Free PCSAE Exam Dumps Preview

Question 1

Multiple choice

Which three actions can an engineer take on the troubleshooting page? (Choose three.)

1. A

   Download the debug log bundle

2. B

   Put the XSOAR server in maintenance mode

3. C

   View and modify server configuration settings

4. D

   Export and import custom content

5. E

   View a list of server administrators

Reveal answer details Close answer details

Correct answersA, B, C

Question 2

Single choice

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

Which command will accomplish this?

1. A

   run `ad-delete-user' command with `user-dn' arg and using-brand="Active Directory Query v2"

2. B

   run `ad-delete-user' command with `user-dn' arg and raw-response=true

3. C

   run `ad-delete-user' command with `user-dn' arg and ignore-outputs=true

4. D

   run `ad-delete-user' command with `user-dn' arg and using="Active Directory Query v2_instance_1"

Reveal answer details Close answer details

Correct answerD

Question 3

Multiple choice

Which three statements are true about the Marketplace? (Choose three.)

1. A

   Allows reverting back to a previous version of a content pack

2. B

   Enables users to participate in the community by sharing content

3. C

   Publishes content without additional review from the Cortex XSOAR team

4. D

   Allows uploading of content in additional languages

5. E

   Offers granularity in installation through content packs

Reveal answer details Close answer details

Correct answersA, B, E

Question 4

Multiple choice

Which of the following are valid methods to contribute custom content? (Choose three.)

1. A

   Submit content directly through feature requests

2. B

   Private GitHub repository submission for premium content

3. C

   A Github pull request on the public XSOAR Content Repository

4. D

   Using the marketplace interface to upload the content

5. E

   Using the content submission tool on live.paloaltonetworks.com

Reveal answer details Close answer details

Correct answersC, D, E

Question 5

Multiple choice

When uploading content, which two options could the upload include? (Choose two.)

1. A

   Indicators

2. B

   Incidents

3. C

   Reports

4. D

   Fields

Reveal answer details Close answer details

Correct answersA, B

Question 6

Multiple choice

Which two incident search queries are valid? (Choose two.)

1. A

   created:>="7 days"

2. B

   owner===admin

3. C

   role is Analyst

4. D

   status:closed -category:job

Reveal answer details Close answer details

Correct answersA, D

Explanation

References:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/cortex-xsoar-overview/how-to-search-in-cortex-xsoar.html

Question 7

Single choice

An analyst runs the following command in a playbook task:

!ip ip=1.1.1.1

Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

1. A

   Synchronous

2. B

   Extract

3. C

   Out of band

4. D

   Inline

Reveal answer details Close answer details

Correct answerD

Question 8

Multiple choice

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

1. A

   Use a field of Number to count the number of seconds elapsed between two tasks

2. B

   After the playbook has run, calculate the total time taken and set the timer field with this value

3. C

   To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer

4. D

   From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Reveal answer details Close answer details

Correct answersC, D

Question 9

Multiple choice

Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

1. A

   Set a field trigger script

2. B

   Associate to an incident type

3. C

   Change field type

4. D

   Change field name

Reveal answer details Close answer details

Correct answersA, B

Explanation

References:
https://docs.servicenow.com/bundle/quebec-it-service-management/page/product/incident-management/reference/incident-management-properties.html

Question 10

Single choice

Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

1. A

   A content repository specified in the Marketplace

2. B

   Remote git repository specified in the dev-prod configuration parameters

3. C

   The development server's default repository

4. D

   Cortex XSOAR public content repository

Reveal answer details Close answer details

Correct answerB

Question 11

Drag & drop

DRAG DROP

Match the corresponding action with the appropriate playbook tasks.

Reveal answer details Close answer details

Explanation

References:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks-overview.html

Question 12

Single choice

Where can engineers add the post-processing scripts to incidents?

