Latest Palo Alto Networks PCSAE Practice Exam Questions

Jonnie Karnath2023-06-13T06:28:03+00:00

If you’re preparing for the Palo Alto Networks Certified Security Automation Engineer (PCSAE) certification exam, Certspots has got you covered with their latest PCSAE practice exam questions. Certspots is a reliable online platform that offers updated and accurate PCSAE practice exams to help you prepare for your certification exams. Their latest offering for PCSAE certification includes a wide range of questions that cover all the topics you’ll encounter in the actual exam. By practicing with Certspots’ PCSAE practice exam questions, you’ll be able to identify your strengths and weaknesses and focus on areas that require improvement. This will help you build your confidence and increase your chances of passing the exam on the first try.

Don’t miss out on this opportunity to prepare for your PCSAE certification exam. Head over to Certspots now and get access to their latest PCSAE practice exam questions.

Page 1 of 5

1. In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows with no more than 10 loops

In repetitive processes that requires sub-playbook re-execution

2. An engineer wants to customize the regex for the default IP indicator type.

How can this change be implemented?

Create a new indicator type and disable the built-in IP indicator

Edit the regex of the default IP Indicator

Add a new server configuration key that will overwrite the default regex of the IP indicator

Delete the default IP indicator

3. You can customize most aspects of the incident layout, including which three of the following? (Choose three.)

Which users have permissions to view the tabs

Which roles have permissions to view the tabs

Which dashboard settings are applied

The information and how is it displayed

Which tabs appear and in which order

4. When uploading content, which two options could the upload include? (Choose two.)

Indicators

Incidents

Reports

Fields

5. On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

2MB

3MB

1MB

5MB

6. Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

Marketplace access

Application with API

Private key/Public key integration

Multitenant deployment

7. A Cortex XSOAR Administrator is tasked with building a button for an analyst in order for the analyst to be assigned to the incident as an owner.

What is the process?

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

8. When browsing the Marketplace for new content packs, which details about each pack are you able to view?

The integration’s source code

A summary of each version history

A test instance for the content pack

The source code of each playbook

9. What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Process all alerts by running the respective playbook and link related incidents during post-processing

Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

Configure a pre-process rule to link related events as they are ingested

Manually go through the incidents created by the raw events and link related incidents

10. An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields.

How can this task be achieved?

Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

SSH into the server and copy the indicator's database.

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CS

Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CS

Page 2 of 5

11. A playbook task generates a report as HTML in the context data.

An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout.

How can the engineer populate the HTML field in the indicator layout?

Populate the custom indicator field with the built-in !SetIndicator command.

Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

Create a custom Indicator Mapper and populate the custom indicator field.

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

12. Which of the following are valid methods to contribute custom content? (Choose three.)

Submit content directly through feature requests

Private GitHub repository submission for premium content

A Github pull request on the public XSOAR Content Repository

Using the marketplace interface to upload the content

Using the content submission tool on live.paloaltonetworks.com

13. You need to retrieve a list of all malicious hashes over the last 30 days.

What is the correct query to use?

type:File reputation:Malicious sourcetimestamp:"30 days ago"

type:File verdict:Malicious sourcetimestamp:<="30 days ago"

type:File reputation:Malicious sourcetimestamp:="30 days ago"

type:File verdict:Malicious sourcetimestamp:>="30 days ago"

14. An incident field is created having the display name as Source_IP.

How can the field be accessed?

${incident.sourceip}

${incident.Source_IP}

${incident.srcip}

${incident.Source IP}

15. An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

Which command will accomplish this?

run ‘ad-delete-user’ command with ‘user-dn’ arg and using-brand=“Active Directory Query v2”

run ‘ad-delete-user’ command with ‘user-dn’ arg and raw-response=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and ignore-outputs=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and using=“Active Directory Query v2_instance_1”

16. Which two input requirements are needed to train a machine learning model? (Choose two.)

3000 Incidents

Incident Field

Verdict Label

Incident Type

17. Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

When creating incidents from the XSOAR REST API

When manually creating an incident from the UI

When adding a new analyst account to XSOAR

When fetching many different incident types from a single mailbox

18. Which three authentication methods are supported when logging into XSOAR? (Choose three.)

OTP token

User name and password

SAML

Active Directory authentication

RADIUS

19. Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.

After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual C Exit on yes C left:1, right 1) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

Create a sub-playbook with a single input containing the computer names that will loop ‘For Each Input’ and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks: -Increase the iterator value by one each time -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

20. An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.

What is the main concern when adding these commands?

