Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 111:

  What can you use to assign a layout, field, and playbook to an incoming incident?

  A. Playbook
  B. Classification and mapping
  C. Incident type
  D. Pre-processing
  B. Classification and mapping

• Question 112:

  How is data transferred between playbook tasks?

  A. Read/Write from context data
  B. Over war room results
  C. Input from the indicator page
  D. Directly from a previous task
  A. Read/Write from context data

• Question 113:

  Which two input requirements are needed to train a machine learning model? (Choose two.)

  A. 3000 Incidents
  B. Incident Field
  C. Verdict Label
  D. Incident Type
  B. Incident Field
  D. Incident Type

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/machine-learing- models/machine-learning-models-overview.html

• Question 114:

  A playbook task generates a report as HTML in the context data.

  An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

  A. Populate the custom indicator field with the built-in !SetIndicator command.
  B. Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.
  C. Create a custom Indicator Mapper and populate the custom indicator field.
  D. Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.
  D. Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Configure-the-HTML-Field

• Question 115:

  An incident field is created having the display name as Source_IP. How can the field be accessed?

  A. ${incident.sourceip}
  B. ${incident.Source_IP}
  C. ${incident.srcip}
  D. ${incident.Source IP}
  C. ${incident.srcip}

• Question 116:

  A Cortex XSOAR Administrator is tasked with building a button for an analyst in order for the analyst to be assigned to the incident as an owner. What is the process?

  A. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument
  B. Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}
  C. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}
  D. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current
  C. Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

• Question 117:

  On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

  A. 2MB
  B. 3MB
  C. 1MB
  D. 5MB
  C. 1MB

• Question 118:

  What happens when an integration is deprecated?

  A. The integration commands in a playbook can no longer be used
  B. The integration commands can be used, but it is recommended to update to the latest content pack
  C. The configuration settings will be lost and the integration will no longer function
  D. The integration commands in a playbook can be used, but it will fail at runtime
  B. The integration commands can be used, but it is recommended to update to the latest content pack

• Question 119:

  Which field type should be used to hold more than 60,000 characters of unformatted text?

  A. Short Text
  B. HTML
  C. Long Text
  D. Markdown
  C. Long Text

• Question 120:

  In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

  A. Inputs and outputs
  B. Through integration context
  C. Automatically extracted by sub-playbooks
  D. From context data, if context is shared globally
  A. Inputs and outputs
  D. From context data, if context is shared globally