[2023] New PCSAE exam Free Sample Questions to Practice
Cover Real PCSAE Exam Questions Make Sure You 100% Pass
NEW QUESTION # 92
During configuration of the inputs of a sub-playbook in the main playbook, there is an option under the Loop tab called "For Each Input". What is this option used to?
- A. To loop the sub-playbook over all the fields marked as important
- B. To loop the sub-playbook over all incident fields for the given incident
- C. To loop the sub-playbook over all context values present in the investigation
- D. To loop the sub-playbook over all defined sub-playbook inputs
Answer: D
NEW QUESTION # 93
Which two components have their own context data? (Choose two.)
- A. Task
- B. Field
- C. Incident
- D. Sub-playbook
Answer: C,D
NEW QUESTION # 94
An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?
- A. Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.
- B. Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.
- C. SSH into the server and copy the indicator's database.
- D. In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.
Answer: D
NEW QUESTION # 95
Can an automation script execute an integration command and an integration command execute an automation script?
- A. An automation script can execute an integration command and an integration command can execute an automation script
- B. An automation script cannot execute an integration command and an integration command can execute an automation script
- C. An automation script cannot execute an integration command and an integration command cannot execute an automation script
- D. An automation script can execute an integration command and an integration command cannot execute an automation script
Answer: D
NEW QUESTION # 96
Which option is available in XSOAR to create the body of a Threat Intel Report?
- A. Grid Fields
- B. Javascript
- C. DOC format
- D. Markdown
Answer: D
NEW QUESTION # 97
In order to automatically run a playbook on the indicators fetched by an integration, what would an XSOAR Administrator setup?
- A. Cron job
- B. Time triggered job
- C. REST API job
- D. Feed triggered job
Answer: D
NEW QUESTION # 98
What can be used as integration parameters?
- A. Token, query, playbook
- B. User-password, csv file, query
- C. URL, API key, port
- D. URL, certificate, image
Answer: C
NEW QUESTION # 99
What are the out-of-the-box aggregate values that can be applied on widgets data?
- A. Count, Sum, Min, Max, Transformers
- B. Min, Max, Count, Average, Custom Transformers
- C. Count, Average, Sum, Min, Max
- D. Min, Max, Count, Average, Custom Group By
Answer: C
NEW QUESTION # 100
Which two options may be added when a content pack is being installed? (Choose two.)
- A. Other content packs
- B. Lists
- C. Indicator layouts
- D. Roles
Answer: B,D
NEW QUESTION # 101
Given an incident with three files, how could the name of the second file be referenced?
- A. ${File.[1].Name}
- B. ${File.Name.[1]}
- C. ${Files.Name.[2]}
- D. ${Files.[2].Name}
Answer: C
NEW QUESTION # 102
Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?
- A. reputation-script
- B. enrich
- C. reputationScript
- D. reputation
Answer: C
NEW QUESTION # 103
A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?
- A. Manually share the dashboard through user emails
- B. Propagate the dashboard based on SAML authentication
- C. Dashboard is shared to all XSOAR users in a selected role
- D. Dashboard is shared to all XSOAR users
Answer: C
NEW QUESTION # 104
During the regular maintenance of XSOAR a customer noticed that there was an update available for the Active Directory content pack (current version 1.4.6) and updated the content pack to the latest version (version 1.4.11). However, after the update the customer noticed that the Active Directory Query integration is not working properly and asked you to resolve the issue.
Which of the following set of steps can help to resolve the issue?
- A. Navigate to Settings
View the configured integrations and select Active Directory Query
Delete all integration instances and add all integration instances again - B. Navigate to Marketplace
View the installed content pack and select Active Directory content pack Click on uninstall content pack - C. Navigate to Settings
View the configured integrations and select Active Directory Authentication Delete all integration instances and add all integration instances again - D. Navigate to Marketplace
View the installed content pack and select Active Directory content pack Select version 1.4.6 and click on "Revert to this version"
Answer: A
Explanation:
Navigate to Marketplace browser and reinstall the Active Directory content pack
NEW QUESTION # 105
What will happen if a playbook debugger is left running for more than 24 hours?
- A. The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.
- B. The session will be running till stopped manually by administrator.
- C. By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.
- D. By default, the system closes automatically any debugger session that have been open 180 minutes.
Answer: D
NEW QUESTION # 106
What are three different loop types in a playbook? (Choose three.)
- A. For-each
- B. Data collection
- C. Automation
- D. Built-in
- E. Conditional
Answer: A,B,E
NEW QUESTION # 107
What is the default task type when creating an empty task?
- A. Section header
- B. Standard (Manual)
- C. Conditional
- D. Standard (Automated)
Answer: C
NEW QUESTION # 108
Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)
- A. Any custom content will be automatically uploaded to the content repository
- B. Use the XSOAR GitHub Contribution Guide to add the contribution to the standard content
- C. Create content and add it to the standard content by contributing through the Marketplace
- D. Create a support ticket with the custom content for review by the support team
Answer: A,C
NEW QUESTION # 109
How long is the trial period for paid content packs?
- A. 14 days
- B. 60 days
- C. 7 days
- D. 30 days
Answer: D
NEW QUESTION # 110
Threat Intel search queries can be shared with which of the following? (Select 1)
- A. Roles defined in the platform
- B. Users outside XSOAR via email invite
- C. Users defined in the platform (email or username)
- D. Other organizations via the Marketplace
Answer: D
NEW QUESTION # 111
Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?
- A. The development server's default repository
- B. Remote git repository specified in the dev-prod configuration parameters
- C. Cortex XSOAR public content repository
- D. A content repository specified in the Marketplace
Answer: B
NEW QUESTION # 112
At what stage during the incident lifecycle is an incident type assigned?
- A. Incident creation
- B. Playbook execution
- C. Pre-processing
- D. Classification
Answer: D
NEW QUESTION # 113
Match the action with the most appropriate playbook task type.
Answer:
Explanation:
Explanation
https://www.jaacostan.com/2021/02/palo-alto-cortex-xsoar-playbook-icons.html
NEW QUESTION # 114
Which two features does XSOAR offer to help recover from a server failure? (Choose two.)
- A. Backup data to XSOAR engines
- B. Live backup (disaster recovery)
- C. Distributed database
- D. Local backup
Answer: A,B
NEW QUESTION # 115
Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)
- A. Field mapping
- B. setFields
- C. setIncident
- D. Layout inline editing
Answer: A,C
NEW QUESTION # 116
How would context data be filtered to receive only malicious indicator values with DBotScore?
- A. Get DBotScore where DBotScore.Score (Larger than) 1
- B. Get DBotScore.value where DBotScore.Score (equals (int)) 3
- C. Get DBotScore where DBotScore.Score (Larger or equals) 2
- D. Get DBotScore.value where DBotScore.Score (Larger or equals) 4
Answer: B
NEW QUESTION # 117
......
Real PCSAE Quesions Pass Certification Exams Easily: https://www.itpassleader.com/Palo-Alto-Networks/PCSAE-dumps-pass-exam.html
PCSAE dumps Accurate Questions and Answers with Free: https://drive.google.com/open?id=1-GgyokyVIKHmBSoxHhU0kZT7BbMMRFoS