[Apr-2022] Palo Alto Networks PCSAE Dumps – Reduce Your Chance of Failure in PCSAE Exam
To help you achieve your ultimate goal, we suggest the actual Palo Alto Networks PCSAE dumps for your Palo Alto Networks Certified Security Automation Engineer exam preparation to use as your guideline.
NEW QUESTION 22
Which two statements accurately describe layouts? (Choose two.)
- A. Layouts override classification and mapping
- B. Layouts can display incident information and custom fields
- C. New tabs can be added to the incident layout
- D. Layouts add or remove custom fields from an incident type
Answer: B,C
NEW QUESTION 23
Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)
- A. When fetching many different incident types from a single mailbox
- B. When manually creating an incident from the UI
- C. When creating incidents from the XSOAR REST API
- D. When adding a new analyst account to XSOAR
Answer: B,C
NEW QUESTION 24
An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed.
How would the engineer implement this?
- A. The new job form for a threat intel feed job cannot be edited
- B. The new job form can be edited from the threat intel feeds integration settings
- C. The new job form changes based on the threat intel feed integration configuration
- D. The new job form can be edited from the Indicator Feed incident type editor
Answer: D
NEW QUESTION 25
Match the appropriate action to the layout type.
Answer:
Explanation:
NEW QUESTION 26
Which three authentication methods are supported when logging into XSOAR? (Choose three.)
- A. User name and password
- B. Active Directory authentication
- C. RADIUS
- D. SAML
- E. OTP token
Answer: B,C,D
NEW QUESTION 27
A large number of incidents were deleted by mistake.
Which two architecture components can be used to recover the lost data? (Choose two.)
- A. Local backup
- B. Distributed database
- C. Live backup
- D. Engine
Answer: C,D
NEW QUESTION 28
An incident field is created having the display name as Source_IP. How can the field be accessed?
- A. ${incident.sourceip}
- B. ${incident.Source IP}
- C. ${incident.srcip}
- D. ${incident.Source_IP}
Answer: C
NEW QUESTION 29
Which method accesses a field called 'User Mail' in a playbook?
- A. ${incident.usermail}
- B. ${usermail}
- C. ${incident.User Mail}
- D. ${incident.UserMail}
Answer: A
NEW QUESTION 30
Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882.
This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.
After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)
- A. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
-Increase the iterator value by one each time
-Active Directory User Enrichment based on the computerName
-Create the ServiceNow Record by adding the enrichment information
-Mark the ticket severity as Urgent - B. Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:
-Active Directory User Enrichment based on the computerName
-Create the ServiceNow Record by adding the enrichment information
-Mark the ticket severity as Urgent - C. Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:
-Active Directory User Enrichment based on the computerName
-Create the ServiceNow Record by adding the enrichment information
-Mark the ticket severity as Urgent - D. Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual - Exit on yes - left:1, right 1) and perform the following tasks:
-Active Directory User Enrichment based on the computerName
-Create the ServiceNow Record by adding the enrichment information
-Mark the ticket severity as Urgent
Answer: A,C
NEW QUESTION 31
By default, which components does an XSOAR implementation include?
- A. Application server, distributed DB server
- B. All in one server
- C. Application server, distributed DB server, Backup server
- D. XSOAR server, XSOAR engine
Answer: A
NEW QUESTION 32
Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)
- A. Field mapping
- B. setIncident
- C. Layout inline editing
- D. setFields
Answer: A,B
NEW QUESTION 33
How is data transferred between playbook tasks?
- A. Directly from a previous task
- B. Input from the indicator page
- C. Read/Write from context data
- D. Over war room results
Answer: C
NEW QUESTION 34
Can an automation script execute an integration command and an integration command execute an automation script?
- A. An automation script cannot execute an integration command and an integration command cannot execute an automation script
- B. An automation script can execute an integration command and an integration command can execute an automation script
- C. An automation script can execute an integration command and an integration command cannot execute an automation script
- D. An automation script cannot execute an integration command and an integration command can execute an automation script
Answer: C
NEW QUESTION 35
What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?
- A. Process all alerts by running the respective playbook and link related incidents during post-processing
- B. Configure a pre-process rule to link related events as they are ingested
- C. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together
- D. Manually go through the incidents created by the raw events and link related incidents
Answer: A
NEW QUESTION 36
An engineer notices that playbooks only start once the user clicks the 'investigate' button and he/she would like the playbook to start automatically.
How can this be implemented?
- A. Select 'Run playbook automatically' from the incident type settings
- B. Add the playbook to the integration's settings
- C. Select 'Run playbook automatically' from the integration settings
- D. Add the !startinvestigation automation to the beginning of the playbook
Answer: B
NEW QUESTION 37
An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?
- A. Edit the regex of the default IP Indicator
- B. Add a new server configuration key that will overwrite the default regex of the IP indicator
- C. Create a new indicator type and disable the built-in IP indicator
- D. Delete the default IP indicator
Answer: C
NEW QUESTION 38
An engineer would like to present a trend using widgets to compare to a previous week's data. Which two methods will allow the engineer to meet the requirement? (Choose two.)
- A. Create a custom widget using a new incident query
- B. Create widget of type Number, check 'Display Trend' and define as 7 days ago
- C. Create a custom widget using a script
- D. Create widget of type Line, check 'Display Trend' and define as 7 days ago
Answer: C,D
NEW QUESTION 39
Which two components have their own context data? (Choose two.)
- A. Field
- B. Task
- C. Incident
- D. Sub-playbook
Answer: C,D
NEW QUESTION 40
What is the default task type when creating an empty task?
- A. Standard (Manual)
- B. Standard (Automated)
- C. Conditional
- D. Section header
Answer: C
NEW QUESTION 41
In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)
- A. Automatically extracted by sub-playbooks
- B. Through integration context
- C. From context data, if context is shared globally
- D. Inputs and outputs
Answer: C,D
NEW QUESTION 42
Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)
- A. Perl
- B. Powershell
- C. Python
- D. JavaScript
- E. Go
Answer: B,C,D
NEW QUESTION 43
Which investigation element is best suited for collaboration among users?
- A. Context Data
- B. Related Incidents
- C. Work Plan
- D. War Room
Answer: A
NEW QUESTION 44
What are two primary uses of standard tasks? (Choose two.)
- A. To create an incident or escalate an existing incident
- B. To generate new widgets for a dashboard
- C. To automate tasks such as parsing a file or enriching indicators
- D. To highlight different paths in a playbook
Answer: B,C
NEW QUESTION 45
What can be added to offload integration instance processing from the main server?
- A. Database node
- B. Engine
- C. Development server
- D. Application server
Answer: A
NEW QUESTION 46
Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)
- A. Create a one task playbook with a fetch-incident command
- B. execute !<integration_instance_name>-fetch
- C. In the instance settings, enable the fetch incidents parameter and wait for one minute
- D. execute !<integration_name>-fetch
Answer: B,C
NEW QUESTION 47
......
Accurate & Verified Answers As Seen in the Real Exam here: https://troytec.validtorrent.com/PCSAE-valid-exam-torrent.html