Palo Alto Networks PSE-Endpoint 問題集

質問 1：
A large manufacturer is planning to roll out Traps to 75,000 endpoints. Their environment consists of three major sites with 24,000 endpoints each, plus about 3,000 remote endpoints in smaller remote locations using always-on VPN connections to a single one of the major sites. The customer wants to minimize network traffic between the major sites, but all endpoints have internet access. The customer is looking for a centrally managed solution with common reporting and management for all endpoints in the environment.
Which design option would be appropriate for this environment?
A. Place the Traps database. ESM Console and two ESM core servers in the large site hosting the VPN gateway, and force all endpoints to use VPN at all times.
B. Place the Traps database, ESM Console and seven ESM core servers in a public-cloud environment where the ESM Core servers are accessible from the internet.
C. Place a Traps database, ESM Console and an ESM core server in each of the three large sites.
D. Place the Traps database and ESM Console in one of the major sites, and one ESM core server in each of the three major sites.
正解：D

質問 2：
A deployment contains some machines that are not part of the domain. The Accounting and Sales departments are two of these.
How can a policy of WildFire notification be applied to Accounting, and a policy of WildFire prevention be applied to Sales, while not affecting any other WildFire policies?
A. Create two rules for WildFire: one for prevention, and one for notification. Make sure the Accounting rule is numbered higher.
B. Create the rules and use the Objects tab to add Accounting and Sales to each rule they should apply to.
C. Create a condition for an application found on an Accounting machine. Use that condition for the Accounting groups rule, and create the rule tor Sales without any conditions.
D. Create group-specific registry entries on endpoints. Use these registry entries to create conditions for the WildFire rules
正解：A

質問 3：
An administrator is testing an exploit that is expected to be blocked by the JIT Mitigation EPM protecting the viewer application in use. No prevention occurs, and the attack is successful.
In which two ways can the administrator determine the reason for the missed prevention?
(Choose two.)
A. Check in the HKLM\SYSTEM\Cyvera\Policy registry key and subkeys whether JIT Mitigation is enabled for this application
B. Check that the Traps libraries are injected into the application
C. Check that all JIT Mitigation functions are enabled in the
HKLM\SYSTEM\Cyvera\Policy\Organization\Process\Default registry key
D. Check if a Just-In-Time debugger is installed on the system
正解：A,B

質問 4：
The ESM policy is set to upload unknowns to WildFire. However, when an unknown is executed the Upload status in ESM Console never displays "Upload in progress", and the verdict remains local analysis or unknown. Even clicking the upload button and checking in does not resolve the Issue. A line in the log file suggests not being able to download a file from "https:/ESMSERVER/BitsUploads/... to C:\ProgramData\Cyvera\Temp\..." Which solution fixes this problem?
A. Restart BITS service on the endpoint
B. Remove and reinstall all the agents without SSL
C. In the ESM Console, use the FQDN in multi ESM
D. Restart BITS service on ESM
正解：D