Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 31:

  Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

  A. reputation-script
  B. enrich
  C. reputationScript
  D. reputation
  C. reputationScript

• Question 32:

  During configuration of the inputs of a sub-playbook in the main playbook, there is an option under the Loop tab called "For Each Input". What is this option used to?

  A. To loop the sub-playbook over all context values present in the investigation
  B. To loop the sub-playbook over all incident fields for the given incident
  C. To loop the sub-playbook over all the fields marked as important
  D. To loop the sub-playbook over all defined sub-playbook inputs
  D. To loop the sub-playbook over all defined sub-playbook inputs

• Question 33:

  Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

  A. Set a field trigger script
  B. Associate to an incident type
  C. Change field type
  D. Change field name
  A. Set a field trigger script
  B. Associate to an incident type

  ---

  Explanation/Reference:

  Reference: https://docs.servicenow.com/bundle/quebec-it-service- management/page/product/incident- management/reference/incident-management- properties.html

• Question 34:

  Threat Intel search queries can be shared with which of the following?

  A. Users defined in the platform (email or username)
  B. Other organizations via the Marketplace
  C. Users outside XSOAR via email invite
  D. Roles defined in the platform
  B. Other organizations via the Marketplace

  ---

  Explanation/Reference:

• Question 35:

  Which option is available in XSOAR to create the body of a Threat Intel Report?

  A. Markdown
  B. Grid Fields
  C. DOC format
  D. Javascript
  A. Markdown

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.9/Cortex-XSOAR- Threat-Intel-Management-Guide/Create-a-Threat-Intel-Report

• Question 36:

  In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

  A. In repetitive process flows to iterate for each playbook input
  B. When continuously ingesting incidents from third-party systems
  C. In repetitive process flows with no more than 10 loops
  D. In repetitive processes that requires sub-playbook re-execution
  A. In repetitive process flows to iterate for each playbook input
  B. When continuously ingesting incidents from third-party systems

• Question 37:

  What is the correct expression to use when filtering only PDF files?

  A. Use File.Extension that does not equal (string comparison) PDF
  B. Use File.Name contains PDF
  C. Use File.Extension contains (general) PDF
  D. Use File.Extension equals (string comparison) PDF
  D. Use File.Extension equals (string comparison) PDF

• Question 38:

  DRAG DROP

  Match the corresponding action with the appropriate playbook tasks.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks-overview.html

• Question 39:

  What is the difference between labels and fields?

  A. Fields can be used in playbooks and labels cannot
  B. Fields are indexed in the database and labels are not
  C. Labels can be used in queries and fields cannot
  D. Labels are indexed in the database and fields are not
  C. Labels can be used in queries and fields cannot

• Question 40:

  Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

  A. Run Command, Export, and Close and Delete for all selected incidents regardless of their status
  B. Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status
  C. Run Command for all selected incidents having Active status
  D. Export incidents as JSON and change incident status
  A. Run Command, Export, and Close and Delete for all selected incidents regardless of their status
  B. Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status