Palo Alto Networks PSE-Endpoint Exam - Topic 1 Question 18 Discussion

Actual exam question for Palo Alto Networks's PSE-Endpoint exam

Question #: 18
Topic #: 1

An administrator has a critical group of systems running Windows XP SP3 that cannot be upgraded. The administrator wants to evaluate the ability of Traps to protect these systems and the word processing applications running on them.

How should an administrator perform this evaluation?

ARun a known 2015 flash exploit on a Windows XP SP3 VM, and run an exploitation tool that acts as a listener. Use the results to demonstrate Traps capabilities.

BRun word processing exploits in a Windows 7 VM in a controlled and isolated environment. Document indicators of compromise and compare to Traps protection capabilities.

CPrepare a Windows 7 VM. Gather information about the word processing applications, determine if some of them are vulnerable, and prepare a working exploit for at least one of them. Execute with an exploitation tool.

DGather information about the word processing applications and run them on a Windows XP SP3 VM. Determine if any of the applications are vulnerable and run the exploit with an exploitation tool.

Show Suggested Answer

Suggested Answer: A

by Haydee at May 04, 2022, 03:11 PM

Limited Time Offer

25%

Off

Get Premium PSE-Endpoint Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dick

4 months ago

C sounds like overkill for just evaluating protection.

upvoted 0 times

...

Karol

4 months ago

B is safer, but not really testing XP directly.

upvoted 0 times

...

Maurine

4 months ago

Wow, running exploits on XP? That's risky!

upvoted 0 times

...

Stefany

4 months ago

I disagree, A is more direct for testing Traps.

upvoted 0 times

...

Jerlene

4 months ago

Option D seems the most relevant for XP SP3 systems.

upvoted 0 times

...

Lorean

5 months ago

I feel like option D is the best choice since it directly tests the applications on the actual OS we need to protect. It seems more straightforward than the others.

upvoted 0 times

...

Ria

5 months ago

I'm not entirely sure, but I feel like running exploits on a Windows 7 VM, like in option B, might not accurately reflect the vulnerabilities of Windows XP SP3.

upvoted 0 times

...

Marva

5 months ago

I remember we discussed the importance of testing in the same environment as the target systems, so I think D makes the most sense.

upvoted 0 times

...

Tawny

5 months ago

I think option A could be risky, but it might show how Traps handles real-world exploits. We practiced something similar in class, but I’m not confident about the specifics.

upvoted 0 times

...

Oliva

5 months ago

Ah, I see what's going on here. The key is that the Start Before threshold is 5 minutes, and the agent started 6 minutes early. So even though they started before the scheduled shift, it's still within the allowed window, so they would be considered adherent. I'm confident that B. Non-adherent is the correct answer.

upvoted 0 times

...

Gwen

5 months ago

I'm a bit unsure; I think providing a list of findings might be useful too. Isn't that option A?

upvoted 0 times

...

Gregoria

5 months ago

This looks like a straightforward question about Traps agent upgrades. I'll carefully read through the options and think about which ones are valid parameters.

upvoted 0 times

...