Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 141:

  You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

  A. type:File reputation:Malicious sourcetimestamp:"30 days ago"
  B. type:File verdict:Malicious sourcetimestamp:
  C. type:File reputation:Malicious sourcetimestamp:="30 days ago"
  D. type:File verdict:Malicious sourcetimestamp:>="30 days ago"
  A. type:File reputation:Malicious sourcetimestamp:"30 days ago"

• Question 142:

  While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?

  A. Define the Incident Fetch Interval when running the integration's commands.
  B. Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.
  C. Configure the application to send incidents on the required interval.
  D. Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.
  A. Define the Incident Fetch Interval when running the integration's commands.

• Question 143:

  An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below: The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

  

  A. XSOAR D2 Agents, to send the required emails.
  B. An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.
  C. Another XSOAR server that uses the same license as their primary XSOAR server.
  D. A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.
  D. A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

• Question 144:

  Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

  A. Python
  B. Perl
  C. Go
  D. JavaScript
  E. Powershell
  A. Python
  D. JavaScript
  E. Powershell

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/playbooks/ automations.html

• Question 145:

  What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

  A. Inputs are data pieces that are present in the playbook
  B. Inputs are data pieces that are present in the task
  C. Outputs are used as incident trigger for playbook
  D. Outputs can be derived from the result of a task or command
  E. Inputs are the data fields parsed by the Classifier
  A. Inputs are data pieces that are present in the playbook
  D. Outputs can be derived from the result of a task or command
  E. Inputs are the data fields parsed by the Classifier

• Question 146:

  Which investigation element is best suited for collaboration among users?

  A. Work Plan
  B. Related Incidents
  C. War Room
  D. Context Data
  D. Context Data

  ---

  Explanation/Reference:

  Reference: https://blog.paloaltonetworks.com/2020/01/cortex-security-operations/

• Question 147:

  Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

  A. Use a field of Number to count the number of seconds elapsed between two tasks
  B. After the playbook has run, calculate the total time taken and set the timer field with this value
  C. To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer
  D. From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on
  C. To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer
  D. From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

• Question 148:

  Which three types of information are displayed on the incident Quick View? (Choose three.)

  A. Indicators and relationships
  B. Timeline information
  C. Evidence Board
  D. Context data
  E. Incident severity
  A. Indicators and relationships
  B. Timeline information
  C. Evidence Board

• Question 149:

  Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?

  A. Download the content from the Marketplace.
  B. Go to Settings > About >Troubleshooting and set a flag to allow custom content.
  C. Register a user account with support.paloaltonetworks.com .
  D. Detach the content item you want to edit from the Marketplace.
  B. Go to Settings > About >Troubleshooting and set a flag to allow custom content.

• Question 150:

  An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

  A. The new job form changes based on the threat intel feed integration configuration
  B. The new job form can be edited from the Indicator Feed incident type editor
  C. The new job form for a threat intel feed job cannot be edited
  D. The new job form can be edited from the threat intel feeds integration settings
  B. The new job form can be edited from the Indicator Feed incident type editor

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat- intel-management- guide/manage-indicators/understand-indicators/create-a-feed-based- job.html