Home / Palo Alto Networks / PCSAE

Palo Alto Networks PCSAE Practice Test - Questions Answers, Page 12

Question list

List of questions

Question 111

(0)

Which task type would be used to verify/check that an integration was enabled?

Question 112

(0)

What is used to trigger playbooks automatically based on the classification of an incident?

Question 113

(0)

After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?

Question 114

(0)

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How c

Question 115

(0)

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident f

Question 116

(0)

An analyst runs the following command in a playbook task: !ip ip=1.1.1.1 Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from

Question 117

(0)

Threat Intel search queries can be shared with which of the following? (Select 1)

Question 118

(0)

An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

Question 119

(0)

Select the correct incident life cycle on XSOAR.

Question 120

(0)

Which of the following does a XSOAR Admin need to create an integration with a third party cloud application?

Question 111

Which task type would be used to verify/check that an integration was enabled?

Standard task

Conditional task

Section Header task

Data Collection task

Show Answer Comment (0)

Question 112

What is used to trigger playbooks automatically based on the classification of an incident?

Indicator type

Incoming mapper

Incident types

Integration configuration

Show Answer Comment (0)

Question 113

After executing the DeleteContext automation with all=yes argument, how would the context data of an incident present?

All the data, including the incident key will be deleted, and the context data will be completely empty.

No difference, the automation cannot be executed manually.

All context data, including custom incident fields will be deleted, system incident fields will remain.

All context data, except the incident key will be deleted.

Show Answer Comment (0)

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

SSH into the server and copy the indicator's database.

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

Show Answer Comment (0)

Question 115

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

How can they achieve this?

Create a custom playbook that sends an email each time the fetch fails.

Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

Add a server config to notify when incident fetch fails.

Show Answer Comment (0)

Question 116

An analyst runs the following command in a playbook task:

!ip ip=1.1.1.1

Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

Synchronous

Extract

Out of band

Inline

Show Answer Comment (0)

Question 117

Threat Intel search queries can be shared with which of the following? (Select 1)

Users defined in the platform (email or username)

Other organizations via the Marketplace

Users outside XSOAR via email invite

Roles defined in the platform

Show Answer Comment (0)

Question 118

An administrator wants to run an automation in the War Room to set the incident field "Description" to "Confirmed Phishing". Which command should they enter in the War Room CLI?

!incidentSet description="Confirmed Phishing"

/incidentSet description=Confirmed Phishing

!setIncident description="Confirmed Phishing"

/setIncident description=Confirmed Phishing

Show Answer Comment (0)