Free Palo Alto Networks Certified Security Automation Engineer Exam PCSAE Exam Practice Test

Inside the Incidents table view, which actions can be performed on the selected incidents? (Choose two.)

• Run Command, Export, and Close and Delete for all selected incidents regardless of their status
  
• Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status
  
• Run Command for all selected incidents having Active status
  
• Export incidents as JSON and change incident status
  

For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

• /var/lib/demisto
  
• /tmp/log/demisto
  
• /usr/local/demisto
  
• /var/log/demisto
  

What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

• Inputs are data pieces that are present in the playbook
  
• Inputs are data pieces that are present in the task
  
• Outputs are used as incident trigger for playbook
  
• Outputs can be derived from the result of a task or command
  
• Inputs are the data fields parsed by the Classifier
  

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

• -status:closed -category:job type:Phishing created:>='30 days ago'
  
• status:closed -category:job & type:Phishing created:>='30 days ago'
  
• -status:closed -category:job & type:Phishing created:<='30 days ago'
  
• -status:closed -category:job type:Phishing created:='30 days ago'
  

Which two statements accurately describe layouts? (Choose two.)

• Layouts override classification and mapping
  
• New tabs can be added to the incident layout
  
• Layouts can display incident information and custom fields
  
• Layouts add or remove custom fields from an incident type
  

In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

• Inputs and outputs
  
• Through integration context
  
• Automatically extracted by sub-playbooks
  
• From context data, if context is shared globally
  

Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

• Set a field trigger script
  
• Associate to an incident type
  
• Change field type
  
• Change field name
  

What will happen if a playbook debugger is left running for more than 24 hours?

• By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.
  
• The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.
  
• The session will be running till stopped manually by administrator.
  
• By default, the system closes automatically any debugger session that have been open 180 minutes.
  

Given the following context data, what would be the expected output of the expression?

• 1E56733826E5035233A097FCEA2046AF96EC616C
  
• E6EF5142E2553C1E442A0FFAC07636EAC61E6EDD
  
• 8D193FA162A305E4859BA8C45F5121F7265E3ABB
  
• e6ef5142e2553c1e442a0ffac07636eac61e6edd
  

Where are incident layouts customized?

• Settings > Object Setup > Incidents > Layouts
  
• Settings > Integrations > Instance configuration
  
• Settings > Object Setup > Indicators > Layouts
  
• Settings > Advanced > Incident Layouts