verdicts.

Answer : A

Question 4

What is the maximum supported number of endpoints per ESM Server in a Traps 3.4 deployment?

A350

B16,000

C10,000

D80,000

Answer : D

Question 5

How does an administrator make a Tech Support File?

AClick the 'Create ZIP' button on the Logs page in ESM Console

BClick the 'Generate' button on the Settings page in ESM Console

CUse dbconfig on ESM Server

DUse cytool on the endpoint

Answer : B

Question 6

Which two statements about file hashes are true? (Choose two.)

AWildFire populates ESM Server's cache with hashes of files known from other customers to be malicious.

BThe Traps agent caches the hashes of executable files for which it has verdicts.

CESM Servers send hashes of application data files to WildFire.

DESM Servers send hashes of executable files to WildFire.

Answer : A, C

Question 7

Which two statements about Local Analysis are true? (Choose two.)

ATraps endpoint agents build a local analysis model based on the executables they detect.

BLocal analysis is called to validate all verdicts on executable files before the files are allowed to run.

CPalo Alto Networks uses machine-learning techniques in its labs to build the local analysis model.

DLocal analysis is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

Answer : C, D

Palo Alto Networks PSE Endpoint Associate Accreditation Exam (Traps 4.0) PSE-Endpoint-Associate Exam Questions