EMT Practice Test

1. Question Content...

---

Question1: How does an "inline" auto-extract task affect playbook execution?

Question2: How do sub-playbooks affect the Incident Context Data?

Question3: What are process exceptions used for?

Question4: A General Purpose Dynamic Section can be added to which two layouts for incident types? (Choose two)

Question5: Which Cortex XDR capability extends investigations to an endpoint?

Question6: The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console. What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

Question7: Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

Question8: An administrator of a Cortex XDR protected production environment would like to test its ability to protect users from a known flash player exploit.
What is the safest way to do it?

Question9: Which option is required to prepare the VDI Golden Image?

Question10: What are two manual actions allowed on War Room entries? (Choose two.)

Question11: Which two filter operators are available in Cortex XDR? (Choose two.)

Question12: A customer wants to modify the retention periods of their Threat logs in Cortex Data Lake.
Where would the user configure the ratio of storage for each log type?

Question13: An EDR project was initiated by a CISO. Which resource will likely have the most heavy influence on the project?

Question14: Which CLI query would bring back Notable Events from Splunk?
A)

B)

C)

D)

Question15: The customer has indicated they need EDR data collection capabilities, which Cortex XDR license is required?

Question16: Which deployment type supports installation of an engine on Windows, Mac OS. and Linux?

Question17: An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

Question18: A prospect has agreed to do a 30-day POC and asked to integrate with a product that Demisto currently does not have an integration with. How should you respond?

Question19: What are two manual actions allowed on War Room entries? (Choose two.)

Question20: An adversary is attempting to communicate with malware running on your network for the purpose of controlling malware activities or for ex filtrating data from your network. Which Cortex XDR Analytics alert is this activity most likely to trigger'?

Question21: If a customer activates a TMS tenant and has not purchased a Cortex Data Lake instance.
Palo Alto Networks will provide the customer with a free instance
What size is this free Cortex Data Lake instance?

Question22: An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them How should an administrator perform this evaluation?

Question23: How many use cases should a POC success criteria document include?

Question24: In an Air-Gapped environment where the Docker package was manually installed after the Cortex XSOAR installation which action allows Cortex XSOAR to access Docker?

Question25: If you have a playbook task that errors out. where could you see the output of the task?

Question26: Which two items are stitched to the Cortex XDR causality chain'' (Choose two)

Question27: In the DBotScore context field, which context key would differentiate between multiple entries for the same indicator in a multi-TIP environment?

Question28: The prospect is deciding whether to go with a phishing or a ServiceNow use case as part of their POC We have integrations for both but a playbook for phishing only Which use case should be used for the POC?

Question29: Which Cortex XDR Agent capability prevents loading malicious files from USB-connected removable equipment?

Question30: In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three )

Question31: In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)

Question32: Which task allows the playbook to follow different paths based on specific conditions?

Question33: Which two log types should be configuredfor firewall forwarding to the Cortex Data Lake for use by Cortex XDR?(Choose two)

Question34: What is the retention requirement for Cortex Data Lake sizing?

Question35: The images show two versions of the same automation script and the results they produce when executed in Demisto. What are two possible causes of the exception thrown in the second Image? (Choose two.) SUCCESS

Question36: Which step is required to prepare the VDI Golden Image?

Question37: The certificate used for decryption was installed as a trusted toot CA certificate to ensure communication between the Cortex XDR Agent and Cortex XDR Management Console.What action needs to be taken if the administrator determines the Cortex XDR Agents are not communicating with the Cortex XDR Management Console?

Question38: How can you view all the relevant incidents for an indicator?