Free PSE-CORTEX sample questions

Correct answer: A main XSOAR server for central management and three separate child tenants, one for each region, using the multi-tenancy feature.

The optimal solution is to use XSOAR's multi-tenancy feature. A main (master) tenant can be used for central content management (playbooks, integrations) and threat intelligence, which can then be propagated to the child tenants. Each regional SOC operates within its own child tenant, ensuring strict data isolation and meeting sovereignty requirements. RBAC alone on a single instance does not provide true data segregation. Fully separate instances create significant management overhead for content synchronization.

Correct answer: The Behavioral Threat Protection engine that analyzes sequences of events against known malicious patterns.

While WildFire is a powerful tool, it is primarily for file-based threats. Fileless attacks, such as living-off-the-land techniques, do not involve traditional malware files. The key differentiator for Cortex XDR in this context is its Behavioral Threat Protection engine. This engine analyzes chains of events (causality) and uses machine learning to detect anomalous behaviors indicative of an attack, even when no single event or file is inherently malicious. This is crucial for identifying sophisticated, fileless techniques that evade signature and IOC-based detection.

Correct answers: Integrations for the email security gateway, sandbox, and firewall.; A Playbook that orchestrates the defined sequence of actions.

To achieve the customer's goal, two core components are necessary. First, you need configured Integrations for each third-party tool involved: the email gateway (to fetch the email), the sandbox (to detonate the URL), and the firewall (to block the URL). Second, you need a Playbook to define the logic and sequence of operations: parse the alert, extract the URL, send it to the sandbox, evaluate the result, and execute conditional actions on the firewall and email gateway. Dashboards and Threat Intelligence Management are valuable but not essential for executing this core automated workflow.

Correct answer: Schedule a knowledge transfer session with the customer's SOC team to review the deployed configuration, policies, and operational workflows.

The most critical step is the knowledge transfer session. This ensures the customer's operational team fully understands their specific deployment, including the configured security policies, alert investigation procedures, and daily management tasks. This direct engagement is far more effective than just providing documentation or support numbers, as it empowers the customer to successfully manage the solution, leading to higher satisfaction and adoption.

Correct answer: Use the standard Windows agent on workstations, the dedicated VDI agent on the golden image for the labs, and the standard Linux agent on servers.

This is the correct approach because it uses the appropriate agent type for each environment. The standard Windows agent is for persistent workstations. For non-persistent VDI environments, Cortex XDR has a specific agent and installation method (using the `--vdi_name` flag) designed to be installed on the golden image. This prevents endpoint identity duplication and licensing issues when new desktops are spun up. The standard Linux agent is correct for the research servers.

Correct answer: True

This statement is true. A primary benefit of Cortex XSIAM is its ability to consolidate multiple disparate security tools (like SIEM, EDR, SOAR, TIP) into one AI-driven platform. This consolidation reduces TCO by eliminating separate licensing costs, infrastructure maintenance, and the need for specialized personnel for each tool, while also improving operational efficiency.

Correct answer: The attribution engine, which uses internet-wide scanning and machine learning to discover and map all assets belonging to the organization.

The core value and capability of Cortex Xpanse that directly addresses this concern is its attribution engine. Xpanse doesn't rely on agent deployment or internal network scanning. Instead, it continuously scans the entire public internet and uses a sophisticated attribution engine to accurately identify and map all assets (known and unknown) that belong to the organization, providing a true 'attacker's view' of the external attack surface.

Correct answer: Deploying a dedicated, firewalled XSOAR engine on a Windows Server within the internal network to run the PowerShell commands.

For security and functionality, it is a best practice to not run sensitive internal integrations directly from the main XSOAR server, especially if it's in a DMZ or cloud environment. The correct approach is to deploy a dedicated XSOAR engine on a hardened Windows Server inside the trusted network. This engine acts as a secure proxy, executing the PowerShell commands locally with the necessary permissions. Network access can be strictly controlled between the main server and this engine, minimizing the attack surface.

Correct answer: The AI-driven analytics engine that stitches together low-and-slow signals into high-fidelity incidents.

The core architectural innovation in XSIAM for reducing alert fatigue is its AI-driven analytics engine. Instead of generating thousands of individual, low-context alerts like a traditional SIEM, XSIAM uses machine learning to analyze and correlate vast amounts of data from different sources. It stitches together disparate, weak signals over time to create a single, high-fidelity incident with a complete narrative. This drastically reduces the number of items an analyst needs to investigate, directly addressing alert fatigue and improving MTTR.

Correct answer: "By preventing a single ransomware incident, Cortex XDR can provide a positive ROI by avoiding costs associated with downtime, recovery efforts, potential ransom payments, and regulatory fines, which often exceed the solution's cost."

This statement directly ties the product's capability (preventing ransomware) to a clear, compelling financial outcome (positive ROI). It quantifies the value by listing the specific, high-impact costs of a breach (downtime, recovery, fines) that the hospital would avoid. This is a much stronger business value proposition than generic statements about alerts or features, as it speaks directly to the C-level concern of financial risk.