Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 61:

  Which three statements are true about the Marketplace? (Choose three.)

  A. Allows reverting back to a previous version of a content pack
  B. Enables users to participate in the community by sharing content
  C. Publishes content without additional review from the Cortex XSOAR team
  D. Allows uploading of content in additional languages
  E. Offers granularity in installation through content packs
  A. Allows reverting back to a previous version of a content pack
  B. Enables users to participate in the community by sharing content
  E. Offers granularity in installation through content packs

• Question 62:

  An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard. How can it be accomplished?

  A. Default Dashboard can be defined by `Role'
  B. Use the server configuration key: default.dashboards
  C. Save the dashboard as a widget and apply it to all users
  D. Right click on the dashboard tab and `Set as Default'
  A. Default Dashboard can be defined by `Role'

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent- admin/monitoring/cortex- xdr-dashboard/manage-dashboards.html

• Question 63:

  An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

  A. Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.
  B. SSH into the server and copy the indicator's database.
  C. In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.
  D. Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.
  C. In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

• Question 64:

  Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

  A. In the instance settings, enable the fetch incidents parameter and wait for one minute
  B. Create a one task playbook with a fetch-incident command
  C. execute !-fetch
  D. execute !-fetch
  A. In the instance settings, enable the fetch incidents parameter and wait for one minute
  C. execute !-fetch

  ---

  Explanation/Reference:

  Reference: https://xsoar.pan.dev/docs/integrations/fetching-incidents

• Question 65:

  Which two options may be added when a content pack is being installed? (Choose two.)

  A. Lists
  B. Roles
  C. Other content packs
  D. Indicator layouts
  A. Lists
  B. Roles

• Question 66:

  What is a primary use case of data collection tasks?

  A. To allow multi-QUESTION NO: surveys without authentication restrictions
  B. To automate tasks such as parsing a file or enriching indicators
  C. To generate new widgets for a dashboard
  D. To determine different paths in a playbook
  A. To allow multi-QUESTION NO: surveys without authentication restrictions

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar- admin/playbooks/playbook- tasks/communication-tasks/create-a-data-collection-task.html

• Question 67:

  Which three options can be defined in the layout settings? (Choose three.)

  A. Set of fields to present
  B. Permission to view the tab based on `Users'
  C. Permission to view the tab based on `Roles'
  D. Delete built-in tabs including the war room
  E. Dynamic sections
  A. Set of fields to present
  C. Permission to view the tab based on `Roles'
  E. Dynamic sections

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar- admin/incidents/customize- incident-view-layouts/customize-incident-layouts.html

• Question 68:

  Newly created subplaybooks do not have any inputs, or outputs. What is necessary to make them functional? (Choose two.)

  A. Define input key in the subplaybook task. Map context values to pull from parent playbook.
  B. The output of the previous task automatically becomes the input of the subplaybook.
  C. Map inputs and outputs to the parent playbook and the subplaybook will use the same values.
  D. Open the subplaybook and add inputs or outputs in the Playbook triggered task.
  A. Define input key in the subplaybook task. Map context values to pull from parent playbook.
  D. Open the subplaybook and add inputs or outputs in the Playbook triggered task.

• Question 69:

  What are two primary uses of standard tasks? (Choose two.)

  A. To highlight different paths in a playbook
  B. To generate new widgets for a dashboard
  C. To create an incident or escalate an existing incident
  D. To automate tasks such as parsing a file or enriching indicators
  C. To create an incident or escalate an existing incident
  D. To automate tasks such as parsing a file or enriching indicators

• Question 70:

  An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

  A. !incidentSet description="Confirmed Phishing"
  B. /incidentSet description=Confirmed Phishing
  C. !setIncident description="Confirmed Phishing"
  D. /setIncident description=Confirmed Phishing
  A. !incidentSet description="Confirmed Phishing"