Palo Alto Networks PSE-Cortex Exam - Topic 4 Question 90 Discussion

Actual exam question for Palo Alto Networks's PSE-Cortex exam

Question #: 90
Topic #: 4

A Cortex XSOAR customer wants to ingest emails from a single mailbox. The mailbox brings in reported phishing emails and email requests from human resources (HR) to onboard new users. The customer wants to run two separate workflows from this mailbox, one for phishing and one for onboarding.

What will allow Cortex XSOAR to accomplish this in the most efficient way?

ACreate two instances of the email integration and classify one instance as ingesting incidents of type phishing and the other as ingesting incidents of type onboarding.

BUse an incident classifier based on a field in each type of email to classify those containing 'Phish Alert' in the subject as phishing and those containing 'Onboard Request' as onboarding.

CCreate a playbook to process and determine incident type based on content of the email.

DUse machine learning (ML) to determine incident type.

Show Suggested Answer

Suggested Answer: B

by Trevor at Mar 09, 2026, 02:31 AM

Limited Time Offer

25%

Off

Get Premium PSE-Cortex Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jonelle

17 days ago

Surprised that ML isn't the best choice here!

upvoted 0 times

...

Markus

23 days ago

I disagree, I think A is more efficient with separate instances.

upvoted 0 times

...

Almeta

28 days ago

Option B sounds like the simplest solution!

upvoted 0 times

...

Giuseppe

1 month ago

Not sure if classifiers will catch everything, though.

upvoted 0 times

...

Dahlia

1 month ago

Definitely need separate workflows, so A makes sense.

upvoted 0 times

...

Christene

1 month ago

Surprised that ML isn't the top option here!

upvoted 0 times

...

Melita

2 months ago

I disagree, I think A is more straightforward.

upvoted 0 times

...

Vilma

2 months ago

Option B sounds like the best choice for quick classification.

upvoted 0 times

...

Lamonica

2 months ago

Machine learning sounds advanced, but I wonder if option D is overkill for this scenario. It might not be necessary for just two types of emails.

upvoted 0 times

...

Roselle

2 months ago

I practiced a similar question where we had to decide between using classifiers and playbooks. I feel like option C could work, but it might be less efficient than just classifying them right away.

upvoted 0 times

...

Shakira

2 months ago

I'm not entirely sure, but I think creating two instances as in option A might complicate things. It could lead to more maintenance down the line.

upvoted 0 times

...

Avery

2 months ago

I remember we discussed using incident classifiers in class. Option B seems like a solid choice since it directly categorizes emails based on their subject lines.

upvoted 0 times

...