Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 111:

  Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

  A. In the instance settings, enable the fetch incidents parameter and wait for one minute

  B. Create a one task playbook with a fetch-incident command

  C. execute !-fetch

  D. execute !-fetch

  Correct Answer: AC

  Reference: https://xsoar.pan.dev/docs/integrations/fetching-incidents

• Question 112:

  To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?

  A. 10,080 minutes (7 days)

  B. 20,160 minutes (14 days)

  C. 21,600 minutes (15 days)

  D. 4,320 minutes (3 days)

  Correct Answer: D

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Indicator-Type-Profile

• Question 113:

  Which playbook will a job run by default?

  A. The playbook assigned to the incident type

  B. The playbook assigned to the indicator type

  C. The playbook assigned during pre-processing

  D. The playbook assigned by the integration

  Correct Answer: A

• Question 114:

  Which configuration is a valid distributed database (DB) implementation?

  A. 2 main DBs, 1 application server, 2 node servers

  B. 1 main DB, 1 application server, 3 node servers

  C. 2 application servers, 1 main DB, 1 node server

  D. 1 application server, 2 main DBs, 1 node server

  Correct Answer: B

• Question 115:

  What assigns newly ingested event attributes to incident fields?

  A. Playbooks

  B. Classification

  C. Mapping

  D. Layouts

  Correct Answer: C

• Question 116:

  You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

  A. type:File reputation:Malicious sourcetimestamp:"30 days ago"

  B. type:File verdict:Malicious sourcetimestamp:<="30 days ago"

  C. type:File reputation:Malicious sourcetimestamp:="30 days ago"

  D. type:File verdict:Malicious sourcetimestamp:>="30 days ago"

  Correct Answer: A

• Question 117:

  Which field type provides an interactive and editable display of table-based data?

  A. HTML

  B. Grid (table)

  C. Markdown

  D. Multi Select

  Correct Answer: B

• Question 118:

  An engineer's organization system is registered in the following manner: . The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be

  created as a separate `User' indicator automatically once a system is found.

  What is the most efficient way for the engineer to achieve this?

  A. Create a custom indicator field named `username' and link it to the internal system indicator

  B. Change the reputation command for the internal system indicator type

  C. Create a new indicator type of the internal username and set a formatting script to extract only the username

  D. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat- intel-management- guide/manage-indicators/understand-indicators/indicator- types/indicator-type-profile

• Question 119:

  What does the outgoing mapper support?

  A. Mirroring

  B. Classification

  C. Dynamic fields

  D. Pre-processing

  Correct Answer: D

  Reference: https://xsoar.pan.dev/docs/incidents/incident-classification-mapping

• Question 120:

  What is the correct definition regarding integration parameters and command arguments?

  A. Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

  B. Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

  C. Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

  D. Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

  Correct Answer: D