PSE Endpoint Associate Accreditation Exam (Traps 4.0) Exam Questions in PDF and Online

In which two ways does Traps complement Palo Alto Networks perimeter protection? (Choose two.)

Endpoints are sometimes operated by their users outside the corporate network perimeter.
ESM servers send information about threats directly to Palo Alto Networks firewalls.
Traps endpoints send information about threats directly to Palo Alto Networks firewalls.
Information about threats from both Palo Alto Networks firewalls and Traps endpoints flows into a shared threat intelligence cloud.

Answer(s): B,C

A user receives an email with an attached data file containing an exploit.
What is it's likely effect? (Choose two.)

The exploit can work only if a corresponding application is installed on the user's system.
The exploit can do damage only if it downloads a piece of malware.
The exploit can work only if it begins with a buffer overflow.
The exploit might be launched merely by previewing the attachment.

Answer(s): A,B

The Traps product and documentation use the terms "malware" and "exploit" in a very specific way.

Which two statements are true? (Choose two.)

Exploits attempt to take advantage of a vulnerability in code.
The primary vector for exploits is .exe files.
Malware consists of application data files containing malicious code.
Malware consists of malicious executable files that do not rely on exploit techniques.

Answer(s): A,C

Which statement about Malware verdicts is true?

If WildFire is not available when the active ESM server tries to reach it for a verdict on a file, the endpoint will get a verdict from local analysis.
If the ESM server is not available when the Traps agent tries to reach it for a verdict on a file, the file status is marked as Benign.
The end user can use the Traps console to override a verdict of Malicious.
Local analysis verdicts take precedence over WildFire verdicts.

Answer(s): A