Palo Alto Networks Palo Alto Networks Certifications PCSAE Questions & Answers

• Question 81:

  What are two primary uses of standard tasks? (Choose two.)

  A. To highlight different paths in a playbook

  B. To generate new widgets for a dashboard

  C. To create an incident or escalate an existing incident

  D. To automate tasks such as parsing a file or enriching indicators

  Correct Answer: CD

• Question 82:

  An incident field is created having the display name as Source_IP. How can the field be accessed?

  A. ${incident.sourceip}

  B. ${incident.Source_IP}

  C. ${incident.srcip}

  D. ${incident.Source IP}

  Correct Answer: C

• Question 83:

  An engineer notices that playbooks only start once the user clicks the `investigate' button and he/she would like the playbook to start automatically.

  How can this be implemented?

  A. Add the playbook to the integration's settings

  B. Select `Run playbook automatically' from the incident type settings

  C. Add the !startinvestigation automation to the beginning of the playbook

  D. Select `Run playbook automatically' from the integration settings

  Correct Answer: B

• Question 84:

  Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

  A. The 'Fetches Incidents' option may not have been enabled

  B. There are no new events from the external service

  C. The first fetch should be manually triggered to start the fetching process

  D. It can take up to 1-hour before incidents are initially fetched

  Correct Answer: AB

• Question 85:

  An Engineer wants to filter a csvList value according to a dynamic value saved under the test context key.

  Which three values would save the test context key? (Choose three.)

  A. Get csvList.value where csvList.value equals test [from previous tasks]

  B. Get csvList.value where csvList.value equals ${test} [from previous tasks]

  C. Get csvList.value where csvList.value equals test {}[from previous tasks]

  D. Get csvList.value where csvList.value equals test [as value]

  E. Get csvList.value where csvList.value equals ${test} [as value]

  Correct Answer: ABE

• Question 86:

  What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

  A. Process all alerts by running the respective playbook and link related incidents during post-processing

  B. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

  C. Configure a pre-process rule to link related events as they are ingested

  D. Manually go through the incidents created by the raw events and link related incidents

  Correct Answer: C

• Question 87:

  Where can engineers add the post-processing scripts to incidents?

  A. The post-processing tag must be added to the automation

  B. Post-processing scripts must be added at the end of playbooks

  C. Post-processing scripts must be added from the Incident Type editor

  D. Post-processing scripts must be added from the Post-Process Rules editor

  Correct Answer: C

• Question 88:

  Reliability scores in XSOAR range from A through F. What do A and F stand for?

  A. F - Reliability cannot be judged, A - Completely Reliable

  B. F - Not reliable, A - Usually Reliable

  C. F - Not usually reliable, A - Fairly Reliable

  D. F - Unreliable, A - Completely Reliable

  Correct Answer: D

• Question 89:

  DRAG DROP

  Match the corresponding action with the appropriate playbook tasks.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks-overview.html

• Question 90:

  DRAG DROP

  Arrange these steps in the order that they occur during an incident fetch.

  Select and Place:

  

  Correct Answer: