Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 91:

  DRAG DROP

  Match the operations with the appropriate context.

  Select and Place:

  

  Correct Answer:

  

• Question 92:

  DRAG DROP

  Match the action with the most appropriate playbook task type.

  Select and Place:

  

  Correct Answer:

  

• Question 93:

  DRAG DROP

  Match the appropriate action to the layout type.

  Select and Place:

  

  Correct Answer:

  

• Question 94:

  Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.

  After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

  A. Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual -Exit on yes -left:1, right1) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

  B. Create a sub-playbook with a single input containing the computer names that will loop `For Each Input' and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

  C. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

  D. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks: -Increase the iterator value by one each time -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

  Correct Answer: BD

• Question 95:

  Which component can be part of a load balancing group?

  A. Distributed database

  B. D2 agent

  C. Engine

  D. Load balancing server

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/engines/understand- demisto-engines.html

• Question 96:

  An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.

  What is the main concern when adding these commands?

  A. The commands must return a proper result to the war room for the analysts to understand

  B. The code may not be written to XSOAR standards

  C. The integrations are locked and cannot be edited with additional commands

  D. The custom integration will not be maintained and updated by XSOAR content team

  Correct Answer: D

• Question 97:

  A Cortex XSOAR Administrator is tasked with building a button for an analyst in order for the analyst to be assigned to the incident as an owner. What is the process?

  A. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

  B. Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

  C. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

  D. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

  Correct Answer: C

• Question 98:

  Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

  A. Python

  B. Perl

  C. Go

  D. JavaScript

  E. Powershell

  Correct Answer: ADE

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/playbooks/ automations.html

• Question 99:

  After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.

  How can the engineer save the data so it will be accessible?

  A. Mark ignore output = true

  B. Use extend-context

  C. Use raw-response = save

  D. Mark ignore input = true

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/extend- context/extend-context-using-the-command-line.html

• Question 100:

  In which two options can an automation script be executed? (Choose two.)

  A. Engine

  B. Integration

  C. War room

  D. Playbook

  Correct Answer: CD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/playbooks/ automations.html