Question 1

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

How can they achieve this?

ACreate a custom playbook that sends an email each time the fetch fails.

BCreate a new integration that monitors the incident fetch and sends an email if the fetch fails.

CSchedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

DAdd a server config to notify when incident fetch fails.

Answer : B

Question 2

An analyst runs the following command in a playbook task:

!ip ip=1.1.1.1

Which extraction mode needs to be enabled on the Advanced tab of the playbook task to synchronously extract indicators from the results of this command?

ASynchronous

BExtract

COut of band

DInline

Answer : D

Question 3

What can you use to assign a layout, field, and playbook to an incoming incident?

APlaybook

BClassification and mapping

CIncident type

DPre-processing

Answer : B

Question 4

For troubleshooting, after a log bundle is created, where do the logs appear on the XCSOAR server?

A/var/lib/demisto

B/tmp/log/demisto

C/usr/local/demisto

D/var/log/demisto

Answer : D

Question 5

Which two functions in XSOAR are incident types used for? (Choose two.)

ATo run dedicated playbooks for different event types

BTo classify events ingested from various sources into the relevant types

CTo classify indicators extracted in XSOAR incidents to their respective types

DTo facilitate role based access to XSOAR incidents

Answer : B, C

Free Palo Alto Networks Certified Security Automation Engineer Questions for Palo Alto Networks Certified Security Automation Engineer Exam as PDF & Practice Test Software

Question 1

Question 2

Question 3

Question 4

Question 5