Palo Alto Networks PCSAE Exam Practice Test Instant Access

Question 1

Which two functions in XSOAR are incident types used for? (Choose two.)

ATo run dedicated playbooks for different event types

BTo classify events ingested from various sources into the relevant types

CTo classify indicators extracted in XSOAR incidents to their respective types

DTo facilitate role based access to XSOAR incidents

Answer : B, C

Question 2

What is the function of timer SLA fields in Cortex XSOAR?

ATo track SLA breaches per playbook

BTo run a script that executes on SLA assignment

CTo automatically alert the analyst on SLA breach

DTo count the time between one or more tasks

Answer : C

Question 3

Which field type provides an interactive and editable display of table-based data?

AHTML

BGrid (table)

CMarkdown

DMulti Select

Answer : B

Question 4

When developing the playbook, which of the following can be used by a XSOAR Administrator?

AThe Debugger panel to test data with one of last five incidents. This will affect the incident's original incident data.

BContext data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.

CDebugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

DThe Debugger panel to test data with one of last fifty incidents. This will not affect the incident's original incident data.

Answer : C

Question 5

Which three types of information are displayed on the incident Quick View? (Choose three.)

AIndicators and relationships

BTimeline information

CEvidence Board

DContext data

EIncident severity

Answer : A, B, C

Question 6

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

How can they achieve this?

ACreate a custom playbook that sends an email each time the fetch fails.

BCreate a new integration that monitors the incident fetch and sends an email if the fetch fails.

CSchedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

DAdd a server config to notify when incident fetch fails.

Answer : B

Question 7

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

ARun the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

BSSH into the server and copy the indicator's database.

CIn the Threat Intel page, add query firstSeen:>='90 days ago', select All columns in Table View, and click Export to export as a CSV.

DRun the command !findIndicators in CLI with the query firstSeen:>='90 days ago' and export to CSV.

Answer : C

Palo Alto Networks PCSAE Palo Alto Networks Certified Security Automation Engineer Exam Practice Test