EMT Practice Test

1. Question Content...

---

Question1: How does DBot score an indicator that has multiple reputation scores?

Question2: If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?

Question3: A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

Question4: The certificate used for decryption was installed as a trusted root CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

Question5: What method does the Traps agent use to identify malware during a scheduled scan?

Question6: If an anomalous process is discovered while investigating the cause of a security event, you can take immediate action to terminate the process or the whole process tree, and block processes from running by initiating which Cortex XDR capability?

Question7: Which two entities can be created as a BIOC? (Choose two.)

Question8: If you have a playbook task that errors out. where could you see the output of the task?

Question9: Which option is required to prepare the VDI Golden Image?

Question10: Given the integration configuration and error in the screenshot what is the cause of the problem?

Question11: Which process in the causality chain does the Cortex XDR agent identify as triggering an event sequence?

Question12: A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

Question13: Rearrange the steps into the correct order for modifying an incident layout.

Question14: An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?

Question15: In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

Question16: Which two formats are supported by Whitelist? (Choose two)

Question17: Which Cortex XDR capability extends investigations to an endpoint?

Question18: When a Demisto Engine is part of a Load-Balancing group it?

Question19: The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

Question20: Which two items are stitched to the Cortex XDR causality chain'' (Choose two)