Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 11:

  Which two incident search queries are valid? (Choose two.)

  A. created:>="7 days"

  B. owner===admin

  C. role is Analyst

  D. status:closed –category:job

  Correct Answer: AD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html

• Question 12:

  An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

  Which command will accomplish this?

  A. run `ad-delete-user' command with `user-dn' arg and using-brand="Active Directory Query v2"

  B. run `ad-delete-user' command with `user-dn' arg and raw-response=true

  C. run `ad-delete-user' command with `user-dn' arg and ignore-outputs=true

  D. run `ad-delete-user' command with `user-dn' arg and using="Active Directory Query v2_instance_1"

  Correct Answer: D

• Question 13:

  What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

  A. Download content for offline installation

  B. Uninstall content pack

  C. Update to x version

  D. Revert to x version

  Correct Answer: CD

• Question 14:

  When browsing the Marketplace for new content packs, which details about each pack are you able to view?

  A. The integration's source code

  B. A summary of each version history

  C. A test instance for the content pack

  D. The source code of each playbook

  Correct Answer: B

• Question 15:

  Which of the following are valid methods to contribute custom content? (Choose three.)

  A. Submit content directly through feature requests

  B. Private GitHub repository submission for premium content

  C. A Github pull request on the public XSOAR Content Repository

  D. Using the marketplace interface to upload the content

  E. Using the content submission tool on live.paloaltonetworks.com

  Correct Answer: CDE

• Question 16:

  An engineer would like to present a trend using widgets to compare to a previous week's data. Which two methods will allow the engineer to meet the requirement? (Choose two.)

  A. Create widget of type Line, check `Display Trend' and define as 7 days ago

  B. Create a custom widget using a new incident query

  C. Create widget of type Number, check `Display Trend' and define as 7 days ago

  D. Create a custom widget using a script

  Correct Answer: AD

• Question 17:

  Where are incident layouts customized?

  A. Settings > Object Setup > Incidents > Layouts

  B. Settings > Integrations > Instance configuration

  C. Settings > Object Setup > Indicators > Layouts

  D. Settings > Advanced > Incident Layouts

  Correct Answer: A

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Customize-Incident-Layouts

• Question 18:

  Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

  A. When creating incidents from the XSOAR REST API

  B. When manually creating an incident from the UI

  C. When adding a new analyst account to XSOAR

  D. When fetching many different incident types from a single mailbox

  Correct Answer: AB

• Question 19:

  You can customize most aspects of the incident layout, including which three of the following? (Choose three.)

  A. Which users have permissions to view the tabs

  B. Which roles have permissions to view the tabs

  C. Which dashboard settings are applied

  D. The information and how is it displayed

  E. Which tabs appear and in which order

  Correct Answer: CDE

• Question 20:

  What will happen if a playbook debugger is left running for more than 24 hours?

  A. By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

  B. The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

  C. The session will be running till stopped manually by administrator.

  D. By default, the system closes automatically any debugger session that have been open 180 minutes.

  Correct Answer: D