Home / Palo Alto Networks / PCSAE

Palo Alto Networks PCSAE Practice Test - Questions Answers, Page 10

Question list

List of questions

Question 91

(0)

What will happen if a playbook debugger is left running for more than 24 hours?

Question 92

(0)

You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

Question 93

(0)

What is the default configuration for indicator auto-extraction when incidents are created?

Question 94

(0)

What are the out-of-the-box aggregate values that can be applied on widgets data?

Question 95

(0)

What assigns newly ingested event attributes to incident fields?

Question 96

(0)

The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

Question 97

(0)

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below: The organization wants to use the ma

Question 98

(0)

A playbook task generates a report as HTML in the context data. An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the

Question 99

(0)

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

Question 100

(0)

Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

Question 91

What will happen if a playbook debugger is left running for more than 24 hours?

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

The session will be running till stopped manually by administrator.

By default, the system closes automatically any debugger session that have been open 180 minutes.

Show Answer Comment (0)

Question 92

You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

type:File reputation:Malicious sourcetimestamp:"30 days ago"

type:File verdict:Malicious sourcetimestamp:<="30 days ago"

type:File reputation:Malicious sourcetimestamp:="30 days ago"

type:File verdict:Malicious sourcetimestamp:>="30 days ago"

Show Answer Comment (0)

Question 93

What is the default configuration for indicator auto-extraction when incidents are created?

Inline

Inband

None

Out of band

Show Answer Comment (0)

Question 94

What are the out-of-the-box aggregate values that can be applied on widgets data?

Min, Max, Count, Average, Custom Transformers

Min, Max, Count, Average, Custom Group By

Count, Average, Sum, Min, Max

Count, Sum, Min, Max, Transformers

Show Answer Comment (0)

Question 95

What assigns newly ingested event attributes to incident fields?

Playbooks

Classification

Mapping

Layouts

Show Answer Comment (0)

Question 96

The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

Using the demisto_error() function

Using a print statement

Using the demisto.debug() function

Using the return_error() function

Show Answer Comment (0)

Question 97

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:

The organization wants to use the mail server location on the subsidiary's cloud to send emails.

Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

XSOAR D2 Agents, to send the required emails.

An XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

Another XSOAR server that uses the same license as their primary XSOAR server.

A Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

Show Answer Comment (0)

Question 98

A playbook task generates a report as HTML in the context data.

An engineer creates a custom indicator field of type "HTML" and adds the field to a section in a custom indicator layout. How can the engineer populate the HTML field in the indicator layout?

Populate the custom indicator field with the built-in !SetIndicator command.

Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

Create a custom Indicator Mapper and populate the custom indicator field.

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

Show Answer Comment (0)