Verified & Latest PCSAE Dump Q&As with Correct Answers [Q28-Q50]

5/5 - (1 vote)

Verified & Latest PCSAE Dump Q&As with Correct Answers

Latest PCSAE dumps – Instant Download PDF

QUESTION 28
Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

Live backup (disaster recovery)

Distributed database

Backup data to XSOAR engines

Local backup

QUESTION 29
What is the correct definition regarding integration parameters and command arguments?

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

QUESTION 30
Which three actions can an engineer take on the troubleshooting page? (Choose three.)

Download the debug log bundle

Put the XSOAR server in maintenance mode

View and modify server configuration settings

Export and import custom content

View a list of server administrators

QUESTION 31
Which two options will troubleshoot an integration’s fetch incidents command? (Choose two.)

In the instance settings, enable the fetch incidents parameter and wait for one minute

Create a one task playbook with a fetch-incident command

execute !<integration_instance_name>-fetch

execute !<integration_name>-fetch

QUESTION 32
What is a primary use case of data collection tasks?

To allow multi-

QUESTION 33
Can an automation script execute an integration command and an integration command execute an automation script?

An automation script can execute an integration command and an integration command cannot execute an automation script

An automation script cannot execute an integration command and an integration command can execute an automation script

An automation script can execute an integration command and an integration command can execute an automation script

An automation script cannot execute an integration command and an integration command cannot execute an automation script

QUESTION 34
How can Cortex XSOAR administrators prevent junior analysts from viewing a senior analyst dashboard?

Share the dashboard in Read and Edit mode for senior analysts.

Share the dashboard in Read & Edit mode for senior analysts and Read Only for juniors analysts.

Share the dashboard in Read and Write mode for senior analysts.

Share the dashboard in Read Only mode for junior analysts and senior analysts.

QUESTION 35
What are two main uses of context data? (Choose two.)

Store incident information in JSON format

Store incident information in XML format

Pass data between playbook tasks

Pass data between to-do tasks

QUESTION 36
Incidents need to be filtered by all of the following criteria:
1.Status – Pending
2.Exclude Category – Job
3.Severity – High
4.Owner – None (No owner assigned)
5.Type – Phishing
6.Email Subject – “You have won a million dollars”
What is the correct query syntax for the above incident search filter?

status==”Pending” && category!=”job” && severity==”High” && owner==”None” && type==”Phishing” && emailsubject==”You have won a million dollars”

Status:Pending and -Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars

status:Pending and -category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

status:Pending or -category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”

QUESTION 37
An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?

The commands must return a proper result to the war room for the analysts to understand

The code may not be written to XSOAR standards

The integrations are locked and cannot be edited with additional commands

The custom integration will not be maintained and updated by XSOAR content team

QUESTION 38
The default expiration method for non-feed indicators is either to never expire or to expire after a specific period of time. How frequently does XSOAR check tor newly expired indicators?

Every 24 hours

Every 5 minutes

Every 8 hours

Every 1 hour

QUESTION 39
Where would you look to find a personalized view of your own incidents and tasks?

Incident Summary View

My Incidents

My Threat Landscape

My Dashboard

QUESTION 40
An engineer’s organization system is registered in the following manner: <SiteName-SystemID- Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate ‘User’ indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?

Create a custom indicator field named ‘username’ and link it to the internal system indicator

Change the reputation command for the internal system indicator type

Create a new indicator type of the internal username and set a formatting script to extract only the username

Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

QUESTION 41
A Cortex XSOAR Administrator is tasked with building a button for an analyst in order for the analyst to be assigned to the incident as an owner. What is the process?

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with no argument

Edit the incident layout to add a new button that calls the AssignToMeButton automation with argument assignBy={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument owner={me}

Edit the incident layout to add a new button that calls the AssignAnalystToIncident automation with argument assignBy=current

QUESTION 42
In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows with no more than 10 loops

In repetitive processes that requires sub-playbook re-execution

QUESTION 43
What are three different loop types in a playbook? (Choose three.)

Automation

Built-in

Data collection

Conditional

For-each

QUESTION 44
The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

Using the demisto_error() function

Using a print statement

Using the demisto.debug() function

Using the return_error() function

QUESTION 45
What are two primary uses of standard tasks? (Choose two.)

To highlight different paths in a playbook

To generate new widgets for a dashboard

To create an incident or escalate an existing incident

To automate tasks such as parsing a file or enriching indicators

QUESTION 46
How is data transferred between playbook tasks?

Read/Write from context data

Over war room results

Input from the indicator page

Directly from a previous task

QUESTION 47
Match the action with the most appropriate playbook task type.

Explanation

https://www.jaacostan.com/2021/02/palo-alto-cortex-xsoar-playbook-icons.html

QUESTION 48
When creating an incident layout section, it is best to place long field values within which of the following?

Section headers

Rows

Canvas

Cards

QUESTION 49
Which two options may be added when a content pack is being installed? (Choose two.)

Lists

Roles

Verified & Latest PCSAE Dump Q&As with Correct Answers [Q28-Q50]

No Responses

Leave a Reply Cancel reply

Related Certifications

PCSAE Practice Tests

Recent Posts

Recent Comments

Categories