Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 91:

  After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?

  A. All the data, including the incident key will be deleted, and the context data will be completely empty.
  B. No difference, the automation cannot be executed manually.
  C. All context data, including custom incident fields will be deleted, system incident fields will remain.
  D. All context data, except the incident key will be deleted.
  D. All context data, except the incident key will be deleted.

• Question 92:

  Where would you look to find a personalized view of your own incidents and tasks?

  A. Incident Summary View
  B. My Incidents
  C. My Threat Landscape
  D. My Dashboard
  D. My Dashboard

• Question 93:

  When is the post-processing script executed in XSOAR?

  A. Just after the incident is created
  B. Just after the pre-processing is executed
  C. Just after the playbook is executed
  D. Just after the Close Incident button is clicked
  C. Just after the playbook is executed

• Question 94:

  An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?

  A. Create a new indicator type and disable the built-in IP indicator
  B. Edit the regex of the default IP Indicator
  C. Add a new server configuration key that will overwrite the default regex of the IP indicator
  D. Delete the default IP indicator
  A. Create a new indicator type and disable the built-in IP indicator

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/manage-indicators/ understand-indicators/indicator-types/indicator-type-profile.html

• Question 95:

  What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

  A. Manually directly from the War Room with the Actions drop-down
  B. From the Notes section (mark as entry icon)
  C. Manually from the playbook task (mark as entry icon)
  D. Automatically from playbook tasks when the option is selected on the Advanced tab
  E. By running the command !MarkAsEvidence
  A. Manually directly from the War Room with the Actions drop-down
  B. From the Notes section (mark as entry icon)
  D. Automatically from playbook tasks when the option is selected on the Advanced tab

• Question 96:

  During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.

  Which of the following set of steps can help to resolve the issue?

  A. Navigate to Settings View the configured integrations and select Active Directory Authentication Delete all integration instances and add all integration instances again
  B. Navigate to Marketplace View the installed content pack and select Active Directory content pack Select version 1.4.6 and click on "Revert to this version"
  C. Navigate to Settings View the configured integrations and select Active Directory Query Delete all integration instances and add all integration instances again
  D. Navigate to Marketplace View the installed content pack and select Active Directory content pack Click on uninstall content pack Navigate to Marketplace browser and reinstall the Active Directory content pack
  C. Navigate to Settings View the configured integrations and select Active Directory Query Delete all integration instances and add all integration instances again

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR- Administrator-Guide/Content-Pack-Update-Notifications

• Question 97:

  When developing the playbook, which of the following can be used by a XSOAR Administrator?

  A. The Debugger panel to test data with one of last five incidents. This will affect the incident's original incident data.
  B. Context data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.
  C. Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.
  D. The Debugger panel to test data with one of last fifty incidents. This will not affect the incident's original incident data.
  C. Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

• Question 98:

  After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.

  How can the engineer save the data so it will be accessible?

  A. Mark ignore output = true
  B. Use extend-context
  C. Use raw-response = save
  D. Mark ignore input = true
  B. Use extend-context

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/extend- context/extend-context-using-the-command-line.html

• Question 99:

  What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

  A. The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.
  B. The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.
  C. The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.
  D. Both the Classifier and Incident Type will classify incoming incidents.
  D. Both the Classifier and Incident Type will classify incoming incidents.

• Question 100:

  A large number of incidents were deleted by mistake.

  Which two architecture components can be used to recover the lost data? (Choose two.)

  A. Live backup
  B. Engine
  C. Distributed database
  D. Local backup
  A. Live backup
  D. Local backup

  ---

  Explanation/Reference:

  https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar- admin/disaster-recovery-and-live-backup/backup-the-database.html https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/disaster-recovery- and-live-backup/disaster-recovery-and-backup-overview.html