Palo Alto Networks PSE-Endpoint Exam Questions Instant Access

Question 1

Which MSI command line parameters will successfully install a Traps agent using SSL and pointed to server ESM?

Amsiexec /i c:\traps.msi /qn TRAPS_SERVER=ESM USE_SSL_PRIMARY=1

Bmsiexec /i c:\traps.msi /qn CYVERA_SERVER=ESM USE_SSL_PRIMARY=1

Cmsiexec /i c:\traps.msi /qn ESM_SERVER=ESM USE_SSL_PRIMARY=1

Dmsiexec /x c:\traps.msi /qn SERVER=ESM USE_SSL_PRIMARY=1

Answer : B

Question 2

An administrator has decided to test Traps functionality using malware samples in an isolated non-production environment. In order to effectively test Traps, what three types of samples should the administrator avoid? (Choose three.)

AA sample with a low number of hits in Virus Total

BAn MS Office document which contains a ransomware macro

CA sample known to be flagged as grayware by Traps

DA freeware video application which spawns malicious processes

EA sample known to generate false positives in the production environment.

Answer : A, B, E

Question 3

During installation of the ESM and the agent, SSL was enabled on an endpoint. However, the agent communication is failing. The services.log on the endpoint has the following error.

*An error occurred while making the HTTP request to https: //hostname:2125/CyveraServer/. This could be due to the fact that the server certificate is not configured property with HTTP SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server."

Which certificate can be imported on the endpoint to solve this issue? Assume the hostname is a valid FQDN and the ESM Server and Console have different certificates.

AESM Server Public Certificate

BESM Server Serf-Signed Certificate

CESM Console Self-Signed Certificate

DESM Console Public Certificate

Answer : B

Question 4

A company is using a Web Gateway/Proxy for all outbound connections. The company has deployed Traps within the domain and in testing, discovered that the ESM Servers are unable to communicate with WildFire. All other Traps features are working. What is the most likely cause of the issue?

AThe administrator needs to configure WildFire proxy settings in each Agent Console.

BThe administrator needs to configure WildFire proxy settings in the ESM Console and in each Agent Console.

CThe Administrator needs to purchase the additional site license required for WildFire.

DThe Administrator needs to configure WildFire proxy settings in the ESM Console.

Answer : D

Question 5

From the ESM console, which two ways can an administrator verify that their installed macOS agents are functional? (Choose two.)

AClick the Settings Tab > Agent > Installation Package to view the agents installed.

BClick the Dashboard Tab, and refer to the Computer Distribution and Version window

CClick the Monitor Tab > Agent > Health. Sort by OS and look for the macOS endpoints

DClick the Monitor Tab > Data Retrieval

Answer : A, C

Question 6

An administrator would like to add Google Chrome and Google Chrome Helper to the exploit prevention policy for macOS. In order to achieve this task, which option should be added to the macOS protected processes list?

Achrome app

Bgoogle chrome and google chrome helper

Cchrome*

Dgoogle chrome

Answer : B

Question 7

An administrator is testing an exploit that is expected to be blocked by the JIT Mitigation EPM protecting the viewer application in use. No prevention occurs, and the attack is successful.

In which two ways can the administrator determine the reason for the missed prevention? (Choose two.)

ACheck in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application

BCheck if a Just-In-Time debugger is installed on the system

CCheck that the Traps libraries are injected into the application

DCheck that all JIT Mitigation functions are enabled in the HKLM\SYSTEM\Cyvera\Policy\Organization\Process\Default registry key

Answer : A, C

Palo Alto Networks PSE Endpoint Professional PSE-Endpoint Exam Questions