Skip to main content

PCSAE Real Exam Questions

Palo Alto Networks Certified Security Automation Engineer (PCSAE)

156 questions available · Page 1 of 16

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Multiple choice

Which three options can be defined in the layout settings? (Choose three.)

  1. A

    Set of fields to present

  2. B

    Permission to view the tab based on `Users'

  3. C

    Permission to view the tab based on `Roles'

  4. D

    Delete built-in tabs including the war room

  5. E

    Dynamic sections

Show answer and explanation

Correct answers: A, C, E

Explanation

References:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/incidents/customize-incident-view-layouts/customize-incident-layouts.html

Question 2 Multiple choice

In which two options can an automation script be executed? (Choose two.)

  1. A

    Engine

  2. B

    Integration

  3. C

    War room

  4. D

    Playbook

Show answer and explanation

Correct answers: C, D

Explanation

References:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/playbooks/
automations.html

Question 3 Single choice

What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

  1. A

    The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.

  2. B

    The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.

  3. C

    The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.

  4. D

    Both the Classifier and Incident Type will classify incoming incidents.

Show answer and explanation

Correct answer: D

Question 4 Multiple choice

Which three statements are true about the Marketplace? (Choose three.)

  1. A

    Allows reverting back to a previous version of a content pack

  2. B

    Enables users to participate in the community by sharing content

  3. C

    Publishes content without additional review from the Cortex XSOAR team

  4. D

    Allows uploading of content in additional languages

  5. E

    Offers granularity in installation through content packs

Show answer and explanation

Correct answers: A, B, E

Question 5 Single choice

What is the difference between labels and fields?

  1. A

    Fields can be used in playbooks and labels cannot

  2. B

    Fields are indexed in the database and labels are not

  3. C

    Labels can be used in queries and fields cannot

  4. D

    Labels are indexed in the database and fields are not

Show answer and explanation

Correct answer: C

Question 6 Single choice

An analyst runs the following command in a playbook task:

!ip ip=1.1.1.1

Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

  1. A

    Synchronous

  2. B

    Extract

  3. C

    Out of band

  4. D

    Inline

Show answer and explanation

Correct answer: D

Question 7 Single choice

What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

  1. A

    Process all alerts by running the respective playbook and link related incidents during post-processing

  2. B

    Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

  3. C

    Configure a pre-process rule to link related events as they are ingested

  4. D

    Manually go through the incidents created by the raw events and link related incidents

Show answer and explanation

Correct answer: C

Question 8 Single choice

An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.

What is the main concern when adding these commands?

  1. A

    The commands must return a proper result to the war room for the analysts to understand

  2. B

    The code may not be written to XSOAR standards

  3. C

    The integrations are locked and cannot be edited with additional commands

  4. D

    The custom integration will not be maintained and updated by XSOAR content team

Show answer and explanation

Correct answer: D

Question 9 Single choice

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

How can they achieve this?

  1. A

    Create a custom playbook that sends an email each time the fetch fails.

  2. B

    Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

  3. C

    Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new

    incidents.

  4. D

    Add a server config to notify when incident fetch fails.

Show answer and explanation

Correct answer: B

Question 10 Multiple choice

What are two common use cases for conditional tasks? (Choose two.)

  1. A

    They are used for branching paths in a playbook

  2. B

    They are used to interact with users through survey functionality

  3. C

    They are used to determine which incident will be executed

  4. D

    They are used for sending a specific QUESTION NO: to a person or team

Show answer and explanation

Correct answers: A, D

Explanation

References:
https://docs-new.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/cortex-xsoar-overview/use-cases.html#id7b31e50b-5aca-4d65-bdb5-ba61b4eac0b4