Get Palo Alto Networks PCSAE Dumps Questions Study Exam Guide Apr 24, 2023
PCSAE Premium Exam Engine - Download Free PDF Questions
How much Palo Alto Networks Certified Security Automation Engineer costs
- Examination Name: Palo Alto PCSAE
- Length of Exam: 120 min
- Types of inquiries: Performance
- Passing Score: 70% or higher
NEW QUESTION 67
Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?
- A. enrich
- B. reputation-script
- C. reputationScript
- D. reputation
Answer: C
NEW QUESTION 68
In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)
- A. In repetitive process flows to iterate for each playbook input
- B. In repetitive process flows with no more than 10 loops
- C. When continuously ingesting incidents from third-party systems
- D. In repetitive processes that requires sub-playbook re-execution
Answer: A,C
NEW QUESTION 69
What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?
- A. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together
- B. Configure a pre-process rule to link related events as they are ingested
- C. Manually go through the incidents created by the raw events and link related incidents
- D. Process all alerts by running the respective playbook and link related incidents during post-processing
Answer: D
NEW QUESTION 70
Newly created subplaybooks do not have any inputs, or outputs. What is necessary to make them functional? (Choose two.)
- A. Map inputs and outputs to the parent playbook and the subplaybook will use the same values.
- B. The output of the previous task automatically becomes the input of the subplaybook.
- C. Define input key in the subplaybook task. Map context values to pull from parent playbook.
- D. Open the subplaybook and add inputs or outputs in the Playbook triggered task.
Answer: C,D
NEW QUESTION 71
Which three statements are true about the Marketplace? (Choose three.)
- A. Allows reverting back to a previous version of a content pack
- B. Publishes content without additional review from the Cortex XSOAR team
- C. Offers granularity in installation through content packs
- D. Enables users to participate in the community by sharing content
- E. Allows uploading of content in additional languages
Answer: B,D,E
NEW QUESTION 72
An engineer notices that playbooks only start once the user clicks the 'investigate' button and he/she would like the playbook to start automatically.
How can this be implemented?
- A. Select 'Run playbook automatically' from the incident type settings
- B. Add the !startinvestigation automation to the beginning of the playbook
- C. Select 'Run playbook automatically' from the integration settings
- D. Add the playbook to the integration's settings
Answer: D
NEW QUESTION 73
Which method accesses a field called 'User Mail' in a playbook?
- A. ${usermail}
- B. ${incident.usermail}
- C. ${incident.UserMail}
- D. ${incident.User Mail}
Answer: B
NEW QUESTION 74
Which two options are the most effective for moving content between two environments? (Choose two.)
- A. Download the content items separately and upload them to the other environment
- B. Remote repository based content sharing
- C. Copy the content backup from one environment file system (/var/lib/demisto/backup/content- backup-*) and move it to the other environment
- D. UI based content import/export button
Answer: B,D
NEW QUESTION 75
Which playbook will a job run by default?
- A. The playbook assigned to the indicator type
- B. The playbook assigned to the incident type
- C. The playbook assigned by the integration
- D. The playbook assigned during pre-processing
Answer: B
NEW QUESTION 76
Which content type cannot be managed using remote repositories?
- A. Lists
- B. Pre-processing rules
- C. Exclusion List
- D. Jobs
Answer: A
NEW QUESTION 77
Which two incident search queries are valid? (Choose two.)
- A. status:closed -category:job
- B. role is Analyst
- C. owner===admin
- D. created:>="7 days"
Answer: A,D
NEW QUESTION 78
What is a primary use case of data collection tasks?
- A. To allow multi-
Answer: A
NEW QUESTION 79
Which two reasons would lead an engineer to create a custom widget? (Choose two.)
- A. To visualize context data
- B. To visualize a custom query
- C. To visualize complex incident data calculations
- D. To visualize server configuration keys
- E. To visualize XSOAR list data
Answer: A,B
NEW QUESTION 80
Which two functions in XSOAR are incident types used for? (Choose two.)
- A. To classify events ingested from various sources into the relevant types
- B. To classify indicators extracted in XSOAR incidents to their respective types
- C. To run dedicated playbooks for different event types
- D. To facilitate role based access to XSOAR incidents
Answer: A,B
NEW QUESTION 81
An administrator wants to send an email via the Mail Sender integration. Which of the following out of the box methods would be used for that?
- A. external integration command
- B. XSOAR shared agent
- C. XSOAR D2 agent
- D. common automation script
Answer: A
NEW QUESTION 82
Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.
After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)
- A. Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual - Exit on yes - left:1, right 1) and perform the following tasks:
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent - B. Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent - C. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent - D. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
- Increase the iterator value by one each time
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
Answer: B,D
Explanation:
- Mark the ticket severity as Urgent
NEW QUESTION 83
Which two features does XSOAR offer to help recover from a server failure? (Choose two.)
- A. Backup data to XSOAR engines
- B. Live backup (disaster recovery)
- C. Local backup
- D. Distributed database
Answer: A,B
NEW QUESTION 84
An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.
How can they achieve this?
- A. Add a server config to notify when incident fetch fails.
- B. Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.
- C. Create a new integration that monitors the incident fetch and sends an email if the fetch fails.
- D. Create a custom playbook that sends an email each time the fetch fails.
Answer: C
NEW QUESTION 85
An engineer's organization system is registered in the following manner: <SiteName-SystemID- Username>.
The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?
- A. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning
- B. Create a new indicator type of the internal username and set a formatting script to extract only the username
- C. Change the reputation command for the internal system indicator type
- D. Create a custom indicator field named 'username' and link it to the internal system indicator
Answer: C
NEW QUESTION 86
An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?
- A. The custom integration will not be maintained and updated by XSOAR content team
- B. The integrations are locked and cannot be edited with additional commands
- C. The commands must return a proper result to the war room for the analysts to understand
- D. The code may not be written to XSOAR standards
Answer: B
NEW QUESTION 87
What are two main uses of context data? (Choose two.)
- A. Pass data between playbook tasks
- B. Store incident information in XML format
- C. Store incident information in JSON format
- D. Pass data between to-do tasks
Answer: A,C
NEW QUESTION 88
......
Free PCSAE Exam Braindumps Palo Alto Networks Pratice Exam: https://www.exams4collection.com/PCSAE-latest-braindumps.html
Instant Download PCSAE Free Updated Test Dumps: https://drive.google.com/open?id=1-5ZXFZr8wKRAperH5BNX5sfAMpif1vIq
