Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 101:

  Which method accesses a field called `User Mail' in a playbook?

  A. ${incident.usermail}

  B. ${incident.User Mail}

  C. ${incident.UserMail}

  D. ${usermail}

  Correct Answer: A

• Question 102:

  What is the default task type when creating an empty task?

  A. Standard (Manual)

  B. Conditional

  C. Section header

  D. Standard (Automated)

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/playbook- tasks/playbook-task-fields.html

• Question 103:

  In which two locations can filters and transformers be used in XSOAR? (Choose two.)

  A. Classification and Mapping

  B. Playbook Tasks

  C. Evidence Fields

  D. Incident Fields

  Correct Answer: BD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/playbooks/filters- and-transformers.html

• Question 104:

  What can be used as integration parameters?

  A. URL, API key, port

  B. URL, certificate, image

  C. Token, query, playbook

  D. User-password, csv file, query

  Correct Answer: A

• Question 105:

  What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

  A. Manually directly from the War Room with the Actions drop-down

  B. From the Notes section (mark as entry icon)

  C. Manually from the playbook task (mark as entry icon)

  D. Automatically from playbook tasks when the option is selected on the Advanced tab

  E. By running the command !MarkAsEvidence

  Correct Answer: ABD

• Question 106:

  After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?

  A. All the data, including the incident key will be deleted, and the context data will be completely empty.

  B. No difference, the automation cannot be executed manually.

  C. All context data, including custom incident fields will be deleted, system incident fields will remain.

  D. All context data, except the incident key will be deleted.

  Correct Answer: D

• Question 107:

  How can Cortex XSOAR administrators prevent junior analysts from viewing a senior analyst dashboard?

  A. Share the dashboard in Read and Edit mode for senior analysts.

  B. Share the dashboard in Read and Edit mode for senior analysts and Read Only for juniors analysts.

  C. Share the dashboard in Read and Write mode for senior analysts.

  D. Share the dashboard in Read Only mode for junior analysts and senior analysts.

  Correct Answer: B

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR- Administrator-Guide/Create-the-Read-Only-Dashboard

• Question 108:

  What is the default configuration for indicator auto-extraction when incidents are created?

  A. Inline

  B. Inband

  C. None

  D. Out of band

  Correct Answer: A

• Question 109:

  When developing the playbook, which of the following can be used by a XSOAR Administrator?

  A. The Debugger panel to test data with one of last five incidents. This will affect the incident's original incident data.

  B. Context data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.

  C. Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

  D. The Debugger panel to test data with one of last fifty incidents. This will not affect the incident's original incident data.

  Correct Answer: C

• Question 110:

  In Cortex XSOAR multi tenant setup, when content from a development server is pushed to the remote repository, where in the production server can the updates be found?

  A. Main Account

  B. Tenants

  C. Agent tools

  D. Marketplace

  Correct Answer: B

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Multi-Tenant-Guide/Configure-a-Remote-Repository-on-the-Main-Account