Palo Alto Networks PSE-Endpoint Exam Questions Instant Access

Question 1

A customer plans to test the malware prevention capabilities of Traps. It has defined this policy.

* Local analysis is enabled

* Quarantining of malicious files is enabled

* Files are to be uploaded to WildFire

No executables have been whitelisted or blacklisted in the ESM Console Hash Control screen.

Malware sample A has a verdict of Malicious in the WildFire service. Malware sample B is unknown to WildFire.

Which behavior will result?

AWildFire will block sample A as known malware; sample B will be blocked as an unknown binary while the file is analyzed by WildFire for a final verdict.

BHash Control already knows sample A locally in the endpoint cache and will block it. Sample B will not be blocked by WildFire, but will be blocked by the local analysis engine.

CWildFire will block sample A as known malware, and sample B will compromise the endpoint because it is new and ESM Server has not obtained the required signatures.

DWildFire will block sample A as known malware; sample B will not be blocked by WildFire, but will be evaluated by the local analysis engine and will or will not be blocked, based on its verdict, until WildFire analysis determines the final verdict.

Answer : D

Question 2

What is the default interval for Traps agents to communicate via heartbeat to the ESM?

AEvery 1 Minute

BEvery 1 Hour

CEvery 1 Day

DEvery 1 year

Answer : B

Question 3

A large manufacturer is planning to roll out Traps to 75,000 endpoints. Their environment consists of three major sites with 24,000 endpoints each, plus about 3,000 remote endpoints in smaller remote locations using always-on VPN connections to a single one of the major sites. The customer wants to minimize network traffic between the major sites, but all endpoints have internet access. The customer is looking for a centrally managed solution with common reporting and management for all endpoints in the environment.

Which design option would be appropriate for this environment?

APlace the Traps database. ESM Console and two ESM core servers in the large site hosting the VPN gateway, and force all endpoints to use VPN at all times.

BPlace the Traps database, ESM Console and seven ESM core servers in a public-cloud environment where the ESM Core servers are accessible from the internet.

CPlace a Traps database, ESM Console and an ESM core server in each of the three large sites.

DPlace the Traps database and ESM Console in one of the major sites, and one ESM core server in each of the three major sites.

Answer : D

Question 4

Once an administrator has successfully instated a Content Update, how is the Content Update applied to endpoint?

AAfter Installation on the ESM, an Agent License renewal is required in order to trigger relevant updates.

BAfter installation on the ESM, relevant updates occur at the next Heartbeat communication from each endpoint.

CInstallation of a Content Update triggers a proactive push of the update by the ESM server to all endpoints with licensed Traps Agents within the Domain.

DThe Traps Agent must be reinstalled on the endpoint in order to apply the content update. Existing Agents will not be able to take advantage of content updates.

Answer : B

Question 5

An administrator would like to add Google Chrome and Google Chrome Helper to the exploit prevention policy for macOS. In order to achieve this task, which option should be added to the macOS protected processes list?

Achrome app

Bgoogle chrome and google chrome helper

Cchrome*

Dgoogle chrome

Answer : B

Question 6

Which two enhanced key usage purposes are necessary when creating an SSL certificate for an ESM server? (Choose two.)

AFile Recovery

BServer Authentication

CClient Authentication

DKey Recovery

Answer : B, C

Question 7

Which set of modules must be loaded and configured when using Metasploit?

AAttacker, payload

BExploit, payload

CExploit, malware

DMalware, host

Answer : C

Palo Alto Networks PSE Endpoint Professional PSE-Endpoint Exam Questions