PCSAE Palo Alto Networks Certified Security Automation Engineer Questions and Answers

To allow multi-QUESTION NO: surveys without authentication restrictions

To automate tasks such as parsing a file or enriching indicators

To generate new widgets for a dashboard

To determine different paths in a playbook

Distributed database

D2 agent

Engine

Load balancing server

Pre-processing

Incident creation

Classification

Playbook execution

Go to the Marketplace > Download the Fix my XSOAR playbook pack > Run the playbook > Download logs from War Room

Settings > About > Troubleshooting > Set Log Level to Debug > Download Logs

Dashboards & Reports > System Health

Settings > About > System Diagnostics

Playbooks

Classification

Mapping

Layouts

${Files.[2].Name}

${Files.Name.[2]}

${File.[1].Name}

${File.Name.[1]}

Retrieve widget chart based on script

Related incidents

War room entries picked by entry query

Incident team members

Lists

Jobs

Pre-processing rules

Exclusion List

The integration commands in a playbook can no longer be used

The integration commands can be used, but it is recommended to update to the latest content pack

The configuration settings will be lost and the integration will no longer function

The integration commands in a playbook can be used, but it will fail at runtime

Populate the custom indicator field with the built-in !SetIndicator command.

Add HTML to a list using !setList and use it as an HTML template to populate the custom indicator field.

Create a custom Indicator Mapper and populate the custom indicator field.

Use the Mapping option in the playbook task that generates the HTML report to populate the custom indicator field.

run ‘ad-delete-user’ command with ‘user-dn’ arg and using-brand=“Active Directory Query v2”

run ‘ad-delete-user’ command with ‘user-dn’ arg and raw-response=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and ignore-outputs=true

run ‘ad-delete-user’ command with ‘user-dn’ arg and using=“Active Directory

Query v2_instance_1”

Define input key in the subplaybook task. Map context values to pull from parent playbook.

The output of the previous task automatically becomes the input of the subplaybook.

Map inputs and outputs to the parent playbook and the subplaybook will use the same values.

Open the subplaybook and add inputs or outputs in the Playbook triggered task.

setFields

Field mapping

setIncident

Layout inline editing

C++, Python, Powershell

Ruby, C++, Python

Javascript, Powershell, C++

Python, Powershell, Javascript

Python

Perl

Go

JavaScript

Powershell

type:File reputation:Malicious sourcetimestamp:"30 days ago"

type:File verdict:Malicious sourcetimestamp:<="30 days ago"

type:File reputation:Malicious sourcetimestamp:="30 days ago"

type:File verdict:Malicious sourcetimestamp:>="30 days ago"

Synchronous

Extract

Out of band

Inline

Define the Incident Fetch Interval when running the integration’s commands.

Duplicate the integration. Edit the resulting copy and add incidentFetchInterval as a parameter. Save the integration. Configure the new integration instance with the interval required.

Configure the application to send incidents on the required interval.

Duplicate the integration. Add the interval in the code. Save the integration and Configure the new integration instance with the interval required.