An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.What is the main concern when adding these commands?

The custom integration will not be maintained and updated by XSOAR content team

The commands must return a proper result to the war room for the analysts to understand

The code may not be written to XSOAR standards

The integrations are locked and cannot be edited with additional commands

The custom integration will not be maintained and updated by XSOAR content team

Which two statements accurately describe layouts? (Choose two.)

New tabs can be added to the incident layout

Layouts can display incident information and custom fields

Layouts override classification and mapping

New tabs can be added to the incident layout

Layouts can display incident information and custom fields

Layouts add or remove custom fields from an incident type

An engineer’s organization system is registered in the following manner: <SiteName-SystemIDUsername>.The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate ‘User’ indicator automatically once a system is found.What is the most efficient way for the engineer to achieve this?

Create a new indicator type of the internal username and set a formatting script to extract only the username

Create a custom indicator field named ‘username’ and link it to the internal system indicator

Change the reputation command for the internal system indicator type

Create a new indicator type of the internal username and set a formatting script to extract only the username

Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

Which two options are the most effective for moving content between two environments? (Choose two.)

Remote repository based content sharing

UI based content import/export button

Remote repository based content sharing

UI based content import/export button

Copy the content backup from one environment file system (/var/lib/demisto/backup/contentbackup-*) and move it to the other environment

Download the content items separately and upload them to the other environment

Which three options can be defined in the layout settings? (Choose three.)

Permission to view the tab based on ‘Roles’

Permission to view the tab based on ‘Users’

Permission to view the tab based on ‘Roles’

Delete built-in tabs including the war room

Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

Live backup (disaster recovery)

An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard.How can it be accomplished?

Default Dashboard can be defined by ‘Role’

Use the server configuration key: default.dashboards

Save the dashboard as a widget and apply it to all users

Right click on the dashboard tab and ‘Set as Default’

How would context data be filtered to receive only malicious indicator values with DBotScore?

Get DBotScore.value where DBotScore.Score (equals (int)) 3

Get DBotScore.value where DBotScore.Score (Larger or equals) 4

Get DBotScore.value where DBotScore.Score (equals (int)) 3

Get DBotScore where DBotScore.Score (Larger than) 1

Get DBotScore where DBotScore.Score (Larger or equals) 2

Can an automation script execute an integration command and an integration command execute an automation script?

An automation script can execute an integration command and an integration command cannot execute an automation script

An automation script cannot execute an integration command and an integration command cannot execute an automation script

An automation script can execute an integration command and an integration command cannot execute an automation script

An automation script cannot execute an integration command and an integration command can execute an automation script

An automation script can execute an integration command and an integration command can execute an automation script

Which two options will troubleshoot an integration’s fetch incidents command? (Choose two.)

In the instance settings, enable the fetch incidents parameter and wait for one minute

execute !<integration_instance_name>-fetch

In the instance settings, enable the fetch incidents parameter and wait for one minute

Create a one task playbook with a fetch-incident command

execute !<integration_instance_name>-fetch

execute !<integration_name>-fetch

Incidents need to be filtered by all of the following criteria:

Owner – None (No owner assigned)

Email Subject – “You have won a million dollars”What is the correct query syntax for the above incident search filter?

status==“Pending“ && category!=”job” && severity==”High” && owner==”None” && type==”Phishing” && emailsubject==”You have won a million dollars”

Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars

status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”

What does Script helper contain?

Automation timeout configuration

When mapping incoming data to incident fields, which statement is correct?

Data that is not mapped is placed under labels

Only text fields are classified

Classification cannot be used if mapping is enabled

Every incoming field must be mapped

Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

When creating incidents from the XSOAR REST API

When manually creating an incident from the UI

When creating incidents from the XSOAR REST API

When manually creating an incident from the UI

When adding a new analyst account to XSOAR

When fetching many different incident types from a single mailbox

What are two primary uses of standard tasks? (Choose two.)

To create an incident or escalate an existing incident

To automate tasks such as parsing a file or enriching indicators

To highlight different paths in a playbook

To generate new widgets for a dashboard

To create an incident or escalate an existing incident

To automate tasks such as parsing a file or enriching indicators

An engineer would like to change an incident’s SLA according to the severity field changes. How can the engineer achieve this task?

Create a job that queries for incident severity changes

Change the SLA manually every time the severity changes

What are two common use cases for conditional tasks? (Choose two.)

They are used for branching paths in a playbook

They are used for sending a specific

They are used for branching paths in a playbook

They are used to interact with users through survey functionality

They are used to determine which incident will be executed

They are used for sending a specific

An Engineer wants to filter a csvList value according to a dynamic value saved under the test context key.Which three values would save the test context key? (Choose three.)

Get csvList.value where csvList.value equals test [from previous tasks]

Get csvList.value where csvList.value equals ${test} [from previous tasks]

Get csvList.value where csvList.value equals ${test} [as value]

Get csvList.value where csvList.value equals test [from previous tasks]

Get csvList.value where csvList.value equals ${test} [from previous tasks]

Get csvList.value where csvList.value equals test {}[from previous tasks]

Get csvList.value where csvList.value equals test [as value]

Get csvList.value where csvList.value equals ${test} [as value]

An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?

Create a new indicator type and disable the built-in IP indicator

Edit the regex of the default IP Indicator

Add a new server configuration key that will overwrite the default regex of the IP indicator

Delete the default IP indicator

In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows with no more than 10 loops

In repetitive processes that requires sub-playbook re-execution

Which configuration is a valid distributed database (DB) implementation?

1 main DB, 1 application server, 3 node servers

2 main DBs, 1 application server, 2 node servers

1 main DB, 1 application server, 3 node servers

2 application servers, 1 main DB, 1 node server

1 application server, 2 main DBs, 1 node server

An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

The new job form can be edited from the Indicator Feed incident type editor

The new job form changes based on the threat intel feed integration configuration

The new job form can be edited from the Indicator Feed incident type editor

The new job form for a threat intel feed job cannot be edited

The new job form can be edited from the threat intel feeds integration settings

What is the difference between labels and fields?

Labels can be used in queries and fields cannot

Fields can be used in playbooks and labels cannot

Fields are indexed in the database and labels are not

Labels can be used in queries and fields cannot

Labels are indexed in the database and fields are not

Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

Create content and add it to the standard content by contributing through the Marketplace

Any custom content will be automatically uploaded to the content repository

Create content and add it to the standard content by contributing through the Marketplace

Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content

Create a support ticket with the custom content for review by the support team

Any custom content will be automatically uploaded to the content repository

What is the correct definition regarding integration parameters and command arguments?

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Palo Alto Networks PCSAE Practice Test 2 - Free Online Exam Prep & Questions

What is the correct expression to use when filtering only PDF files?

Use File.Extension that does not equal (string comparison) PDF

Use File.Name contains PDF

Use File.Extension contains (general) PDF

Use File.Extension equals (string comparison) PDF

Comment (0)

Palo Alto Networks PCSAE Practice Test 2

Question

Palo Alto Networks PCSAE Practice Tests

Practice Tests