Palo Alto Networks PCSAE Exam Questions Instant Access

Question 1

How can Cortex XSOAR administrators prevent junior analysts from viewing a senior analyst dashboard?

AShare the dashboard in Read and Edit mode for senior analysts.

BShare the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts.

CShare the dashboard in Read and Write mode for senior analysts.

DShare the dashboard in Read Only mode for junior analysts and senior analysts.

Answer : B

Question 2

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from one specific site.

Which command will accomplish this?

Arun 'ad-delete-user' command with 'user-dn' arg and using-brand=''Active Directory Query v2''

Brun 'ad-delete-user' command with 'user-dn' arg and raw-response=true

Crun 'ad-delete-user' command with 'user-dn' arg and ignore-outputs=true

Drun 'ad-delete-user' command with 'user-dn' arg and using=''Active Directory
Query v2_instance_1''

Answer : D

Question 3

What is the difference between labels and fields?

AFields can be used in playbooks and labels cannot

BFields are indexed in the database and labels are not

CLabels can be used in queries and fields cannot

DLabels are indexed in the database and fields are not

Answer : C

Question 4

An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

AThe new job form changes based on the threat intel feed integration configuration

BThe new job form can be edited from the Indicator Feed incident type editor

CThe new job form for a threat intel feed job cannot be edited

DThe new job form can be edited from the threat intel feeds integration settings

Answer : B

Question 5

What are the three ways to add/mark entries as evidence inside the Evidence Board? (Choose three.)

AManually directly from the War Room with the Actions drop-down

BFrom the Notes section (mark as entry icon)

CManually from the playbook task (mark as entry icon)

DAutomatically from playbook tasks when the option is selected on the Advanced tab

EBy running the command !MarkAsEvidence

Answer : A, B, D

Question 6

While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?

ADefine the Incident Fetch Interval when running the integration's commands.

BDuplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.

CConfigure the application to send incidents on the required interval.

DDuplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.

Answer : A

Question 7

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below:

The organization wants to use the mail server location on the subsidiary's cloud to send emails. Without acquiring additional licenses, which XSOAR component can fulfill the requirement?

AXSOAR D2 Agents, to send the required emails.

BAn XSOAR engine that is downloaded from the XSOAR server and installed within the subsidiary.

CAnother XSOAR server that uses the same license as their primary XSOAR server.

DA Linux server connected with an XSOAR server using SSH integration. Commands can be run remotely to access the mail server.

Answer : D

Palo Alto Networks Certified Security Automation Engineer PCSAE Exam Questions