Palo Alto Networks Palo Alto Certifications and Accreditations PCSAE Questions & Answers

• Question 21:

  An engineer would like to change an incident's SLA according to the severity field changes. How can the engineer achieve this task?

  A. Use a field trigger script

  B. Use a field display script

  C. Create a job that queries for incident severity changes

  D. Change the SLA manually every time the severity changes

  Correct Answer: B

  Reference: https://xsoar.pan.dev/docs/incidents/incident-fields

• Question 22:

  What are two primary uses of standard tasks? (Choose two.)

  A. To highlight different paths in a playbook

  B. To generate new widgets for a dashboard

  C. To create an incident or escalate an existing incident

  D. To automate tasks such as parsing a file or enriching indicators

  Correct Answer: BD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks-overview.html

• Question 23:

  Which two options may be added when a content pack is being installed? (Choose two.)

  A. Lists

  B. Roles

  C. Other content packs

  D. Indicator layouts

  Correct Answer: AB

• Question 24:

  Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

  A. Python

  B. Perl

  C. Go

  D. JavaScript

  E. Powershell

  Correct Answer: ADE

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/playbooks/automations.html

• Question 25:

  Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

  A. When creating incidents from the XSOAR REST API

  B. When manually creating an incident from the UI

  C. When adding a new analyst account to XSOAR

  D. When fetching many different incident types from a single mailbox

  Correct Answer: AB

• Question 26:

  When mapping incoming data to incident fields, which statement is correct?

  A. Data that is not mapped is placed under labels

  B. Only text fields are classified

  C. Classification cannot be used if mapping is enabled

  D. Every incoming field must be mapped

  Correct Answer: D

  Reference: https://xsoar.pan.dev/docs/incidents/incident-classification-mapping

• Question 27:

  What does Script helper contain?

  A. Available commands

  B. Permission settings

  C. Automation version history

  D. Automation timeout configuration

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/concepts/xsoar-ide

• Question 28:

  Incidents need to be filtered by all of the following criteria:

  1.

  Status – Pending

  2.

  Exclude Category – Job

  3.

  Severity – High

  4.

  Owner – None (No owner assigned)

  5.

  Type – Phishing

  6.

  Email Subject – “You have won a million dollars”

  What is the correct query syntax for the above incident search filter?

  A. status==“Pending“ andand category!=”job” andand severity==”High” andand owner==”None” andand type==”Phishing” andand emailsubject==”You have won a million dollars”

  B. Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars

  C. status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

  D. status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/cortex-xsoar-overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5-a698-08b5710196d3

• Question 29:

  Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

  A. In the instance settings, enable the fetch incidents parameter and wait for one minute

  B. Create a one task playbook with a fetch-incident command

  C. execute !-fetch

  D. execute !-fetch

  Correct Answer: AC

  Reference: https://xsoar.pan.dev/docs/integrations/fetching-incidents

• Question 30:

  Can an automation script execute an integration command and an integration command execute an automation script?

  A. An automation script cannot execute an integration command and an integration command cannot execute an automation script

  B. An automation script can execute an integration command and an integration command cannot execute an automation script

  C. An automation script cannot execute an integration command and an integration command can execute an automation script

  D. An automation script can execute an integration command and an integration command can execute an automation script

  Correct Answer: B