Palo Alto Networks Certified Security Automation Engineer (PCSAE) Free Practice Test

Question 1

In which two locations can filters and transformers be used in XSOAR? (Choose two.)

A. Evidence Fields

B. Incident Fields

C. Playbook Tasks

D. Classification and Mapping

Correct Answer: B,C

Question 2

When creating a new tab in the layout, which section cannot be added?

A. Retrieve widget chart based on script

B. Incident team members

C. Related incidents

D. War room entries picked by entry query

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

A. Add an engine

B. Add an indexing server

C. Add a live backup server (disaster recovery)

D. Add a distributed database server

Correct Answer: C,D

Question 4

Which method accesses a field called 'User Mail' in a playbook?

A. ${usermail}

B. ${incident.usermail}

C. ${incident.User Mail}

D. ${incident.UserMail}

Correct Answer: B

Question 5

How long is the trial period for paid content packs?

A. 14 days

B. 7 days

C. 60 days

D. 30 days

Correct Answer: D

Question 6

Where do you navigate to monitor and improve the system performance and resilience for hosts in a multitenant environment?

A. Settings > Account Management > Hosts, in the main host account. Each host has a System Diagnostics page.

B. Settings > About > Troubleshooting, in the main host account. Each host has a System Diagnostics page.

C. Settings > Advanced > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

D. Settings > About > System Diagnostics, in the main host account. Each host has a System Diagnostics page.

Correct Answer: D

Question 7

What assigns newly ingested event attributes to incident fields?

A. Mapping

B. Classification

C. Layouts

D. Playbooks

Correct Answer: A

Question 8

Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

A. Run Command for all selected incidents having Active status

B. Export incidents as JSON and change incident status

C. Run Command, Export, and Close and Delete for all selected incidents regardless of their status

D. Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

Correct Answer: C,D

Question 9

In which two options can an automation script be executed? (Choose two.)

A. War room

B. Integration

C. Engine

D. Playbook

Correct Answer: A,D

Question 10

An incident field is created having the display name as Source_IP. How can the field be accessed?

A. ${incident.Source_IP}

B. ${incident.sourceip}

C. ${incident.Source IP}

D. ${incident.srcip}

Correct Answer: D

Question 11

An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and adding the needed commands.
What is the main concern when adding these commands?

A. The commands must return a proper result to the war room for the analysts to understand

B. The code may not be written to XSOAR standards

C. The custom integration will not be maintained and updated by XSOAR content team

D. The integrations are locked and cannot be edited with additional commands

Correct Answer: C

Welcome to TestSimulate

Palo Alto Networks Certified Security Automation Engineer (PCSAE) Free Practice Test