Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 11:

  Which field type provides an interactive and editable display of table-based data?

  A. HTML
  B. Grid (table)
  C. Markdown
  D. Multi Select
  B. Grid (table)

• Question 12:

  Where can engineers add the post-processing scripts to incidents?

  A. The post-processing tag must be added to the automation
  B. Post-processing scripts must be added at the end of playbooks
  C. Post-processing scripts must be added from the Incident Type editor
  D. Post-processing scripts must be added from the Post-Process Rules editor
  C. Post-processing scripts must be added from the Incident Type editor

• Question 13:

  Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

  A. Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.
  B. Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page.
  C. Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page.
  D. Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.
  D. Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

• Question 14:

  Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.

  After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

  A. Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual -Exit on yes -left:1, right1) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent
  B. Create a sub-playbook with a single input containing the computer names that will loop `For Each Input' and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent
  C. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent
  D. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks: -Increase the iterator value by one each time -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent
  B. Create a sub-playbook with a single input containing the computer names that will loop `For Each Input' and perform the following tasks: -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent
  D. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks: -Increase the iterator value by one each time -Active Directory User Enrichment based on the computerName -Create the ServiceNow Record by adding the enrichment information -Mark the ticket severity as Urgent

  ---

  Explanation/Reference:

• Question 15:

  What is the default task type when creating an empty task?

  A. Standard (Manual)
  B. Conditional
  C. Section header
  D. Standard (Automated)
  B. Conditional

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/playbook- tasks/playbook-task-fields.html

• Question 16:

  Incidents need to be filtered by all of the following criteria:

  1.Status -Pending 2.Exclude Category -Job 3.Severity -High 4.Owner -None (No owner assigned) 5.Type -Phishing 6.Email Subject -"You have won a million dollars"

  What is the correct query syntax for the above incident search filter?

  A. status==“Pending“ andand category!=”job” andand severity==”High” andand owner==”None” andand type==”Phishing” andand emailsubject==”You have won a million dollars”
  B. Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars
  C. status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”
  D. status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”
  C. status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5- a698-08b5710196d3

• Question 17:

  An engineer is developing a playbook that will be run multiple times for testing purposes. What is the recommended first task to be used in the playbook?

  A. DeleteContext
  B. GenerateTest
  C. PrintContext
  D. SetContext
  A. DeleteContext

  ---

  Explanation/Reference:

  Reference: https://xsoar.pan.dev/docs/integrations/test-playbooks

• Question 18:

  Select the correct incident life cycle on XSOAR.

  A. Planning > Incident Ingestion > Incident Creation > Mapping and Classification > Pre- processing > Playbook runs > Post-processing
  B. Planning > Incident Ingestion > Pre-processing > Incident Creation > Mapping and Classification > Playbook runs > Post-processing
  C. Planning > Incident Ingestion > Pre-processing > Mapping and Classification > Incident Creation > Playbook runs > Post-processing
  D. Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing
  D. Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

• Question 19:

  What can be used as integration parameters?

  A. URL, API key, port
  B. URL, certificate, image
  C. Token, query, playbook
  D. User-password, csv file, query
  A. URL, API key, port

• Question 20:

  Which two statements accurately describe layouts? (Choose two.)

  A. Layouts override classification and mapping
  B. New tabs can be added to the incident layout
  C. Layouts can display incident information and custom fields
  D. Layouts add or remove custom fields from an incident type
  B. New tabs can be added to the incident layout
  C. Layouts can display incident information and custom fields