Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 141:

  When mapping incoming data to incident fields, which statement is correct?

  A. Data that is not mapped is placed under labels

  B. Only text fields are classified

  C. Classification cannot be used if mapping is enabled

  D. Every incoming field must be mapped

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/incidents/incident-classification-mapping

• Question 142:

  Which content type cannot be managed using remote repositories?

  A. Lists

  B. Jobs

  C. Pre-processing rules

  D. Exclusion List

  Correct Answer: A

• Question 143:

  What is the default landing page for a new user in XSOAR?

  A. Dashboards

  B. Threat Intel

  C. Settings

  D. Marketplace

  Correct Answer: A

• Question 144:

  Which two input requirements are needed to train a machine learning model? (Choose two.)

  A. 3000 Incidents

  B. Incident Field

  C. Verdict Label

  D. Incident Type

  Correct Answer: BD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/machine-learing- models/machine-learning-models-overview.html

• Question 145:

  When is the post-processing script executed in XSOAR?

  A. Just after the incident is created

  B. Just after the pre-processing is executed

  C. Just after the playbook is executed

  D. Just after the Close Incident button is clicked

  Correct Answer: C

• Question 146:

  Which field type should be used to hold more than 60,000 characters of unformatted text?

  A. Short Text

  B. HTML

  C. Long Text

  D. Markdown

  Correct Answer: C

• Question 147:

  An automation returned an output called: csvReport.

  What filter would be used to check if the automation returned results?

  A. Contains/Includes

  B. Equals/Matches

  C. In/In list

  D. Is defined/Exist

  Correct Answer: D

  Explanation: This filter will be used to check if the automation returned results, as it checks to see if the output variable called csvReport is defined and exists. If it is, then the automation returned results.

• Question 148:

  An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below: The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

  

  A. XSOAR D2 Agents, to send the required emails.

  B. An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

  C. Another XSOAR server that uses the same license as their primary XSOAR server.

  D. A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

  Correct Answer: D

• Question 149:

  Correct Answer: AD

  Reference: https://docs-new.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/cortex-xsoar- overview/use-cases.html#id7b31e50b-5aca-4d65-bdb5-ba61b4eac0b4

• Question 150:

  An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

  How can they achieve this?

  A. Create a custom playbook that sends an email each time the fetch fails.

  B. Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

  C. Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

  D. Add a server config to notify when incident fetch fails.

  Correct Answer: B