Palo Alto Networks Palo Alto Certifications and Accreditations PCSAE Questions & Answers

• Question 31:

  How would context data be filtered to receive only malicious indicator values with DBotScore?

  A. Get DBotScore.value where DBotScore.Score (Larger or equals) 4

  B. Get DBotScore.value where DBotScore.Score (equals (int)) 3

  C. Get DBotScore where DBotScore.Score (Larger than) 1

  D. Get DBotScore where DBotScore.Score (Larger or equals) 2

  Correct Answer: B

  Reference: https://github.com/demisto/content/blob/master//Packs/DeprecatedContent/Integrations/PaloAlto_MineMeld/README.md

• Question 32:

  When uploading content, which two options could the upload include? (Choose two.)

  A. Indicators

  B. Incidents

  C. Reports

  D. Fields

  Correct Answer: AB

• Question 33:

  An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard. How can it be accomplished?

  A. Default Dashboard can be defined by `Role'

  B. Use the server configuration key: default.dashboards

  C. Save the dashboard as a widget and apply it to all users

  D. Right click on the dashboard tab and `Set as Default'

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/monitoring/cortex-xdr-dashboard/manage-dashboards.html

• Question 34:

  Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

  A. Live backup (disaster recovery)

  B. Distributed database

  C. Backup data to XSOAR engines

  D. Local backup

  Correct Answer: AC

• Question 35:

  What can be used as integration parameters?

  A. URL, API key, port

  B. URL, certificate, image

  C. Token, query, playbook

  D. User-password, csv file, query

  Correct Answer: A

• Question 36:

  Which three options can be defined in the layout settings? (Choose three.)

  A. Set of fields to present

  B. Permission to view the tab based on `Users'

  C. Permission to view the tab based on `Roles'

  D. Delete built-in tabs including the war room

  E. Dynamic sections

  Correct Answer: ACE

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/incidents/customize-incident-view-layouts/customize-incident-layouts.html

• Question 37:

  Which two options are the most effective for moving content between two environments? (Choose two.)

  A. Remote repository based content sharing

  B. UI based content import/export button

  C. Copy the content backup from one environment file system (/var/lib/demisto/backup/content-backup-*) and move it to the other environment

  D. Download the content items separately and upload them to the other environment

  Correct Answer: AC

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/manage-data/migrate-data-to-another-server-for-multi-tenant.html

• Question 38:

  Which two statements accurately describe layouts? (Choose two.)

  A. Layouts override classification and mapping

  B. New tabs can be added to the incident layout

  C. Layouts can display incident information and custom fields

  D. Layouts add or remove custom fields from an incident type

  Correct Answer: BC

• Question 39:

  An engineer's organization system is registered in the following manner: . The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate `User' indicator automatically once a system is found.

  What is the most efficient way for the engineer to achieve this?

  A. Create a custom indicator field named `username' and link it to the internal system indicator

  B. Change the reputation command for the internal system indicator type

  C. Create a new indicator type of the internal username and set a formatting script to extract only the username

  D. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat-intel-management-guide/manage-indicators/understand-indicators/indicator-types/indicator-type-profile

• Question 40:

  A large number of incidents were deleted by mistake.

  Which two architecture components can be used to recover the lost data? (Choose two.)

  A. Live backup

  B. Engine

  C. Distributed database

  D. Local backup

  Correct Answer: AB

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/disaster-recovery-and-live-backup/disaster-recovery-and-backup-overview.html