Home

Home / Palo Alto Networks / PCSAE

Question list

List of questions

Question 1

(0)

Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

Question 2

(0)

Given an incident with three files, how could the name of the second file be referenced?

Question 3

(0)

Which component can be part of a load balancing group?

Question 4

(0)

Which method accesses a field called ‘User Mail’ in a playbook?

Question 5

(0)

A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

Question 6

(0)

Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)

Question 7

(0)

DRAG DROP Match the action with the most appropriate playbook task type.

Question 8

(0)

Which built-in automation/command cab be used to change an incident’s type?

Question 9

(0)

An engineer notices that playbooks only start once the user clicks the ‘investigate’ button and he/she would like the playbook to start automatically. How can this be implemented?

Question 10

(0)

Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

Open VPLUS File

Convert VPLUS to PDF

Related questions

On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users. Which two options are available to the Engineer for contributing to the Marketplace? (Choose two.)

Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

What does Script helper contain?

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site. Which command will accomplish this?

Which of the following is a basic setting that can be configured in an automation?

What are two of the actions available on the Version History tab of a content pack in the marketplace? (Choose two.)

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?

Which development languages are supported when creating XSOAR automation scripts?

Question 99 - PCSAE discussion

Report

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

A.

Manually directly from the War Room with the Actions drop-down

B.

From the Notes section (mark as entry icon)

C.

Manually from the playbook task (mark as entry icon)

D.

Automatically from playbook tasks when the option is selected on the Advanced tab

E.

By running the command !MarkAsEvidence

Show Answer

asked 23/09/2024

Simon Liu

36 questions

User

Your answer: A B C D E

0 comments

Sorted by

Leave a comment first