Paloalto Networks PCSAE Palo Alto Networks Certified Security Automation Engineer Exam Practice Test

To track SLA breaches per playbook

To run a script that executes on SLA assignment

To automatically alert the analyst on SLA breach

To count the time between one or more tasks

${incident.sourceip}

${incident.Source_IP}

${incident.srcip}

${incident.Source IP}

In repetitive process flows to iterate for each playbook input

When continuously ingesting incidents from third-party systems

In repetitive process flows with no more than 10 loops

In repetitive processes that requires sub-playbook re-execution

Open a ticket with the XSOAR support team

Create a pull request directly on Github

Contribute through the XSOAR UI

Send an email to contributions@xsoar.com

10,080 minutes (7 days)

20,160 minutes (14 days)

21,600 minutes (15 days)

4,320 minutes (3 days)

reputation-script

enrich

reputationScript

reputation

Users defined in the platform (email or username)

Other organizations via the Marketplace

Users outside XSOAR via email invite

Roles defined in the platform

The commands must return a proper result to the war room for the analysts to understand

The code may not be written to XSOAR standards

The integrations are locked and cannot be edited with additional commands

The custom integration will not be maintained and updated by XSOAR content team

The Debugger panel to test data with one of last five incidents. This will affect the incident’s original incident data.

Context data from existing incidents by exporting the YAML data from incidents and importing it to playbook editor.

Debugger panel and XML data from a similar incident with New Mock Incident. This will not affect the incidents original incident data.

The Debugger panel to test data with one of last fifty incidents. This will not affect the incident’s original incident data.

Create a custom indicator field named ‘username’ and link it to the internal system indicator

Change the reputation command for the internal system indicator type

Create a new indicator type of the internal username and set a formatting script to extract only the

username

Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

The session will be running till stopped manually by administrator.

By default, the system closes automatically any debugger session that have been open 180 minutes.

!incidentSet description="Confirmed Phishing"

/incidentSet description=Confirmed Phishing

!setIncident description="Confirmed Phishing"

/setIncident description=Confirmed Phishing

XSOAR server, XSOAR engine

Application server, distributed DB server

Application server, distributed DB server, Backup server

All in one server

To run dedicated playbooks for different event types

To classify events ingested from various sources into the relevant types

To classify indicators extracted in XSOAR incidents to their respective types

To facilitate role based access to XSOAR incidents

The administrator will receive a notification that there is both a Classifier and Incident Type set for that integration instance.

The Incident Type will be ignored, and incoming incidents will be classified according to the Classifier.

The Classifier will be ignored, and incoming incidents will be classified according to the Incident Type.

Both the Classifier and Incident Type will classify incoming incidents.

Indicators

Incidents

Reports

Fields

Run Command, Export, and Close and Delete for all selected incidents regardless of their status

Assign, Edit, and Mark as Duplicate for all selected incidents regardless of their status

Run Command for all selected incidents having Active status

Export incidents as JSON and change incident status

Short Text

HTML

Long Text

Markdown

Read/Write from context data

Over war room results

Input from the indicator page

Directly from a previous task

Get DBotScore.value where DBotScore.Score (Larger or equals) 4

Get DBotScore.value where DBotScore.Score (equals (int)) 3

Get DBotScore where DBotScore.Score (Larger than) 1

Get DBotScore where DBotScore.Score (Larger or equals) 2

They are used for branching paths in a playbook

They are used to interact with users through survey functionality

They are used to determine which incident will be executed

They are used for sending a specific QUESTION NO: to a person or team

Standard task

Conditional task

Section Header task

Data Collection task

Pre-processing

Incident creation

Classification

Playbook execution