Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 31:

  Which three options can be defined in the layout settings? (Choose three.)

  A. Set of fields to present

  B. Permission to view the tab based on `Users'

  C. Permission to view the tab based on `Roles'

  D. Delete built-in tabs including the war room

  E. Dynamic sections

  Correct Answer: ACE

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/incidents/customize- incident-view-layouts/customize-incident-layouts.html

• Question 32:

  Which two capabilities do Automation script settings include? (Choose two.)

  A. Define `parameters'

  B. Correlate to incident types

  C. Define `outputs'

  D. Set password protection

  Correct Answer: CD

• Question 33:

  By default, automation written in which language will be executed in a Docker container?

  A. Python

  B. Go

  C. JavaScript

  D. Perl

  Correct Answer: B

• Question 34:

  Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

  A. A content repository specified in the Marketplace

  B. Remote git repository specified in the dev-prod configuration parameters

  C. The development server's default repository

  D. Cortex XSOAR public content repository

  Correct Answer: B

• Question 35:

  A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

  A. Manually share the dashboard through user emails

  B. Dashboard is shared to all XSOAR users

  C. Propagate the dashboard based on SAML authentication

  D. Dashboard is shared to all XSOAR users in a selected role

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/dashboards/share- a-dashboard.html

• Question 36:

  The default expiration method for non-feed indicators is either to never expire or to expire after a specific period of time. How frequently does XSOAR check tor newly expired indicators?

  A. Every 24 hours

  B. Every 5 minutes

  C. Every 8 hours

  D. Every 1 hour

  Correct Answer: D

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR- Threat-Intel-Management-Guide/Indicator-Expiration

• Question 37:

  In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

  A. The audit log

  B. The log bundle

  C. The source code for an integration

  D. The error message returned directly below the button

  E. The playground war room

  Correct Answer: BCD

• Question 38:

  B. To automate tasks such as parsing a file or enriching indicators

  C. To generate new widgets for a dashboard

  D. To determine different paths in a playbook

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/playbook- tasks/communication-tasks/create-a-data-collection-task.html

• Question 39:

  Which three types of information are displayed on the incident Quick View? (Choose three.)

  A. Indicators and relationships

  B. Timeline information

  C. Evidence Board

  D. Context data

  E. Incident severity

  Correct Answer: ABC

• Question 40:

  What does Script helper contain?

  A. Available commands

  B. Permission settings

  C. Automation version history

  D. Automation timeout configuration

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/concepts/xsoar-ide