PCSAE Exam Training Practice Tests (Palo Alto Networks Certified Security Automation Engineer)]

Question 1

Which two components have their own context data? (Choose two.)

A. Incident B. Task C. Sub-playbook D. Field

Correct Answer: A,C

Question 2

After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.
How can the engineer save the data so it will be accessible?

A. Mark ignore input = true B. Use raw-response = save C. Mark ignore output = true D. Use extend-context

Correct Answer: D

Question 3

What is the default configuration for indicator auto-extraction when incidents are created?

A. Inline B. None C. Inband D. Out of band

Correct Answer: A

Question 4

Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

A. Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page. B. Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page. C. Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page. D. Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.

Correct Answer: C

Question 5

An XSOAR engineer has been tasked with exporting all indicators from the production environment in the last 90 days. The final report needs to be in CSV format containing all indicator fields. How can this task be achieved?

A. Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days. B. In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV. C. SSH into the server and copy the indicator's database. D. Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

Correct Answer: B

Question 6

An administrator wants to send an email via the Mail Sender integration. Which of the following out of the box methods would be used for that?

A. external integration command B. XSOAR shared agent C. XSOAR D2 agent D. common automation script

Correct Answer: A

Question 7

Which of the following is a feature of XSOAR automations?

A. can be written in C++ B. can run on multiple docker containers C. can be password protected D. can be set to run on a scheduled basis in the automation settings

Correct Answer: D

Question 8

Which three actions can an engineer take on the troubleshooting page? (Choose three.)

A. Put the XSOAR server in maintenance mode B. View and modify server configuration settings C. View a list of server administrators D. Download the debug log bundle E. Export and import custom content

Correct Answer: A,B,D

Question 9

Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

A. When adding a new analyst account to XSOAR B. When manually creating an incident from the UI C. When fetching many different incident types from a single mailbox D. When creating incidents from the XSOAR REST API

Correct Answer: B,D

Question 10

When creating an incident layout section, it is best to place long field values within which of the following?

A. Rows B. Cards C. Canvas D. Section headers

Correct Answer: A

Question 11

By default, which components does an XSOAR implementation include?

A. All in one server B. Application server, distributed DB server C. Application server, distributed DB server, Backup server D. XSOAR server, XSOAR engine

Correct Answer: B

Question 12

Which two options may be added when a content pack is being installed? (Choose two.)

A. Lists B. Roles C. Other content packs D. Indicator layouts

Correct Answer: A,B

Question 13

Which development languages are supported when creating XSOAR automation scripts?

A. Python, Powershell, Javascript B. Javascript, Powershell, C++ C. C++, Python, Powershell D. Ruby, C++, Python

Correct Answer: A

Question 14

Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

A. execute !<integration_name>-fetch B. execute !<integration_instance_name>-fetch C. In the instance settings, enable the fetch incidents parameter and wait for one minute D. Create a one task playbook with a fetch-incident command

Correct Answer: B,C

Palo Alto Networks Certified Security Automation Engineer - PCSAE Exam Practice Test