Which of the following is a prerequisite to editing out-of-the-box (OOTB) content?

Go to Settings > About >Troubleshooting and set a flag to allow custom content.

Download the content from the Marketplace.

Go to Settings > About >Troubleshooting and set a flag to allow custom content.

Register a user account with support.paloaltonetworks.com .

Detach the content item you want to edit from the Marketplace.

Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.

Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page.

Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

When creating an automation in XSOAR, what is the best way to create a log message?

Using the demisto.debug() function

Using the demisto.results() function

During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.Which of the following set of steps can help to resolve the issue?

Navigate to SettingsView the configured integrations and select Active Directory QueryDelete all integration instances and add all integration instances again

Navigate to SettingsView the configured integrations and select Active Directory Authentication Delete all integration instances and add all integration instances again

Navigate to MarketplaceView the installed content pack and select Active Directory content pack Select version 1.4.6 and click on "Revert to this version"

Navigate to SettingsView the configured integrations and select Active Directory QueryDelete all integration instances and add all integration instances again

Navigate to MarketplaceView the installed content pack and select Active Directory content pack Click on uninstall content pack Navigate to Marketplace browser and reinstall the Active Directory content pack

When developing the playbook, which of the following can be used by a XSOAR Administrator?

Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

The Debugger panel to test data with one of last five incidents. This will affect the incident’s original incident data.

Context data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.

Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

The Debugger panel to test data with one of last fifty incidents. This will not affect the incident’s original incident data.

What is the function of timer SLA fields in Cortex XSOAR?

To automatically alert the analyst on SLA breach

To track SLA breaches per playbook

To run a script that executes on SLA assignment

To automatically alert the analyst on SLA breach

To count the time between one or more tasks

What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

Inputs are data pieces that are present in the playbook

Outputs can be derived from the result of a task or command

Inputs are the data fields parsed by the Classifier

Inputs are data pieces that are present in the playbook

Inputs are data pieces that are present in the task

Outputs are used as incident trigger for playbook

Outputs can be derived from the result of a task or command

Inputs are the data fields parsed by the Classifier

Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

Run Command, Export, and Close and Delete for all selected incidents regardless of their status

Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

Run Command, Export, and Close and Delete for all selected incidents regardless of their status

Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

Run Command for all selected incidents having Active status

Export incidents as JSON and change incident status

An administrator has noticed that an integration has failed to fetch incidents. Where would they go to download logs to troubleshoot the error?

Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs

Go to the Marketplace > Download the Fix my XSOAR playbook pack > Run the playbook > Download logs from War Room

Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs

Dashboards & Reports > System Health

Settings > About > System Diagnostics

When browsing the Marketplace for new content packs, which details about each pack are you able to view?

A summary of each version history

The integration’s source code

A summary of each version history

A test instance for the content pack

The source code of each playbook

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

-status:closed -category:job & type:Phishing created:<="30 days ago"

-status:closed -category:job type:Phishing created:>="30 days ago"

status:closed -category:job & type:Phishing created:>="30 days ago"

-status:closed -category:job & type:Phishing created:<="30 days ago"

-status:closed –category:job type:Phishing created:="30 days ago"

During configuration of the inputs of a sub-playbook in the main playbook, there is an option under the Loop tab called "For Each Input". What is this option used to?

To loop the sub-playbook over all defined sub-playbook inputs

To loop the sub-playbook over all context values present in the investigation

To loop the sub-playbook over all incident fields for the given incident

To loop the sub-playbook over all the fields marked as important

To loop the sub-playbook over all defined sub-playbook inputs

What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

Download content for offline installation

Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

Remote git repository specified in the dev-prod configuration parameters

A content repository specified in the Marketplace

Remote git repository specified in the dev-prod configuration parameters

The development server's default repository

Cortex XSOAR public content repository

Which of the following are valid methods to contribute custom content? (Choose three.)

A Github pull request on the public XSOAR Content Repository

Using the marketplace interface to upload the content

Using the content submission tool on live.paloaltonetworks.com

Submit content directly through feature requests

Private GitHub repository submission for premium content

A Github pull request on the public XSOAR Content Repository

Using the marketplace interface to upload the content

Using the content submission tool on live.paloaltonetworks.com

What happens if both a Classifier and Incident Type are configured in an integration instance's settings?

Both the Classifier and Incident Type will classify incoming incidents.

The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.

The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.

The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.

Both the Classifier and Incident Type will classify incoming incidents.

You can customize most aspects of the incident layout, including which three of the following?(Choose three.)

Which dashboard settings are applied

The information and how is it displayed

Which tabs appear and in which order

Which users have permissions to view the tabs

Which roles have permissions to view the tabs

Which dashboard settings are applied

The information and how is it displayed

Which tabs appear and in which order

Who is permitted to create and submit content to the Marketplace?

All users with the correct XSOAR Role and Permissions

Only users with a valid Github account

Any user who has signed up through the dev portal

Any user who has a live.paloaltonetworks.com account

All users with the correct XSOAR Role and Permissions

Reliability scores in XSOAR range from A through F. What do A and F stand for?

F - Unreliable, A - Completely Reliable

F - Reliability cannot be judged, A - Completely Reliable

F - Not reliable, A - Usually Reliable

F - Not usually reliable, A - Fairly Reliable

F - Unreliable, A - Completely Reliable

Newly created subplaybooks do not have any inputs, or outputs. What is necessary to make them functional? (Choose two.)

Define input key in the subplaybook task. Map context values to pull from parent playbook.

Open the subplaybook and add inputs or outputs in the Playbook triggered task.

Define input key in the subplaybook task. Map context values to pull from parent playbook.

The output of the previous task automatically becomes the input of the subplaybook.

Map inputs and outputs to the parent playbook and the subplaybook will use the same values.

Open the subplaybook and add inputs or outputs in the Playbook triggered task.

A Cortex XSOAR Administrator is tasked with building a button for an analyst in order for the analyst to be assigned to the incident as an owner. What is the process?

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

Which two functions in XSOAR are incident types used for? (Choose two.)

To classify events ingested from various sources into the relevant types

To classify indicators extracted in XSOAR incidents to their respective types

To run dedicated playbooks for different event types

To classify events ingested from various sources into the relevant types

To classify indicators extracted in XSOAR incidents to their respective types

To facilitate role based access to XSOAR incidents

Palo Alto Networks PCSAE Practice Test 4 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Palo Alto Networks PCSAE Practice Test 4

Question

Palo Alto Networks PCSAE Practice Tests

Practice Tests