Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 21:

  When creating an automation in XSOAR, what is the best way to create a log message?

  A. Using a debug statement

  B. Using the demisto.debug() function

  C. Using a print statement

  D. Using the demisto.results() function

  Correct Answer: B

• Question 22:

  What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

  A. The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.

  B. The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.

  C. The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.

  D. Both the Classifier and Incident Type will classify incoming incidents.

  Correct Answer: D

• Question 23:

  Select the correct incident life cycle on XSOAR.

  A. Planning > Incident Ingestion > Incident Creation > Mapping and Classification > Pre- processing > Playbook runs > Post-processing

  B. Planning > Incident Ingestion > Pre-processing > Incident Creation > Mapping and Classification > Playbook runs > Post-processing

  C. Planning > Incident Ingestion > Pre-processing > Mapping and Classification > Incident Creation > Playbook runs > Post-processing

  D. Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

  Correct Answer: D

• Question 24:

  At what stage during the incident lifecycle is an incident type assigned?

  A. Pre-processing

  B. Incident creation

  C. Classification

  D. Playbook execution

  Correct Answer: C

• Question 25:

  Which two reasons would lead an engineer to create a custom widget? (Choose two.)

  A. To visualize server configuration keys

  B. To visualize XSOAR list data

  C. To visualize complex incident data calculations

  D. To visualize context data

  E. To visualize a custom query

  Correct Answer: DE

  Reference:

  https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xsoar/6- 0/ cortex-xsoar-admin/cortex-xsoar-admin.pdf/cortex-xsoar-admin.pdf

• Question 26:

  For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

  A. /var/lib/demisto

  B. /tmp/log/demisto

  C. /usr/local/demisto

  D. /var/log/demisto

  Correct Answer: D

• Question 27:

  While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?

  A. Define the Incident Fetch Interval when running the integration's commands.

  B. Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.

  C. Configure the application to send incidents on the required interval.

  D. Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.

  Correct Answer: A

• Question 28:

  Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)

  A. setFields

  B. Field mapping

  C. setIncident

  D. Layout inline editing

  Correct Answer: BC

• Question 29:

  Which two options are the most effective for moving content between two environments? (Choose two.)

  A. Remote repository based content sharing

  B. UI based content import/export button

  C. Copy the content backup from one environment file system (/var/lib/demisto/backup/content- backup-*) and move it to the other environment

  D. Download the content items separately and upload them to the other environment

  Correct Answer: AB

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/manage-data/ migrate-data-to-another-server-for-multi-tenant.html

• Question 30:

  Where would you look to find a personalized view of your own incidents and tasks?

  A. Incident Summary View

  B. My Incidents

  C. My Threat Landscape

  D. My Dashboard

  Correct Answer: D