Which three actions can an engineer take on the troubleshooting page? (Choose three.)

Put the XSOAR server in maintenance mode

View and modify server configuration settings

Put the XSOAR server in maintenance mode

View and modify server configuration settings

Export and import custom content

View a list of server administrators

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users.Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

Create a pull request directly on Github

Contribute through the XSOAR UI

Open a ticket with the XSOAR support team

Create a pull request directly on Github

Contribute through the XSOAR UI

Send an email to contributions@xsoar.com

Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

Add a distributed database server

Add a live backup server (disaster recovery)

Add a distributed database server

Add a live backup server (disaster recovery)

Management would like to get an incident report automatically following an incident’s closure. How would this be accomplished?

Configure post-processing using a script

Define a task in a playbook to generate an incident report before the closure occurs

Manually create an ‘Incident Report’

Configure post-processing using a script

Create an ‘Incident Report’ from the Reports page

Which two reasons would lead an engineer to create a custom widget? (Choose two.)

To visualize server configuration keys

To visualize complex incident data calculations

While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?

Define the Incident Fetch Interval when running the integration’s commands.

Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter.Save the integration. Configure the new integration instance with the interval required.

Configure the application to send incidents on the required interval.

Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.

What will happen if a playbook debugger is left running for more than 24 hours?

By default, the system closes automatically any debugger session that have been open 180 minutes.

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

The session will be running till stopped manually by administrator.

By default, the system closes automatically any debugger session that have been open 180 minutes.

You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

type:File reputation:Malicious sourcetimestamp:"30 days ago"

type:File verdict:Malicious sourcetimestamp:<="30 days ago"

type:File reputation:Malicious sourcetimestamp:="30 days ago"

type:File verdict:Malicious sourcetimestamp:>="30 days ago"

What are the out-of-the-box aggregate values that can be applied on widgets data?

Min, Max, Count, Average, Custom Transformers

Min, Max, Count, Average, Custom Group By

Count, Sum, Min, Max, Transformers

The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

Using the demisto.debug() function

Using the demisto_error() function

Using the demisto.debug() function

Using the return_error() function

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below: The organization wants to use the mail server location on the subsidiary's cloud to send emails.Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

XSOAR D2 Agents, to send the required emails.

An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

Another XSOAR server that uses the same license as their primary XSOAR server.

A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

A playbook task generates a report as HTML in the context data.An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

Populate the custom indicator field with the built-in !SetIndicator command.

Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

Create a custom Indicator Mapper and populate the custom indicator field.

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

Manually directly from the War Room with the Actions drop-down

From the Notes section (mark as entry icon)

Automatically from playbook tasks when the option is selected on the Advanced tab

Manually directly from the War Room with the Actions drop-down

From the Notes section (mark as entry icon)

Manually from the playbook task (mark as entry icon)

Automatically from playbook tasks when the option is selected on the Advanced tab

By running the command !MarkAsEvidence

Which playbook will a job run by default?

The playbook assigned to the incident type

The playbook assigned to the indicator type

The playbook assigned during pre-processing

The playbook assigned by the integration

Which of the following is a feature of XSOAR automations?

can be set to run on a scheduled basis in the automation settings

can run on multiple docker containers

can be set to run on a scheduled basis in the automation settings

When is the post-processing script executed in XSOAR?

Just after the playbook is executed

Just after the incident is created

Just after the pre-processing is executed

Just after the playbook is executed

Just after the Close Incident button is clicked

Given the following context data, what would be the expected output of the expression?

e6ef5142e2553c1e442a0ffac07636eac61e6edd

1E56733826E5035233A097FCEA2046AF96EC616C

E6EF5142E2553C1E442A0FFAC07636EAC61E6EDD

8D193FA162A305E4859BA8C45F5121F7265E3ABB

e6ef5142e2553c1e442a0ffac07636eac61e6edd

Where are incident layouts customized?

Settings > Object Setup > Incidents > Layouts

Settings > Integrations > Instance configuration

Settings > Object Setup > Indicators > Layouts

Settings > Advanced > Incident Layouts

How can Cortex XSOAR administrators prevent junior analysts from viewing a senior analyst dashboard?

Share the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts.

Share the dashboard in Read and Edit mode for senior analysts.

Share the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts.

Share the dashboard in Read and Write mode for senior analysts.

Share the dashboard in Read Only mode for junior analysts and senior analysts.

An analyst wants to run a script to remove usernames from an incident before the incident becomes active in XSOAR. How can this be achieved?

Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.

Run an automation script in the Playground to remove usernames from the incident.

Create a pre-processing rule that runs an automation script to remove usernames from the incident as it comes into XSOAR.

Run an automation script on the XSOAR server to remove usernames from the incident.

Create a playbook task to remove the usernames from the incident.

After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?

All context data, except the incident key will be deleted.

All the data, including the incident key will be deleted, and the context data will be completely empty.

No difference, the automation cannot be executed manually.

All context data, including custom incident fields will be deleted, system incident fields will remain.

All context data, except the incident key will be deleted.

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

SSH into the server and copy the indicator's database.

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.How can they achieve this?

Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

Create a custom playbook that sends an email each time the fetch fails.

Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

Add a server config to notify when incident fetch fails.

Threat Intel search queries can be shared with which of the following? (Select 1)

Other organizations via the Marketplace

Users defined in the platform (email or username)

Other organizations via the Marketplace

Users outside XSOAR via email invite

An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

!incidentSet description="Confirmed Phishing"

/incidentSet description=Confirmed Phishing

!setIncident description="Confirmed Phishing"

/setIncident description=Confirmed Phishing

Select the correct incident life cycle on XSOAR.

Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

Planning > Incident Ingestion > Incident Creation > Mapping and Classification > Pre-processing > Playbook runs > Post-processing

Planning > Incident Ingestion > Pre-processing > Incident Creation > Mapping and Classification > Playbook runs > Post-processing

Planning > Incident Ingestion > Pre-processing > Mapping and Classification > Incident Creation > Playbook runs > Post-processing

Planning > Incident Ingestion > Mapping and Classification > Pre-processing > Incident Creation > Playbook runs > Post-processing

Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

Private key/Public key integration

Palo Alto Networks PCSAE Practice Test 3 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Palo Alto Networks PCSAE Practice Test 3

Question

Palo Alto Networks PCSAE Practice Tests

Practice Tests