Summer Special - 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: c4sdisc65

PCSAE PDF

$38.5

$109.99

3 Months Free Update

  • Printable Format
  • Value of Money
  • 100% Pass Assurance
  • Verified Answers
  • Researched by Industry Experts
  • Based on Real Exams Scenarios
  • 100% Real Questions

PCSAE PDF + Testing Engine

$61.6

$175.99

3 Months Free Update

  • Exam Name: Palo Alto Networks Certified Security Automation Engineer
  • Last Update: May 29, 2024
  • Questions and Answers: 156
  • Free Real Questions Demo
  • Recommended by Industry Experts
  • Best Economical Package
  • Immediate Access

PCSAE Engine

$46.2

$131.99

3 Months Free Update

  • Best Testing Engine
  • One Click installation
  • Recommended by Teachers
  • Easy to use
  • 3 Modes of Learning
  • State of Art Technology
  • 100% Real Questions included

PCSAE Practice Exam Questions with Answers Palo Alto Networks Certified Security Automation Engineer Certification

Question # 6

An engineer is developing a playbook that will be run multiple times for testing purposes. What is the recommended first task to be used in the playbook?

A.

DeleteContext

B.

GenerateTest

C.

PrintContext

D.

SetContext

Full Access
Question # 7

Which component can be part of a load balancing group?

A.

Distributed database

B.

D2 agent

C.

Engine

D.

Load balancing server

Full Access
Question # 8

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

A.

Use a field of Number to count the number of seconds elapsed between two tasks

B.

After the playbook has run, calculate the total time taken and set the timer field with this value

C.

To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer

D.

From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Full Access
Question # 9

In which two options can an automation script be executed? (Choose two.)

A.

Engine

B.

Integration

C.

War room

D.

Playbook

Full Access
Question # 10

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.

Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

A.

Open a ticket with the XSOAR support team

B.

Create a pull request directly on Github

C.

Contribute through the XSOAR UI

D.

Send an email to contributions@xsoar.com

Full Access
Question # 11

Which three actions can an engineer take on the troubleshooting page? (Choose three.)

PCSAE question answer

A.

Download the debug log bundle

B.

Put the XSOAR server in maintenance mode

C.

View and modify server configuration settings

D.

Export and import custom content

E.

View a list of server administrators

Full Access
Question # 12

Which method accesses a field called ‘User Mail’ in a playbook?

A.

${incident.usermail}

B.

${incident.User Mail}

C.

${incident.UserMail}

D.

${usermail}

Full Access
Question # 13

What will happen if a playbook debugger is left running for more than 24 hours?

A.

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

B.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

C.

The session will be running till stopped manually by administrator.

D.

By default, the system closes automatically any debugger session that have been open 180 minutes.

Full Access
Question # 14

Which two functions in XSOAR are incident types used for? (Choose two.)

A.

To run dedicated playbooks for different event types

B.

To classify events ingested from various sources into the relevant types

C.

To classify indicators extracted in XSOAR incidents to their respective types

D.

To facilitate role based access to XSOAR incidents

Full Access
Question # 15

When browsing the Marketplace for new content packs, which details about each pack are you able to view?

A.

The integration’s source code

B.

A summary of each version history

C.

A test instance for the content pack

D.

The source code of each playbook

Full Access
Question # 16

You can customize most aspects of the incident layout, including which three of the following? (Choose three.)

A.

Which users have permissions to view the tabs

B.

Which roles have permissions to view the tabs

C.

Which dashboard settings are applied

D.

The information and how is it displayed

E.

Which tabs appear and in which order

Full Access
Question # 17

In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

A.

Inputs and outputs

B.

Through integration context

C.

Automatically extracted by sub-playbooks

D.

From context data, if context is shared globally

Full Access
Question # 18

Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

A.

Add a distributed database server

B.

Add an indexing server

C.

Add a live backup server (disaster recovery)

D.

Add an engine

Full Access
Question # 19

An administrator has noticed that an integration has failed to fetch incidents. Where would they go to download logs to troubleshoot the error?

A.

Go to the Marketplace > Download the Fix my XSOAR playbook pack > Run the playbook > Download logs from War Room

B.

Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs

C.

Dashboards & Reports > System Health

D.

Settings > About > System Diagnostics

Full Access
Question # 20

For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

A.

/var/lib/demisto

B.

/tmp/log/demisto

C.

/usr/local/demisto

D.

/var/log/demisto

Full Access
Question # 21

A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

A.

Manually share the dashboard through user emails

B.

Dashboard is shared to all XSOAR users

C.

Propagate the dashboard based on SAML authentication

D.

Dashboard is shared to all XSOAR users in a selected role

Full Access
Question # 22

When mapping incoming data to incident fields, which statement is correct?

A.

Data that is not mapped is placed under labels

B.

Only text fields are classified

C.

Classification cannot be used if mapping is enabled

D.

Every incoming field must be mapped

Full Access
Question # 23

An incident field is created having the display name as Source_IP. How can the field be accessed?

A.

${incident.sourceip}

B.

${incident.Source_IP}

C.

${incident.srcip}

D.

