Palo Alto Networks PCSAE Online Practice Questions and Exam Preparation

Palo Alto Networks PCSAE Online Questions & Answers

• Question 81:

  What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

  A. Process all alerts by running the respective playbook and link related incidents during post-processing
  B. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together
  C. Configure a pre-process rule to link related events as they are ingested
  D. Manually go through the incidents created by the raw events and link related incidents
  C. Configure a pre-process rule to link related events as they are ingested

• Question 82:

  Where are incident layouts customized?

  A. Settings > Object Setup > Incidents > Layouts
  B. Settings > Integrations > Instance configuration
  C. Settings > Object Setup > Indicators > Layouts
  D. Settings > Advanced > Incident Layouts
  A. Settings > Object Setup > Incidents > Layouts

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOAR- Administrator-Guide/Customize-Incident-Layouts

• Question 83:

  Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

  A. When creating incidents from the XSOAR REST API
  B. When manually creating an incident from the UI
  C. When adding a new analyst account to XSOAR
  D. When fetching many different incident types from a single mailbox
  A. When creating incidents from the XSOAR REST API
  B. When manually creating an incident from the UI

• Question 84:

  You can customize most aspects of the incident layout, including which three of the following? (Choose three.)

  A. Which users have permissions to view the tabs
  B. Which roles have permissions to view the tabs
  C. Which dashboard settings are applied
  D. The information and how is it displayed
  E. Which tabs appear and in which order
  C. Which dashboard settings are applied
  D. The information and how is it displayed
  E. Which tabs appear and in which order

• Question 85:

  An engineer notices that playbooks only start once the user clicks the `investigate' button and he/she would like the playbook to start automatically.

  How can this be implemented?

  A. Add the playbook to the integration's settings
  B. Select `Run playbook automatically' from the incident type settings
  C. Add the !startinvestigation automation to the beginning of the playbook
  D. Select `Run playbook automatically' from the integration settings
  B. Select `Run playbook automatically' from the incident type settings

• Question 86:

  The default expiration method for non-feed indicators is either to never expire or to expire after a specific period of time. How frequently does XSOAR check tor newly expired indicators?

  A. Every 24 hours
  B. Every 5 minutes
  C. Every 8 hours
  D. Every 1 hour
  D. Every 1 hour

  ---

  Explanation/Reference:

  Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR- Threat-Intel-Management-Guide/Indicator-Expiration

• Question 87:

  What is used to trigger playbooks automatically based on the classification of an incident?

  A. Indicator type
  B. Incoming mapper
  C. Incident types
  D. Integration configuration
  C. Incident types

• Question 88:

  What will happen if a playbook debugger is left running for more than 24 hours?

  A. By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.
  B. The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.
  C. The session will be running till stopped manually by administrator.
  D. By default, the system closes automatically any debugger session that have been open 180 minutes.
  D. By default, the system closes automatically any debugger session that have been open 180 minutes.

• Question 89:

  What assigns newly ingested event attributes to incident fields?

  A. Playbooks
  B. Classification
  C. Mapping
  D. Layouts
  C. Mapping

• Question 90:

  Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

  A. Marketplace access
  B. Application with API
  C. Private key/Public key integration
  D. Multitenant deployment
  B. Application with API