Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 51:

  Which of the following is a basic setting that can be configured in an automation?

  A. Summary

  B. Compiler

  C. Schedule

  D. Run On

  Correct Answer: C

• Question 52:

  When uploading content, which two options could the upload include? (Choose two.)

  A. Indicators

  B. Incidents

  C. Reports

  D. Fields

  Correct Answer: AB

• Question 53:

  When creating an incident layout section, it is best to place long field values within which of the following?

  A. Section headers

  B. Rows

  C. Canvas

  D. Cards

  Correct Answer: B

• Question 54:

  Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

  A. Create content and add it to the standard content by contributing through the Marketplace

  B. Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

  C. Create a support ticket with the custom content for review by the support team

  D. Any custom content will be automatically uploaded to the content repository

  Correct Answer: AD

• Question 55:

  Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

  A. Live backup (disaster recovery)

  B. Distributed database

  C. Backup data to XSOAR engines

  D. Local backup

  Correct Answer: AC

• Question 56:

  An analyst runs the following command in a playbook task:

  !ip ip=1.1.1.1

  Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

  A. Synchronous

  B. Extract

  C. Out of band

  D. Inline

  Correct Answer: D

• Question 57:

  Which two functions in XSOAR are incident types used for? (Choose two.)

  A. To run dedicated playbooks for different event types

  B. To classify events ingested from various sources into the relevant types

  C. To classify indicators extracted in XSOAR incidents to their respective types

  D. To facilitate role based access to XSOAR incidents

  Correct Answer: BC

• Question 58:

  By default, which components does an XSOAR implementation include?

  A. XSOAR server, XSOAR engine

  B. Application server, distributed DB server

  C. Application server, distributed DB server, Backup server

  D. All in one server

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/installation/install- demisto-on-a-physical-or-virtual-server.html

• Question 59:

  What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

  A. Inputs are data pieces that are present in the playbook

  B. Inputs are data pieces that are present in the task

  C. Outputs are used as incident trigger for playbook

  D. Outputs can be derived from the result of a task or command

  E. Inputs are the data fields parsed by the Classifier

  Correct Answer: ADE

• Question 60:

  Threat Intel search queries can be shared with which of the following?

  A. Users defined in the platform (email or username)

  B. Other organizations via the Marketplace

  C. Users outside XSOAR via email invite

  D. Roles defined in the platform

  Correct Answer: B