${incident.Source IP}

Full Access
Question # 24

Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?

A.

Download the content from the Marketplace.

B.

Go to Settings > About >Troubleshooting and set a flag to allow custom content.

C.

Register a user account with support.paloaltonetworks.com .

D.

Detach the content item you want to edit from the Marketplace.

Full Access
Question # 25

Given an incident with three files, how could the name of the second file be referenced?

A.

${Files.[2].Name}

B.

${Files.Name.[2]}

C.

${File.[1].Name}

D.

${File.Name.[1]}

Full Access
Question # 26

What are two primary uses of standard tasks? (Choose two.)

A.

To highlight different paths in a playbook

B.

To generate new widgets for a dashboard

C.

To create an incident or escalate an existing incident

D.

To automate tasks such as parsing a file or enriching indicators

Full Access
Question # 27

Which two reasons would lead an engineer to create a custom widget? (Choose two.)

A.

To visualize server configuration keys

B.

To visualize XSOAR list data

C.

To visualize complex incident data calculations

D.

To visualize context data

E.

To visualize a custom query

Full Access
Question # 28

Which three types of information are displayed on the incident Quick View? (Choose three.)

A.

Indicators and relationships

B.

Timeline information

C.

Evidence Board

D.

Context data

E.

Incident severity

Full Access
Question # 29

An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically.

How can this be implemented?

A.

Add the playbook to the integration’s settings

B.

Select ‘Run playbook automatically’ from the incident type settings

C.

Add the !startinvestigation automation to the beginning of the playbook

D.

Select ‘Run playbook automatically’ from the integration settings

Full Access
Question # 30

What is used to trigger playbooks automatically based on the classification of an incident?

A.

Indicator type

B.

Incoming mapper

C.

Incident types

D.

Integration configuration

Full Access
Question # 31

Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

A.

Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.

B.

Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

C.

Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page.

D.

Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

Full Access
Question # 32

An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard.

How can it be accomplished?

A.

Default Dashboard can be defined by ‘Role’

B.

Use the server configuration key: default.dashboards

C.

Save the dashboard as a widget and apply it to all users

D.

Right click on the dashboard tab and ‘Set as Default’

Full Access
Question # 33

What does Script helper contain?

A.

Available commands

B.

Permission settings

C.

Automation version history

D.

Automation timeout configuration

Full Access
Question # 34

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

A.

-status:closed -category:job type:Phishing created:>="30 days ago"

B.

status:closed -category:job & type:Phishing created:>="30 days ago"

C.

-status:closed -category:job & type:Phishing created:<="30 days ago"

D.

-status:closed -category:job type:Phishing created:="30 days ago"

Full Access
Question # 35

Which of the following are valid methods to contribute custom content? (Choose three.)

A.

Submit content directly through feature requests

B.

Private GitHub repository submission for premium content

C.

A Github pull request on the public XSOAR Content Repository

D.

Using the marketplace interface to upload the content

E.

Using the content submission tool on live.paloaltonetworks.com

Full Access
Question # 36

Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

A.

A content repository specified in the Marketplace

B.

Remote git repository specified in the dev-prod configuration parameters

C.

The development server's default repository

D.

Cortex XSOAR public content repository

Full Access
Question # 37

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:

PCSAE question answer

The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

A.

XSOAR D2 Agents, to send the required emails.

B.

An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

C.

Another XSOAR server that uses the same license as their primary XSOAR server.

D.

A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

Full Access
Question # 38

Which option is available in XSOAR to create the body of a Threat Intel Report?

A.

Markdown

B.

Grid Fields

C.

DOC format

D.

Javascript

Full Access
Question # 39

Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

A.

Create content and add it to the standard content by contributing through the Marketplace

B.

Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

C.

Create a support ticket with the custom content for review by the support team

D.

Any custom content will be automatically uploaded to the content repository

Full Access
Question # 40

Whar are possible war room result (entry) types?

A.

Context, file, error, image

B.

Note, indicator, error, image

C.

Video, file, error, image

D.

Note, file, error, image

Full Access
Question # 41

Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

A.

reputation-script

B.

enrich

C.

reputationScript

D.

reputation

Full Access
Question # 42

Which two options will troubleshoot an integration’s fetch incidents command? (Choose two.)

A.

In the instance settings, enable the fetch incidents parameter and wait for one minute

B.

Create a one task playbook with a fetch-incident command

C.

execute !-fetch

D.

execute !-fetch

Full Access
Question # 43

In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

A.

The audit log

B.

The log bundle

C.

The source code for an integration

D.

The error message returned directly below the button

E.

The playground war room

Full Access
Question # 44

Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

A.

Python

B.

Perl

C.

Go

D.

JavaScript

E.

Powershell

Full Access
Question # 45

An automation returned an output called: csvReport.

What filter would be used to check if the automation returned results?

A.

Contains/Includes

B.

Equals/Matches

C.

In/In list

D.

Is defined/Exist

Full Access
Question # 46

Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

A.

Run Command, Export, and Close and Delete for all selected incidents regardless of their status

B.

Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

C.

Run Command for all selected incidents having Active status

D.

Export incidents as JSON and change incident status

Full Access