Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 41:

  Which three authentication methods are supported when logging into XSOAR? (Choose three.)

  A. OTP token

  B. User name and password

  C. SAML

  D. Active Directory authentication

  E. RADIUS

  Correct Answer: CDE

  Reference: https://www.paloguard.com/GlobalProtect.asp

• Question 42:

  Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

  A. Run Command, Export, and Close and Delete for all selected incidents regardless of their status

  B. Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

  C. Run Command for all selected incidents having Active status

  D. Export incidents as JSON and change incident status

  Correct Answer: AB

• Question 43:

  Which three actions can an engineer take on the troubleshooting page? (Choose three.)

  

  A. Download the debug log bundle

  B. Put the XSOAR server in maintenance mode

  C. View and modify server configuration settings

  D. Export and import custom content

  E. View a list of server administrators

  Correct Answer: ABC

• Question 44:

  Whar are possible war room result (entry) types?

  A. Context, file, error, image

  B. Note, indicator, error, image

  C. Video, file, error, image

  D. Note, file, error, image

  Correct Answer: B

• Question 45:

  Which option is available in XSOAR to create the body of a Threat Intel Report?

  A. Markdown

  B. Grid Fields

  C. DOC format

  D. Javascript

  Correct Answer: A

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.9/Cortex-XSOAR- Threat-Intel-Management-Guide/Create-a-Threat-Intel-Report

• Question 46:

  Which two options may be added when a content pack is being installed? (Choose two.)

  A. Lists

  B. Roles

  C. Other content packs

  D. Indicator layouts

  Correct Answer: AB

• Question 47:

  Incidents need to be filtered by all of the following criteria:

  1.Status -Pending 2.Exclude Category -Job 3.Severity -High 4.Owner -None (No owner assigned) 5.Type -Phishing 6.Email Subject -"You have won a million dollars"

  What is the correct query syntax for the above incident search filter?

  A. status==“Pending“ andand category!=”job” andand severity==”High” andand owner==”None” andand type==”Phishing” andand emailsubject==”You have won a million dollars”

  B. Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars

  C. status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

  D. status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5- a698-08b5710196d3

• Question 48:

  How would context data be filtered to receive only malicious indicator values with DBotScore?

  A. Get DBotScore.value where DBotScore.Score (Larger or equals) 4

  B. Get DBotScore.value where DBotScore.Score (equals (int)) 3

  C. Get DBotScore where DBotScore.Score (Larger than) 1

  D. Get DBotScore where DBotScore.Score (Larger or equals) 2

  Correct Answer: B

  Reference:

  https://github.com/demisto/content/blob/master//Packs/DeprecatedContent/Integrations/ PaloAlto_MineMeld/README.md

• Question 49:

  An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.

  Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

  A. Open a ticket with the XSOAR support team

  B. Create a pull request directly on Github

  C. Contribute through the XSOAR UI

  D. Send an email to [email protected]

  Correct Answer: BC

• Question 50:

  Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

  A. Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.

  B. Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

  C. Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page.

  D. Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

  Correct Answer: D