1. A

   The post-processing tag must be added to the automation

2. B

   Post-processing scripts must be added at the end of playbooks

3. C

   Post-processing scripts must be added from the Incident Type editor

4. D

   Post-processing scripts must be added from the Post-Process Rules editor

Reveal answer details Close answer details

Correct answerC

Question 13

Single choice

In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?

1. A

   Cron job

2. B

   Time triggered job

3. C

   Feed triggered job

4. D

   REST API job

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Create-Indicator-Extract-Rules-for-a-Playbook-Task

Question 14

Single choice

What is the correct expression to use when filtering only PDF files?

1. A

   Use File.Extension that does not equal (string comparison) PDF

2. B

   Use File.Name contains PDF

3. C

   Use File.Extension contains (general) PDF

4. D

   Use File.Extension equals (string comparison) PDF

Reveal answer details Close answer details

Correct answerD

Question 15

Single choice

Management would like to get an incident report automatically following an incident's closure.

How would this be accomplished?

1. A

   Define a task in a playbook to generate an incident report before the closure occurs

2. B

   Manually create an `Incident Report'

3. C

   Configure post-processing using a script

4. D

   Create an `Incident Report' from the Reports page

Reveal answer details Close answer details

Correct answerC

Question 16

Multiple choice

Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

1. A

   Create content and add it to the standard content by contributing through the Marketplace

2. B

   Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

3. C

   Create a support ticket with the custom content for review by the support team

4. D

   Any custom content will be automatically uploaded to the content repository

Reveal answer details Close answer details

Correct answersA, D

Question 17

Single choice

How is data transferred between playbook tasks?

1. A

   Read/Write from context data

2. B

   Over war room results

3. C

   Input from the indicator page

4. D

   Directly from a previous task

Reveal answer details Close answer details

Correct answerA

Question 18

Single choice

What assigns newly ingested event attributes to incident fields?

1. A

   Playbooks

2. B

   Classification

3. C

   Mapping

4. D

   Layouts

Reveal answer details Close answer details

Correct answerC

Question 19

Single choice

While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing.

How can this be fixed?

1. A

   Define the Incident Fetch Interval when running the integration's commands.

2. B

   Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.

3. C

   Configure the application to send incidents on the required interval.

4. D

   Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.

Reveal answer details Close answer details

Correct answerA

Question 20

Single choice

An administrator wants to send an email via the Mail Sender integration.

Which of the following out of the box methods would be used for that?

1. A

   XSOAR D2 agent

2. B

   external integration command

3. C

   XSOAR shared agent

4. D

   common automation script

Reveal answer details Close answer details

Correct answerB

Question 21

Multiple choice

Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

1. A

   Live backup (disaster recovery)

2. B

   Distributed database

3. C

   Backup data to XSOAR engines

4. D

   Local backup

Reveal answer details Close answer details

Correct answersA, C

Question 22

Single choice

You need to retrieve a list of all malicious hashes over the last 30 days.

What is the correct query to use?

1. A

   type:File reputation:Malicious sourcetimestamp:"30 days ago"

2. B

   type:File verdict:Malicious sourcetimestamp:<="30 days ago"

3. C

   type:File reputation:Malicious sourcetimestamp:="30 days ago"

4. D

   type:File verdict:Malicious sourcetimestamp:>="30 days ago"

Reveal answer details Close answer details

Correct answerA

Question 23

Multiple choice

You can customize most aspects of the incident layout, including which three of the following? (Choose three.)

1. A

   Which users have permissions to view the tabs

2. B

   Which roles have permissions to view the tabs

3. C

   Which dashboard settings are applied

4. D

   The information and how is it displayed

5. E

   Which tabs appear and in which order

Reveal answer details Close answer details

Correct answersC, D, E

Question 24

Single choice

Which built-in automation/command cab be used to change an incident's type?

1. A

   setIncident

2. B

   Set

3. C

   GetFieldsByIncidentType

4. D

   modifyIncidentFields

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/incidents/incidents-management/incident-fields/field-trigger-scripts.html