Updated Palo Alto Networks PSE-Endpoint-Associate Exam Dumps

Question No: 1

MultipleChoice

What can a Traps content update include? (Choose three.)

Options

ANew EPMs

BUpdates to the local-analysis model

CNew trusted root certificates

DNew default policy rules

ENew trusted publishers

FNew Traps endpoint drivers

Question No: 2

MultipleChoice

A user receives an email with an attached data file containing an exploit. What is it's likely effect? (Choose two.)

Options

AThe exploit can work only if a corresponding application is installed on the user's system.

BThe exploit can do damage only if it downloads a piece of malware.

CThe exploit can work only if it begins with a buffer overflow.

DThe exploit might be launched merely by previewing the attachment.

Question No: 3

MultipleChoice

Which three statements about the trusted publisher mechanism are true? (Choose three.)

Options

AThe trusted-publisher mechanism blocks executables from running unless they are signed by a trusted publisher.

BThe list of trusted publishers is maintained through content updates.

CThe trusted-publisher mechanism takes precedence over verdict overrides by administrators.

DThe trusted-publisher mechanism is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

EThe trusted-publisher mechanism allows trusted signed executables to run without seeking a WildFire verdict.

FNo executable will be affected by the trusted-publisher mechanism unless it is signed by a publisher on a list maintained by Palo Alto Networks.

Question No: 4

MultipleChoice

Which two of the following TLS/SSL configurations are valid in a Traps 3.4 deployment? Choose two correct answers.

Options

AESM Server configured for TLS/SSL; endpoint configured for TLS/SSL

BESM Server NOT configured for TLS/SSL; endpoint configured for TLS/SSL

CESM Server configured for TLS/SSL; endpoint NOT configured for TLS/SSL

DESM Server NOT configured for TLS/SSL; endpoint NOT configured for TLS/SSL

Question No: 5

MultipleChoice

What does ROP stand for?

Options

AReturn-Oriented Programming

BRules of Prevention

CRestriction on Process

DRetained Original Process

Question No: 6

MultipleChoice

By default, where are log entries for the ESM Server and the ESM Console stored?

Options

AIn XML-formatted text files on the server

BIn flat text files on the server

CIn a connected SIEM system

DIn Panorama

EIn the Windows event log on the server

Question No: 7

MultipleChoice

The administrator uses Restrictions to do what in the ESM Console?

Options

Arestrict which processes will be protected by which EPMs.

Brestrict the execution of executable files.

Crestrict which administrators can set policies.

Drestrict the information displayed to users when the Traps agent blocks an exploit.

Question No: 8

MultipleChoice

Which two statements about advanced cyberthreats are true? (Choose two.)

Options

AIt is very common for attacks to use previously unknown malware.

BA zero-day vulnerability is defined as a security flaw of which the vulnerable product's vendor has no prior awareness.

CIt is impractical to protect against zero-day attacks.

DA zero-day vulnerability is defined as a security flaw of which the vulnerable product's customers have no prior awareness.

Question No: 9

MultipleChoice

What is the maximum supported number of endpoints per ESM Server in a Traps 3.4 deployment?

Options

A350

B16,000

C10,000

D80,000

Question No: 10

MultipleChoice

Traps endpoints send which three items directly to the ESM Server over port 2125 by default? (Choose three.)

Options

ARequests for software update packages

BVerdict requests

CWildFire malware reports

DExploit prevention dumps

EPrevention events

FHeartbeats

Question No: 11

MultipleChoice

What can a Traps content update include? (Choose three.)

Options

ANew EPMs

BUpdates to the local-analysis model

CNew trusted root certificates

DNew default policy rules

ENew trusted publishers

FNew Traps endpoint drivers

Question No: 12

MultipleChoice

Which two statements about Local Analysis are true? (Choose two.)

Options

ATraps endpoint agents build a local analysis model based on the executables they detect.

BLocal analysis is called to validate all verdicts on executable files before the files are allowed to run.

CPalo Alto Networks uses machine-learning techniques in its labs to build the local analysis model.

DLocal analysis is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

Question No: 13

MultipleChoice

A user receives an email that has piece of malware as an attachment. Choose the true statement.

Options

AThe piece of malware can work only if a corresponding application is on the user's system.

BThe piece of malware can do damage only if it makes a connection to a command-and-control server.

CThe piece of malware can work only if it begins with a buffer overflow.

DThe piece of malware can work only if the user opens the attachment.

Question No: 14

MultipleChoice

Which two statements about file hashes are true? (Choose two.)

Options

AWildFire populates ESM Server's cache with hashes of files known from other customers to be malicious.

BThe Traps agent caches the hashes of executable files for which it has verdicts.

CESM Servers send hashes of application data files to WildFire.

DESM Servers send hashes of executable files to WildFire.

Question No: 15

MultipleChoice

In the Traps product, what does the term “Service Protection” mean?

Options

Athe protection of a specified process

Bthe ability of one ESM Server to take over for another

Cthe protection of a process running on a Windows Server system

Dthe ability of the Traps agent to make itself tamper-proof

Question No: 16

MultipleChoice

In which two ways does Traps complement Palo Alto Networks perimeter protection? (Choose two.)

Options

AEndpoints are sometimes operated by their users outside the corporate network perimeter.

BESM servers send information about threats directly to Palo Alto Networks firewalls.

CTraps endpoints send information about threats directly to Palo Alto Networks firewalls.

DInformation about threats from both Palo Alto Networks firewalls and Traps endpoints flows into a shared threat intelligence cloud.

Question No: 17

MultipleChoice

Which statement about Malware verdicts is true?

Options

AIf WildFire is not available when the active ESM server tries to reach it for a verdict on a file, the endpoint will get a verdict from local analysis.

BIf the ESM server is not available when the Traps agent tries to reach it for a verdict on a file, the file status is marked as Benign.

CThe end user can use the Traps console to override a verdict of Malicious.

DLocal analysis verdicts take precedence over WildFire verdicts.

Question No: 18

MultipleChoice

How does an administrator make a Tech Support File?

Options

AClick the 'Create ZIP' button on the Logs page in ESM Console

BClick the 'Generate' button on the Settings page in ESM Console

CUse dbconfig on ESM Server

DUse cytool on the endpoint

Question No: 19

MultipleChoice

What can be used to change the uninstall passwords of agents after the initial installation of the ESM Server and the endpoint agent software?

Options

AUsing the Advanced tab of the Traps endpoint agent console

BUsing an agent action in ESM Console

CUsing an ESM Server setting in ESM Console

DUsing the command 'dbconfig server uninstallpassword' on ESM Server

Question No: 20

MultipleChoice

Which two statements about targeted attacks are true? (Choose two.)

Options

AExploits typically target vulnerabilities for which there are no patches.

BTargeted attacks typically employ a combination of software exploits and malware.

CComputer users can protect themselves effectively against targeted attacks by keeping their systems fully patched and their antivirus signature databases up to date.

DAttackers may gather information about their intended victims using social media.

Free Palo Alto Networks PSE-Endpoint-Associate Exam Dumps May 2026