Palo Alto Networks Certified Security Automation Engineer

QUESTION NO: 1
When browsing the Marketplace for new content packs, which details about each pack are you able to view?

A. The integration's source code B. The source code of each playbook C. A summary of each version history D. A test instance for the content pack

Correct Answer: C

QUESTION NO: 2
Which of the following are valid methods to contribute custom content? (Choose three.)

A. A Github pull request on the public XSOAR Content Repository B. Submit content directly through feature requests C. Private GitHub repository submission for premium content D. Using the marketplace interface to upload the content E. Using the content submission tool on live.paloaltonetworks.com

Correct Answer: A,D,E

QUESTION NO: 3
Which component can be part of a load balancing group?

A. Distributed database B. Engine C. D2 agent D. Load balancing server

Correct Answer: B

QUESTION NO: 4
Which investigation element is best suited for collaboration among users?

A. Context Data B. Work Plan C. Related Incidents D. War Room

Correct Answer: A

QUESTION NO: 5
What can be added to offload integration instance processing from the main server?

A. Database node B. Application server C. Engine D. Development server

Correct Answer: A

QUESTION NO: 6
Which of these would be the most operationally efficient repository for moving XSOAR custom content from a development server to a production environment?

A. Remote git repository specified in the dev-prod configuration parameters B. The development server's default repository C. A content repository specified in the Marketplace D. Cortex XSOAR public content repository

Correct Answer: A

QUESTION NO: 7
How can Cortex XSOAR administrators prevent junior analysts from viewing a senior analyst dashboard?

A. Share the dashboard in Read and Write mode for senior analysts. B. Share the dashboard in Read Only mode for junior analysts and senior analysts. C. Share the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts. D. Share the dashboard in Read and Edit mode for senior analysts.

Correct Answer: C

QUESTION NO: 8
Match the action with the most appropriate playbook task type.

Correct Answer:

QUESTION NO: 9
Incidents need to be filtered by all of the following criteria:
1. Status - Pending
2. Exclude Category - Job
3. Severity - High
4. Owner - None (No owner assigned)
5. Type - Phishing
6. Email Subject - "You have won a million dollars"
What is the correct query syntax for the above incident search filter?

A. Status:Pending and -Category:job and Severity:High and Owner:"" and Type:Phishing and Email Subject:You have won a million dollars B. status:Pending and -category:job and severity:High and owner:"" and type:Phishing and emailsubject:"You have won a million dollars" C. status:Pending or -category:job or severity:High or owner:"" or type:Phishing or emailsubject:"You have won a million dollars" D. status=="Pending" && category!="job" && severity=="High" && owner=="None" && type=="Phishing" && emailsubject=="You have won a million dollars"

Correct Answer: B

QUESTION NO: 10
Reliability scores in XSOAR range from A through F. What do A and F stand for?

A. F - Reliability cannot be judged, A - Completely Reliable B. F - Not usually reliable, A - Fairly Reliable C. F - Not reliable, A - Usually Reliable D. F - Unreliable, A - Completely Reliable

Correct Answer: D

QUESTION NO: 11
What are two primary uses of standard tasks? (Choose two.)

A. To highlight different paths in a playbook B. To create an incident or escalate an existing incident C. To generate new widgets for a dashboard D. To automate tasks such as parsing a file or enriching indicators

Correct Answer: B,D

QUESTION NO: 12
An engineer is developing a playbook that will be run multiple times for testing purposes. What is the recommended first task to be used in the playbook?

A. DeleteContext B. GenerateTest C. SetContext D. PrintContext

Correct Answer: A

QUESTION NO: 13
What assigns newly ingested event attributes to incident fields?

A. Playbooks B. Mapping C. Classification D. Layouts

Correct Answer: B

QUESTION NO: 14
Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

A. Distributed database B. Live backup (disaster recovery) C. Backup data to XSOAR engines D. Local backup

Correct Answer: B,C

Palo Alto Networks Certified Security Automation Engineer - PCSAE Exam Questions