ExamGecko
Login
Ask Question

PCSAE: Palo Alto Networks Certified Security Automation Engineer

Vendor:
Exam Questions:
157
 Learners
  2.370
Last Updated
February - 2025
Language
English
4 Quizzes
PDF | VPLUS
This study guide should help you understand what to expect on the exam and includes a summary of the topics the exam might cover and links to additional resources. The information and materials in this document should help you focus your studies as you prepare for the exam.

Related questions

Question 1

Report Export Collapse

Incidents need to be filtered by all of the following criteria:

Status – Pending
Status – Pending
Exclude Category – Job
Exclude Category – Job
Severity – High
Severity – High
Owner – None (No owner assigned)
Owner – None (No owner assigned)
Type – Phishing
Type – Phishing
Email Subject – “You have won a million dollars”What is the correct query syntax for the above incident search filter?
Email Subject – “You have won a million dollars”What is the correct query syntax for the above incident search filter?
status==“Pending“ && category!=”job” && severity==”High” && owner==”None” && type==”Phishing” && emailsubject==”You have won a million dollars”
status==“Pending“ && category!=”job” && severity==”High” && owner==”None” && type==”Phishing” && emailsubject==”You have won a million dollars”
Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars
Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars
status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”
status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”
status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”
status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”
Suggested answer: C
Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/cortexxsoar-overview/how-to-search-in-cortex-xsoar.html#idcd7fe505-c1c1-42f5-a698-08b5710196d3

asked 23/09/2024
Ahmed Otmani Amaoui
30 questions

Question 2

Report Export Collapse

On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

2MB
2MB
3MB
3MB
1MB
1MB
5MB
5MB
Suggested answer: C
asked 23/09/2024
Deshawn Sharpe
35 questions

Question 3

Report Export Collapse

Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

Python
Python
Perl
Perl
Go
Go
JavaScript
JavaScript
Powershell
Powershell
Suggested answer: A, D, E
Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoaradmin/playbooks/ automations.html

asked 23/09/2024
Daniel williams
51 questions

Question 4

Report Export Collapse

A playbook task generates a report as HTML in the context data.

An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

Populate the custom indicator field with the built-in !SetIndicator command.
Populate the custom indicator field with the built-in !SetIndicator command.
Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.
Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.
Create a custom Indicator Mapper and populate the custom indicator field.
Create a custom Indicator Mapper and populate the custom indicator field.
Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.
Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.
Suggested answer: D
Explanation:

Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.6/Cortex-XSOARAdministrator-Guide/Configure-the-HTML-Field

asked 23/09/2024
Billy Mitchell
29 questions

Question 5

Report Export Collapse

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.

Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

Open a ticket with the XSOAR support team
Open a ticket with the XSOAR support team
Create a pull request directly on Github
Create a pull request directly on Github
Contribute through the XSOAR UI
Contribute through the XSOAR UI
Send an email to [email protected]
Send an email to [email protected]
Suggested answer: B, C
asked 23/09/2024
Cristian Bello Henriquez
34 questions

Question 6

Report Export Collapse

Newly created subplaybooks do not have any inputs, or outputs. What is necessary to make them functional? (Choose two.)

Become a Premium Member for full access
  Unlock Premium Member

Question 7

Report Export Collapse

During configuration of the inputs of a sub-playbook in the main playbook, there is an option under the Loop tab called "For Each Input". What is this option used to?

Become a Premium Member for full access
  Unlock Premium Member

Question 8

Report Export Collapse

An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?

Create a new indicator type and disable the built-in IP indicator
Create a new indicator type and disable the built-in IP indicator
Edit the regex of the default IP Indicator
Edit the regex of the default IP Indicator
Add a new server configuration key that will overwrite the default regex of the IP indicator
Add a new server configuration key that will overwrite the default regex of the IP indicator
Delete the default IP indicator
Delete the default IP indicator
Suggested answer: A
Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoaradmin/manage-indicators/ understand-indicators/indicator-types/indicator-type-profile.html

asked 23/09/2024
Luis Marino
34 questions

Question 9

Report Export Collapse

After enriching a username using Active Directory, an engineer would like to send an email to the user’s manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager’s email is returned, but not saved in the context.

How can the engineer save the data so it will be accessible?

Mark ignore output = true
Mark ignore output = true
Use extend-context
Use extend-context
Use raw-response = save
Use raw-response = save
Mark ignore input = true
Mark ignore input = true
Suggested answer: B
Explanation:

Reference: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoaradmin/playbooks/extend- context/extend-context-using-the-command-line.html

asked 23/09/2024
PKE Holding AG Leitgeb
33 questions

Question 10

Report Export Collapse

What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

Become a Premium Member for full access
  Unlock Premium Member