Palo Alto Networks Palo Alto Certifications and Accreditations PCSAE Questions & Answers

• Question 41:

  How is data transferred between playbook tasks?

  A. Read/Write from context data

  B. Over war room results

  C. Input from the indicator page

  D. Directly from a previous task

  Correct Answer: A

• Question 42:

  Whar are possible war room result (entry) types?

  A. Context, file, error, image

  B. Note, indicator, error, image

  C. Video, file, error, image D. Note, file, error, image

  Correct Answer: B

• Question 43:

  An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands. What is the main concern when adding these commands?

  A. The commands must return a proper result to the war room for the analysts to understand

  B. The code may not be written to XSOAR standards

  C. The integrations are locked and cannot be edited with additional commands

  D. The custom integration will not be maintained and updated by XSOAR content team

  Correct Answer: C

• Question 44:

  What is the correct expression to use when filtering only PDF files?

  A. Use File.Extension that does not equal (string comparison) PDF

  B. Use File.Name contains PDF

  C. Use File.Extension contains (general) PDF

  D. Use File.Extension equals (string comparison) PDF

  Correct Answer: B

• Question 45:

  Which two incident search queries are valid? (Choose two.)

  A. created:>="7 days"

  B. owner===admin

  C. role is Analyst

  D. status:closed –category:job

  Correct Answer: AD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/cortex-xsoar-overview/how-to-search-in-cortex-xsoar.html

• Question 46:

  What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

  A. Process all alerts by running the respective playbook and link related incidents during post-processing

  B. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

  C. Configure a pre-process rule to link related events as they are ingested

  D. Manually go through the incidents created by the raw events and link related incidents

  Correct Answer: A

• Question 47:

  An engineer is developing a playbook that will be run multiple times for testing purposes.

  What is the recommended first task to be used in the playbook?

  A. DeleteContext

  B. GenerateTest

  C. PrintContext

  D. SetContext

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/integrations/test-playbooks

• Question 48:

  An incident field is created having the display name as Source_IP.

  How can the field be accessed?

  A. ${incident.sourceip}

  B. ${incident.Source_IP}

  C. ${incident.srcip}

  D. ${incident.Source IP}

  Correct Answer: C

• Question 49:

  An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

  Which command will accomplish this?

  A. run `ad-delete-user' command with `user-dn' arg and using-brand="Active Directory Query v2"

  B. run `ad-delete-user' command with `user-dn' arg and raw-response=true

  C. run `ad-delete-user' command with `user-dn' arg and ignore-outputs=true

  D. run `ad-delete-user' command with `user-dn' arg and using="Active Directory Query v2_instance_1"

  Correct Answer: A

• Question 50:

  Which XSOAR architecture would be recommended for Managed Security Service Providers (MSSP)?

  A. Multi-region

  B. Dev-Prod

  C. Multi-tenant

  D. Distributed database

  Correct Answer: C

  Reference: https://www.ncsi.com/wp-content/uploads/2020/11/cortex-xsoar.pdf