Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 51:

  An analyst runs the following command in a playbook task:

  !ip ip=1.1.1.1

  Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

  A. Synchronous
  B. Extract
  C. Out of band
  D. Inline
  D. Inline

• Question 52:

  An administrator has noticed that an integration has failed to fetch incidents. Where would they go to download logs to troubleshoot the error?

  A. Go to the Marketplace > Download the Fix my XSOAR playbook pack > Run the playbook > Download logs from War Room
  B. Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs
  C. Dashboards and Reports > System Health
  D. Settings > About > System Diagnostics
  B. Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs

• Question 53:

  What is the function of timer SLA fields in Cortex XSOAR?

  A. To track SLA breaches per playbook
  B. To run a script that executes on SLA assignment
  C. To automatically alert the analyst on SLA breach
  D. To count the time between one or more tasks
  C. To automatically alert the analyst on SLA breach

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/cortex/cortex-xsoar//6-2/cortex-xsoar- admin/work-with-slas/create-an-sla-field

• Question 54:

  What is an example of a generic reputation command?

  A. !ip
  B. !getReputation
  C. !reputation
  D. !enrichIndicator
  C. !reputation

• Question 55:

  Which XSOAR architecture would be recommended for Managed Security Service Providers (MSSP)?

  A. Multi-region
  B. Dev-Prod
  C. Multi-tenant
  D. Distributed database
  C. Multi-tenant

  ---

  Explanation/Reference:

  Reference: https://www.ncsi.com/wp-content/uploads/2020/11/cortex-xsoar.pdf

• Question 56:

  Which two incident search queries are valid? (Choose two.)

  A. created:>="7 days"
  B. owner===admin
  C. role is Analyst
  D. status:closed –category:job
  A. created:>="7 days"
  D. status:closed –category:job

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/cortex-xsoar- overview/how-to-search-in-cortex-xsoar.html

• Question 57:

  At what stage during the incident lifecycle is an incident type assigned?

  A. Pre-processing
  B. Incident creation
  C. Classification
  D. Playbook execution
  C. Classification

• Question 58:

  What is the default configuration for indicator auto-extraction when incidents are created?

  A. Inline
  B. Inband
  C. None
  D. Out of band
  A. Inline

• Question 59:

  How long is the trial period for paid content packs?

  A. 30 days
  B. 14 days
  C. 7 days
  D. 60 days
  A. 30 days

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/marketplace/ marketplace-subscriptions.html

• Question 60:

  DRAG DROP

  Match the operations with the appropriate context.

  Select and Place:

  

  

  ---

  Explanation/Reference: