Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 1:

  In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

  A. Inputs and outputs

  B. Through integration context

  C. Automatically extracted by sub-playbooks

  D. From context data, if context is shared globally

  Correct Answer: AD

• Question 2:

  What can you use to assign a layout, field, and playbook to an incoming incident?

  A. Playbook

  B. Classification and mapping

  C. Incident type

  D. Pre-processing

  Correct Answer: B

• Question 3:

  What can be added to offload integration instance processing from the main server?

  A. Database node

  B. Application server

  C. Engine

  D. Development server

  Correct Answer: A

• Question 4:

  An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

  A. Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

  B. SSH into the server and copy the indicator's database.

  C. In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

  D. Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

  Correct Answer: C

• Question 5:

  A playbook task generates a report as HTML in the context data.

  An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

  A. Populate the custom indicator field with the built-in !SetIndicator command.

  B. Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

  C. Create a custom Indicator Mapper and populate the custom indicator field.

  D. Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

  Correct Answer: D

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Configure-the-HTML-Field

• Question 6:

  What are three different loop types in a playbook? (Choose three.)

  A. Automation

  B. Built-in

  C. Data collection

  D. Conditional

  E. For-each

  Correct Answer: CDE

• Question 7:

  What is the correct expression to use when filtering only PDF files?

  A. Use File.Extension that does not equal (string comparison) PDF

  B. Use File.Name contains PDF

  C. Use File.Extension contains (general) PDF

  D. Use File.Extension equals (string comparison) PDF

  Correct Answer: D

• Question 8:

  Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?

  A. Download the content from the Marketplace.

  B. Go to Settings > About >Troubleshooting and set a flag to allow custom content.

  C. Register a user account with support.paloaltonetworks.com .

  D. Detach the content item you want to edit from the Marketplace.

  Correct Answer: B

• Question 9:

  How long is the trial period for paid content packs?

  A. 30 days

  B. 14 days

  C. 7 days

  D. 60 days

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/marketplace/ marketplace-subscriptions.html

• Question 10:

  Given the following context data, what would be the expected output of the expression?

  A. 1E56733826E5035233A097FCEA2046AF96EC616C

  B. E6EF5142E2553C1E442A0FFAC07636EAC61E6EDD

  C. 8D193FA162A305E4859BA8C45F5121F7265E3ABB

  D. e6ef5142e2553c1e442a0ffac07636eac61e6edd

  Correct Answer: D