A SOC manager built a dashboard and would like to share the dashboard with other team members.How would the SOC manager create a dashboard that meets this requirement?

Dashboard is shared to all XSOAR users in a selected role

Manually share the dashboard through user emails

Dashboard is shared to all XSOAR users

Propagate the dashboard based on SAML authentication

Dashboard is shared to all XSOAR users in a selected role

An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically.How can this be implemented?

Select ‘Run playbook automatically’ from the incident type settings

Add the playbook to the integration’s settings

Select ‘Run playbook automatically’ from the incident type settings

Add the !startinvestigation automation to the beginning of the playbook

Select ‘Run playbook automatically’ from the integration settings

Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

The ’Fetches Incidents’ option may not have been enabled

There are no new events from the external service

The ’Fetches Incidents’ option may not have been enabled

There are no new events from the external service

The first fetch should be manually triggered to start the fetching process

It can take up to 1-hour before incidents are initially fetched

To automate tasks such as parsing a file or enriching indicators

To generate new widgets for a dashboard

To determine different paths in a playbook

In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

The source code for an integration

The error message returned directly below the button

The source code for an integration

The error message returned directly below the button

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer

From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Use a field of Number to count the number of seconds elapsed between two tasks

After the playbook has run, calculate the total time taken and set the timer field with this value

To begin counting time taken, add a task in the playbook with automation startTimer. To end the counting, add a task with automation stopTimer

From the Timers tab of the playbook task, choose the action for the timer and the timer field to perform the action on

Where can engineers add the post-processing scripts to incidents?

Post-processing scripts must be added from the Incident Type editor

The post-processing tag must be added to the automation

Post-processing scripts must be added at the end of playbooks

Post-processing scripts must be added from the Incident Type editor

Post-processing scripts must be added from the Post-Process Rules editor

An engineer would like to present a trend using widgets to compare to a previous week’s dat a. Which two methods will allow the engineer to meet the requirement? (Choose two.)

Create widget of type Line, check ‘Display Trend’ and define as 7 days ago

Create a custom widget using a script

Create widget of type Line, check ‘Display Trend’ and define as 7 days ago

Create a custom widget using a new incident query

Create widget of type Number, check ‘Display Trend’ and define as 7 days ago

Create a custom widget using a script

What happens when an integration is deprecated?

The integration commands can be used, but it is recommended to update to the latest content pack

The integration commands in a playbook can no longer be used

The integration commands can be used, but it is recommended to update to the latest content pack

The configuration settings will be lost and the integration will no longer function

The integration commands in a playbook can be used, but it will fail at runtime

Which three authentication methods are supported when logging into XSOAR? (Choose three.)

Active Directory authentication

What are two main uses of context data? (Choose two.)

Store incident information in JSON format

Pass data between playbook tasks

Store incident information in JSON format

Store incident information in XML format

Pass data between playbook tasks

Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017- 11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

Create a sub-playbook with a single input containing the computer names that will loop ‘For Each Input’ and perform the following tasks:- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:- Increase the iterator value by one each time- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual – Exit on yes – left:1, right 1) and perform the following tasks:- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

Create a sub-playbook with a single input containing the computer names that will loop ‘For Each Input’ and perform the following tasks:- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:- Increase the iterator value by one each time- Active Directory User Enrichment based on the computerName- Create the ServiceNow Record by adding the enrichment information- Mark the ticket severity as Urgent

When creating a new tab in the layout, which section cannot be added?

Retrieve widget chart based on script

War room entries picked by entry query

In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

From context data, if context is shared globally

Automatically extracted by sub-playbooks

From context data, if context is shared globally

By default, which components does an XSOAR implementation include?

Application server, distributed DB server

Application server, distributed DB server, Backup server

Which three statements are true about the Marketplace? (Choose three.)

Allows reverting back to a previous version of a content pack

Enables users to participate in the community by sharing content

Offers granularity in installation through content packs

Allows reverting back to a previous version of a content pack

Enables users to participate in the community by sharing content

Publishes content without additional review from the Cortex XSOAR team

Allows uploading of content in additional languages

Offers granularity in installation through content packs

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.Which command will accomplish this?

run ‘ad-delete-user’ command with ‘user-dn’ arg and using=“Active Directory Query v2_instance_1”

run ‘ad-delete-user’ command with ‘user-dn’ arg and using-brand=“Active Directory Query v2”

run ‘ad-delete-user’ command with ‘user-dn’ arg and raw-response=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and ignore-outputs=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and using=“Active Directory Query v2_instance_1”

What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Configure a pre-process rule to link related events as they are ingested

Process all alerts by running the respective playbook and link related incidents during postprocessing

Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

Configure a pre-process rule to link related events as they are ingested

Manually go through the incidents created by the raw events and link related incidents

Palo Alto Networks PCSAE Practice Test 1 - Free Online Exam Prep & Questions

Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

Set a field trigger script

Associate to an incident type

Change field type

Change field name

Comment (0)

Palo Alto Networks PCSAE Practice Test 1

Question

Palo Alto Networks PCSAE Practice Tests

Practice Tests