The commands must return a proper result to the war room for the analysts to understand

The code may not be written to XSOAR standards

The integrations are locked and cannot be edited with additional commands

The custom integration will not be maintained and updated by XSOAR content team

Page 3 of 5

21. Where can engineers add the post-processing scripts to incidents?

The post-processing tag must be added to the automation

Post-processing scripts must be added at the end of playbooks

Post-processing scripts must be added from the Incident Type editor

Post-processing scripts must be added from the Post-Process Rules editor

22. What are two primary uses of standard tasks? (Choose two.)

To highlight different paths in a playbook

To generate new widgets for a dashboard

To create an incident or escalate an existing incident

To automate tasks such as parsing a file or enriching indicators

23. What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

Inputs are data pieces that are present in the playbook

Inputs are data pieces that are present in the task

Outputs are used as incident trigger for playbook

Outputs can be derived from the result of a task or command

Inputs are the data fields parsed by the Classifier

24. What are two common use cases for conditional tasks? (Choose two.)

They are used for branching paths in a playbook

They are used to interact with users through survey functionality

They are used to determine which incident will be executed

They are used for sending a specific QUESTION NO: to a person or team

25. Which playbook will a job run by default?

The playbook assigned to the incident type

The playbook assigned to the indicator type

The playbook assigned during pre-processing

The playbook assigned by the integration

26. Select the correct incident life cycle on XSOAR.

Planning > Incident Ingestion > Incident Creation > Mapping and Classification > Pre-processing > Playbook runs > Post-processing

Planning > Incident Ingestion > Pre-processing > Incident Creation > Mapping and Classification > Playbook runs > Post-processing

Planning > Incident Ingestion > Pre-processing > Mapping and Classification > Incident Creation > Playbook runs > Post-processing

Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

27. Which of the following is a basic setting that can be configured in an automation?

Summary

Compiler

Schedule

Run On

28. What are the out-of-the-box aggregate values that can be applied on widgets data?

Min, Max, Count, Average, Custom Transformers

Min, Max, Count, Average, Custom Group By

Count, Average, Sum, Min, Max

Count, Sum, Min, Max, Transformers

29. What is the default configuration for indicator auto-extraction when incidents are created?

Inline

Inband

None

Out of band

30. Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

Use a field of Number to count the number of seconds elapsed between two tasks

After the playbook has run, calculate the total time taken and set the timer field with this value

To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer

From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Page 4 of 5

31. How can Cortex XSOAR administrators prevent junior analysts from viewing a senior

analyst dashboard?

Share the dashboard in Read and Edit mode for senior analysts.

Share the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts.

Share the dashboard in Read and Write mode for senior analysts.

Share the dashboard in Read Only mode for junior analysts and senior analysts.

32. Where are incident layouts customized?

Settings > Object Setup > Incidents > Layouts

Settings > Integrations > Instance configuration

Settings > Object Setup > Indicators > Layouts

Settings > Advanced > Incident Layouts

33. DRAG DROP

Match the action with the most appropriate playbook task type.

34. What does Script helper contain?

Available commands

Permission settings

Automation version history

Automation timeout configuration

35. What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

Download content for offline installation

Uninstall content pack

Update to x version

Revert to x version

36. In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

Inputs and outputs

Through integration context

Automatically extracted by sub-playbooks

From context data, if context is shared globally

37. Which of the following is a feature of XSOAR automations?

can run on multiple docker containers

can be set to run on a scheduled basis in the automation settings

can be password protected

can be written in C++

38. Which two statements accurately describe layouts? (Choose two.)

Layouts override classification and mapping

New tabs can be added to the incident layout

Layouts can display incident information and custom fields

Layouts add or remove custom fields from an incident type

39. Can an automation script execute an integration command and an integration command execute an automation script?

An automation script cannot execute an integration command and an integration command cannot execute an automation script

An automation script can execute an integration command and an integration command cannot execute an automation script

An automation script cannot execute an integration command and an integration command can execute an automation script

An automation script can execute an integration command and an integration command can execute an automation script

40. Which two incident search queries are valid? (Choose two.)

created:>=”7 days”

owner===admin

role is Analyst

status:closed Ccategory:job

Page 5 of 5

41. What is the default landing page for a new user in XSOAR?

Dashboards

Threat Intel

Settings

Marketplace

42. What is the function of timer SLA fields in Cortex XSOAR?

To track SLA breaches per playbook

To run a script that executes on SLA assignment

To automatically alert the analyst on SLA breach

To count the time between one or more tasks

43. When creating an incident layout section, it is best to place long field values within which of the following?

Section headers

Rows

Canvas

Cards

44. Given an incident with three files, how could the name of the second file be referenced?

${Files.[2].Name}

${Files.Name.[2]}

${File.[1].Name}

${File.Name.[1]}

45. Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

Create content and add it to the standard content by contributing through the Marketplace

Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

Create a support ticket with the custom content for review by the support team

Any custom content will be automatically uploaded to the content repository

46. What is the correct expression to use when filtering only PDF files?

Use File.Extension that does not equal (string comparison) PDF

Use File.Name contains PDF

Use File.Extension contains (general) PDF

Use File.Extension equals (string comparison) PDF

47. An analyst wants to run a script to remove usernames from an incident before the incident becomes active in XSOAR.

How can this be achieved?

Run an automation script in the Playground to remove usernames from the incident.

Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOA

Run an automation script on the XSOAR server to remove usernames from the incident.

Create a playbook task to remove the usernames from the incident.

48. Which method accesses a field called ‘User Mail’ in a playbook?

${incident.usermail}

${incident.User Mail}

${incident.UserMail}

${usermail}

Facebook Twitter LinkedIn Google + Email