Palo Alto Networks PCSAE Exam Questions Instant Access

Question 1

Which tag must be applied to an Automation Script in order for it to be available when configuring an Indicator Type?

Areputation-script

Benrich

CreputationScript

Dreputation

Answer : C

Question 2

What will happen if a playbook debugger is left running for more than 24 hours?

ABy default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

BThe session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

CThe session will be running till stopped manually by administrator.

DBy default, the system closes automatically any debugger session that have been open 180 minutes.

Answer : D

Question 3

Which task type would be used to verify/check that an integration was enabled?

AStandard task

BConditional task

CSection Header task

DData Collection task

Answer : D

Question 4

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

ARun the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

BSSH into the server and copy the indicator's database.

CIn the Threat Intel page, add query firstSeen:>='90 days ago', select All columns in Table View, and click Export to export as a CSV.

DRun the command !findIndicators in CLI with the query firstSeen:>='90 days ago' and export to CSV.

Answer : C

Question 5

An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

AThe new job form changes based on the threat intel feed integration configuration

BThe new job form can be edited from the Indicator Feed incident type editor

CThe new job form for a threat intel feed job cannot be edited

DThe new job form can be edited from the threat intel feeds integration settings

Answer : B

Question 6

An automation returned an output called: csvReport.

What filter would be used to check if the automation returned results?

AContains/Includes

BEquals/Matches

CIn/In list

DIs defined/Exist

Answer : D

This filter will be used to check if the automation returned results, as it checks to see if the output variable called csvReport is defined and exists. If it is, then the automation returned results.

Question 7

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

AManually directly from the War Room with the Actions drop-down

BFrom the Notes section (mark as entry icon)

CManually from the playbook task (mark as entry icon)

DAutomatically from playbook tasks when the option is selected on the Advanced tab

EBy running the command !MarkAsEvidence

Answer : A, B, D

Palo Alto Networks Certified Security Automation Engineer PCSAE Exam Questions