Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 71:

  An administrator wants to send an email via the Mail Sender integration. Which of the following out of the box methods would be used for that?

  A. XSOAR D2 agent
  B. external integration command
  C. XSOAR shared agent
  D. common automation script
  B. external integration command

• Question 72:

  An engineer's organization system is registered in the following manner: . The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be

  created as a separate `User' indicator automatically once a system is found.

  What is the most efficient way for the engineer to achieve this?

  A. Create a custom indicator field named `username' and link it to the internal system indicator
  B. Change the reputation command for the internal system indicator type
  C. Create a new indicator type of the internal username and set a formatting script to extract only the username
  D. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning
  C. Create a new indicator type of the internal username and set a formatting script to extract only the username

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat- intel-management- guide/manage-indicators/understand-indicators/indicator- types/indicator-type-profile

• Question 73:

  Which of the following is a basic setting that can be configured in an automation?

  A. Summary
  B. Compiler
  C. Schedule
  D. Run On
  C. Schedule

• Question 74:

  A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

  A. -status:closed -category:job type:Phishing created:>="30 days ago"
  B. status:closed -category:job and type:Phishing created:>="30 days ago"
  C. -status:closed -category:job and type:Phishing created:
  D. -status:closed -category:job type:Phishing created:="30 days ago"
  C. -status:closed -category:job and type:Phishing created:

• Question 75:

  In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

  A. The audit log
  B. The log bundle
  C. The source code for an integration
  D. The error message returned directly below the button
  E. The playground war room
  B. The log bundle
  C. The source code for an integration
  D. The error message returned directly below the button

• Question 76:

  Which three support types are included in the Marketplace Content Packs? (Choose three.)

  A. Customer supported
  B. Contex XSOAR supported
  C. Community supported
  D. Partner supported
  E. Prisma Cloud supported
  B. Contex XSOAR supported
  C. Community supported
  D. Partner supported

  ---

  Explanation/Reference:

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar- admin/marketplace/ marketplace-overview/content-packs-support-types.html

• Question 77:

  Given the following context data, what would be the expected output of the expression?

  A. 1E56733826E5035233A097FCEA2046AF96EC616C
  B. E6EF5142E2553C1E442A0FFAC07636EAC61E6EDD
  C. 8D193FA162A305E4859BA8C45F5121F7265E3ABB
  D. e6ef5142e2553c1e442a0ffac07636eac61e6edd
  D. e6ef5142e2553c1e442a0ffac07636eac61e6edd

• Question 78:

  Which content type cannot be managed using remote repositories?

  A. Lists
  B. Jobs
  C. Pre-processing rules
  D. Exclusion List
  A. Lists

• Question 79:

  Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

  A. A content repository specified in the Marketplace
  B. Remote git repository specified in the dev-prod configuration parameters
  C. The development server's default repository
  D. Cortex XSOAR public content repository
  B. Remote git repository specified in the dev-prod configuration parameters

• Question 80:

  An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.

  Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

  A. Open a ticket with the XSOAR support team
  B. Create a pull request directly on Github
  C. Contribute through the XSOAR UI
  D. Send an email to [email protected]
  B. Create a pull request directly on Github
  C. Contribute through the XSOAR UI