Palo Alto Networks PCSAE Palo Alto Networks Certified Security Automation Engineer Exam Exam Practice Test Questions

• Question 1

  Which two options may be added when a content pack is being installed? (Choose two.)

  • Lists
    
  • Roles
    
  • Other content packs
    
  • Indicator layouts
    

  Show Answer Answer: 1,,2 Next

• Question 2

  Where are incident layouts customized?

  • Settings > Object Setup > Incidents > Layouts
    
  • Settings > Integrations > Instance configuration
    
  • Settings > Object Setup > Indicators > Layouts
    
  • Settings > Advanced > Incident Layouts
    

  Show Answer Answer: 1 Next

• Question 3

  Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

  • Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual -- Exit on yes -- left:1, right 1) and perform the following tasks:
    - Active Directory User Enrichment based on the computerName
    - Create the ServiceNow Record by adding the enrichment information
    - Mark the ticket severity as Urgent
    
  • Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:
    - Active Directory User Enrichment based on the computerName
    - Create the ServiceNow Record by adding the enrichment information
    - Mark the ticket severity as Urgent
    
  • Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator contains the count of the number of items in the list) and perform the following tasks:
    - Active Directory User Enrichment based on the computerName
    - Create the ServiceNow Record by adding the enrichment information
    - Mark the ticket severity as Urgent
    
  • Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
    - Increase the iterator value by one each time
    - Active Directory User Enrichment based on the computerName
    - Create the ServiceNow Record by adding the enrichment information
    - Mark the ticket severity as Urgent
    

  Show Answer Answer: 2,,4 Next

• Question 4

  When developing the playbook, which of the following can be used by a XSOAR Administrator?

  • The Debugger panel to test data with one of last five incidents. This will affect the incident's original incident data.
    
  • Context data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.
    
  • Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.
    
  • The Debugger panel to test data with one of last fifty incidents. This will not affect the incident's original incident data.
    

  Show Answer Answer: 3 Next

• Question 5

  At what stage during the incident lifecycle is an incident type assigned?

  • Pre-processing
    
  • Incident creation
    
  • Classification
    
  • Playbook execution
    

  Show Answer Answer: 3 Next