Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 101:

  What is the default landing page for a new user in XSOAR?

  A. Dashboards
  B. Threat Intel
  C. Settings
  D. Marketplace
  A. Dashboards

• Question 102:

  What are two common use cases for conditional tasks? (Choose two.)

  A. They are used for branching paths in a playbook
  B. They are used to interact with users through survey functionality
  C. They are used to determine which incident will be executed
  D. They are used for sending a specific QUESTION NO: to a person or team
  A. They are used for branching paths in a playbook
  D. They are used for sending a specific QUESTION NO: to a person or team

  ---

  Explanation/Reference:

  Reference: https://docs-new.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/cortex-xsoar- overview/use-cases.html#id7b31e50b-5aca-4d65-bdb5-ba61b4eac0b4

• Question 103:

  Management would like to get an incident report automatically following an incident's closure. How would this be accomplished?

  A. Define a task in a playbook to generate an incident report before the closure occurs
  B. Manually create an `Incident Report'
  C. Configure post-processing using a script
  D. Create an `Incident Report' from the Reports page
  C. Configure post-processing using a script

• Question 104:

  An engineer would like to change an incident's SLA according to the severity field changes. How can the engineer achieve this task?

  A. Use a field trigger script
  B. Use a field display script
  C. Create a job that queries for incident severity changes
  D. Change the SLA manually every time the severity changes
  A. Use a field trigger script

  ---

  Explanation/Reference:

  Reference: https://xsoar.pan.dev/docs/incidents/incident-fields

• Question 105:

  What are three different loop types in a playbook? (Choose three.)

  A. Automation
  B. Built-in
  C. Data collection
  D. Conditional
  E. For-each
  C. Data collection
  D. Conditional
  E. For-each

• Question 106:

  To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?

  A. 10,080 minutes (7 days)
  B. 20,160 minutes (14 days)
  C. 21,600 minutes (15 days)
  D. 4,320 minutes (3 days)
  D. 4,320 minutes (3 days)

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Indicator-Type-Profile

• Question 107:

  When creating an automation in XSOAR, what is the best way to create a log message?

  A. Using a debug statement
  B. Using the demisto.debug() function
  C. Using a print statement
  D. Using the demisto.results() function
  B. Using the demisto.debug() function

• Question 108:

  Which three authentication methods are supported when logging into XSOAR? (Choose three.)

  A. OTP token
  B. User name and password
  C. SAML
  D. Active Directory authentication
  E. RADIUS
  C. SAML
  D. Active Directory authentication
  E. RADIUS

  ---

  Explanation/Reference:

  Reference: https://www.paloguard.com/GlobalProtect.asp

• Question 109:

  When creating an incident layout section, it is best to place long field values within which of the following?

  A. Section headers
  B. Rows
  C. Canvas
  D. Cards
  B. Rows

• Question 110:

  In which two locations can filters and transformers be used in XSOAR? (Choose two.)

  A. Classification and Mapping
  B. Playbook Tasks
  C. Evidence Fields
  D. Incident Fields
  B. Playbook Tasks
  D. Incident Fields

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/playbooks/filters- and-transformers.html