Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 71:

  An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard. How can it be accomplished?

  A. Default Dashboard can be defined by `Role'

  B. Use the server configuration key: default.dashboards

  C. Save the dashboard as a widget and apply it to all users

  D. Right click on the dashboard tab and `Set as Default'

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent- admin/monitoring/cortex- xdr-dashboard/manage-dashboards.html

• Question 72:

  An engineer would like to change an incident's SLA according to the severity field changes. How can the engineer achieve this task?

  A. Use a field trigger script

  B. Use a field display script

  C. Create a job that queries for incident severity changes

  D. Change the SLA manually every time the severity changes

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/incidents/incident-fields

• Question 73:

  During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.

  Which of the following set of steps can help to resolve the issue?

  A. Navigate to Settings View the configured integrations and select Active Directory Authentication Delete all integration instances and add all integration instances again

  B. Navigate to Marketplace View the installed content pack and select Active Directory content pack Select version 1.4.6 and click on "Revert to this version"

  C. Navigate to Settings View the configured integrations and select Active Directory Query Delete all integration instances and add all integration instances again

  D. Navigate to Marketplace View the installed content pack and select Active Directory content pack Click on uninstall content pack Navigate to Marketplace browser and reinstall the Active Directory content pack

  Correct Answer: C

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.8/Cortex-XSOAR- Administrator-Guide/Content-Pack-Update-Notifications

• Question 74:

  Which three support types are included in the Marketplace Content Packs? (Choose three.)

  A. Customer supported

  B. Contex XSOAR supported

  C. Community supported

  D. Partner supported

  E. Prisma Cloud supported

  Correct Answer: BCD

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/marketplace/ marketplace-overview/content-packs-support-types.html

• Question 75:

  Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

  A. Marketplace access

  B. Application with API

  C. Private key/Public key integration

  D. Multitenant deployment

  Correct Answer: B

• Question 76:

  An engineer is developing a playbook that will be run multiple times for testing purposes. What is the recommended first task to be used in the playbook?

  A. DeleteContext

  B. GenerateTest

  C. PrintContext

  D. SetContext

  Correct Answer: A

  Reference: https://xsoar.pan.dev/docs/integrations/test-playbooks

• Question 77:

  An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

  A. The new job form changes based on the threat intel feed integration configuration

  B. The new job form can be edited from the Indicator Feed incident type editor

  C. The new job form for a threat intel feed job cannot be edited

  D. The new job form can be edited from the threat intel feeds integration settings

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat- intel-management- guide/manage-indicators/understand-indicators/create-a-feed-based- job.html

• Question 78:

  An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?

  A. Create a new indicator type and disable the built-in IP indicator

  B. Edit the regex of the default IP Indicator

  C. Add a new server configuration key that will overwrite the default regex of the IP indicator

  D. Delete the default IP indicator

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/manage-indicators/ understand-indicators/indicator-types/indicator-type-profile.html

• Question 79:

  Which investigation element is best suited for collaboration among users?

  A. Work Plan

  B. Related Incidents

  C. War Room

  D. Context Data

  Correct Answer: D

  Reference: https://blog.paloaltonetworks.com/2020/01/cortex-security-operations/

• Question 80:

  A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

  A. -status:closed -category:job type:Phishing created:>="30 days ago"

  B. status:closed -category:job and type:Phishing created:>="30 days ago"

  C. -status:closed -category:job and type:Phishing created:<="30 days ago"

  D. -status:closed -category:job type:Phishing created:="30 days ago"

  Correct Answer: C