Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 131:

  A large number of incidents were deleted by mistake.

  Which two architecture components can be used to recover the lost data? (Choose two.)

  A. Live backup

  B. Engine

  C. Distributed database

  D. Local backup

  Correct Answer: AD

  https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar- admin/disaster-recovery-and-live-backup/backup-the-database.html https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/disaster-recovery- and-live-backup/disaster-recovery-and-backup-overview.html

• Question 132:

  What is the difference between labels and fields?

  A. Fields can be used in playbooks and labels cannot

  B. Fields are indexed in the database and labels are not

  C. Labels can be used in queries and fields cannot

  D. Labels are indexed in the database and fields are not

  Correct Answer: C

• Question 133:

  Which two statements accurately describe layouts? (Choose two.)

  A. Layouts override classification and mapping

  B. New tabs can be added to the incident layout

  C. Layouts can display incident information and custom fields

  D. Layouts add or remove custom fields from an incident type

  Correct Answer: BC

• Question 134:

  When creating a new tab in the layout, which section cannot be added?

  A. Retrieve widget chart based on script

  B. Related incidents

  C. War room entries picked by entry query

  D. Incident team members

  Correct Answer: B

  Explanation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex- XSOAR-Administrator-Guide/Customize-Incident-Layouts

• Question 135:

  Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

  A. Add a distributed database server

  B. Add an indexing server

  C. Add a live backup server (disaster recovery)

  D. Add an engine

  Correct Answer: AC

• Question 136:

  On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

  A. 2MB

  B. 3MB

  C. 1MB

  D. 5MB

  Correct Answer: C

• Question 137:

  Which XSOAR architecture would be recommended for Managed Security Service Providers (MSSP)?

  A. Multi-region

  B. Dev-Prod

  C. Multi-tenant

  D. Distributed database

  Correct Answer: C

  Reference: https://www.ncsi.com/wp-content/uploads/2020/11/cortex-xsoar.pdf

• Question 138:

  An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

  A. !incidentSet description="Confirmed Phishing"

  B. /incidentSet description=Confirmed Phishing

  C. !setIncident description="Confirmed Phishing"

  D. /setIncident description=Confirmed Phishing

  Correct Answer: A

• Question 139:

  Which two components have their own context data? (Choose two.)

  A. Sub-playbook

  B. Task

  C. Field

  D. Incident

  Correct Answer: AD

• Question 140:

  Which task type would be used to verify/check that an integration was enabled?

  A. Standard task

  B. Conditional task

  C. Section Header task

  D. Data Collection task

  Correct Answer: D