Updated Palo Alto Networks PSE-Endpoint-Associate Exam Dumps

Question No: 1

MultipleChoice

Which two statements about targeted attacks are true? (Choose two.)

Options

AExploits typically target vulnerabilities for which there are no patches.

BTargeted attacks typically employ a combination of software exploits and malware.

CComputer users can protect themselves effectively against targeted attacks by keeping their systems fully patched and their antivirus signature databases up to date.

DAttackers may gather information about their intended victims using social media.

Question No: 2

MultipleChoice

A user receives an email with an attached data file containing an exploit. What is it's likely effect? (Choose two.)

Options

AThe exploit can work only if a corresponding application is installed on the user's system.

BThe exploit can do damage only if it downloads a piece of malware.

CThe exploit can work only if it begins with a buffer overflow.

DThe exploit might be launched merely by previewing the attachment.

Question No: 3

MultipleChoice

A user receives an email that has piece of malware as an attachment. Select the true statement.

Options

AThe piece of malware can work only if a corresponding application is on the user's system.

BThe piece of malware can do damage only if it makes a connection to a command-and-control server.

CThe piece of malware can work only if it begins with a buffer overflow.

DThe piece of malware can work only if the user opens the attachment.

Question No: 4

MultipleChoice

By default, where are log entries for the ESM Server and the ESM Console stored?

Options

AIn XML-formatted text files on the server

BIn flat text files on the server

CIn a connected SIEM system

DIn Panorama

EIn the Windows event log on the server

Question No: 5

MultipleChoice

What can a Traps content update include? (Choose three.)

Options

ANew EPMs

BUpdates to the local-analysis model

CNew trusted root certificates

DNew default policy rules

ENew trusted publishers

FNew Traps endpoint drivers

Question No: 6

MultipleChoice

A user receives an email with an attached data file containing an exploit. What is it's likely effect? (Choose two.)

Options

AThe exploit can work only if a corresponding application is installed on the user's system.

BThe exploit can do damage only if it downloads a piece of malware.

CThe exploit can work only if it begins with a buffer overflow.

DThe exploit might be launched merely by previewing the attachment.

Question No: 7

MultipleChoice

Which three statements about the trusted publisher mechanism are true? (Choose three.)

Options

AThe trusted-publisher mechanism blocks executables from running unless they are signed by a trusted publisher.

BThe list of trusted publishers is maintained through content updates.

CThe trusted-publisher mechanism takes precedence over verdict overrides by administrators.

DThe trusted-publisher mechanism is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

EThe trusted-publisher mechanism allows trusted signed executables to run without seeking a WildFire verdict.

FNo executable will be affected by the trusted-publisher mechanism unless it is signed by a publisher on a list maintained by Palo Alto Networks.

Question No: 8

MultipleChoice

Which two of the following TLS/SSL configurations are valid in a Traps 3.4 deployment? Choose two correct answers.

Options

AESM Server configured for TLS/SSL; endpoint configured for TLS/SSL

BESM Server NOT configured for TLS/SSL; endpoint configured for TLS/SSL

CESM Server configured for TLS/SSL; endpoint NOT configured for TLS/SSL

DESM Server NOT configured for TLS/SSL; endpoint NOT configured for TLS/SSL

Question No: 9

MultipleChoice

What does ROP stand for?

Options

AReturn-Oriented Programming

BRules of Prevention

CRestriction on Process

DRetained Original Process

Question No: 10

MultipleChoice

By default, where are log entries for the ESM Server and the ESM Console stored?

Options

AIn XML-formatted text files on the server

BIn flat text files on the server

CIn a connected SIEM system

DIn Panorama

EIn the Windows event log on the server

Question No: 11

MultipleChoice

The administrator uses Restrictions to do what in the ESM Console?

Options

Arestrict which processes will be protected by which EPMs.

Brestrict the execution of executable files.

Crestrict which administrators can set policies.

Drestrict the information displayed to users when the Traps agent blocks an exploit.

Question No: 12

MultipleChoice

Which two statements about advanced cyberthreats are true? (Choose two.)

Options

AIt is very common for attacks to use previously unknown malware.

BA zero-day vulnerability is defined as a security flaw of which the vulnerable product's vendor has no prior awareness.

CIt is impractical to protect against zero-day attacks.

DA zero-day vulnerability is defined as a security flaw of which the vulnerable product's customers have no prior awareness.

Question No: 13

MultipleChoice

What is the maximum supported number of endpoints per ESM Server in a Traps 3.4 deployment?

Options

A350

B16,000

C10,000

D80,000

Question No: 14

MultipleChoice

Traps endpoints send which three items directly to the ESM Server over port 2125 by default? (Choose three.)

Options

ARequests for software update packages

BVerdict requests

CWildFire malware reports

DExploit prevention dumps

EPrevention events

FHeartbeats

Question No: 15

MultipleChoice

What can a Traps content update include? (Choose three.)

Options

ANew EPMs

BUpdates to the local-analysis model

CNew trusted root certificates

DNew default policy rules

ENew trusted publishers

FNew Traps endpoint drivers

Question No: 16

MultipleChoice

Which two statements about Local Analysis are true? (Choose two.)

Options

ATraps endpoint agents build a local analysis model based on the executables they detect.

BLocal analysis is called to validate all verdicts on executable files before the files are allowed to run.

CPalo Alto Networks uses machine-learning techniques in its labs to build the local analysis model.

DLocal analysis is called whenever an executable file would otherwise get an Unknown or No Connection verdict.

Question No: 17

MultipleChoice

A user receives an email that has piece of malware as an attachment. Choose the true statement.

Options

AThe piece of malware can work only if a corresponding application is on the user's system.

BThe piece of malware can do damage only if it makes a connection to a command-and-control server.

CThe piece of malware can work only if it begins with a buffer overflow.

DThe piece of malware can work only if the user opens the attachment.

Question No: 18

MultipleChoice

Which two statements about file hashes are true? (Choose two.)

Options

AWildFire populates ESM Server's cache with hashes of files known from other customers to be malicious.

BThe Traps agent caches the hashes of executable files for which it has verdicts.

CESM Servers send hashes of application data files to WildFire.

DESM Servers send hashes of executable files to WildFire.

Question No: 19

MultipleChoice

In the Traps product, what does the term “Service Protection” mean?

Options

Athe protection of a specified process

Bthe ability of one ESM Server to take over for another

Cthe protection of a process running on a Windows Server system

Dthe ability of the Traps agent to make itself tamper-proof

Question No: 20

MultipleChoice

In which two ways does Traps complement Palo Alto Networks perimeter protection? (Choose two.)

Options

AEndpoints are sometimes operated by their users outside the corporate network perimeter.

BESM servers send information about threats directly to Palo Alto Networks firewalls.

CTraps endpoints send information about threats directly to Palo Alto Networks firewalls.

DInformation about threats from both Palo Alto Networks firewalls and Traps endpoints flows into a shared threat intelligence cloud.

Free Palo Alto Networks PSE-Endpoint-Associate Exam Dumps August 2026