PCSAE Online Practice Questions and Answers

Where can engineers add the post-processing scripts to incidents?

A. The post-processing tag must be added to the automation

B. Post-processing scripts must be added at the end of playbooks

C. Post-processing scripts must be added from the Incident Type editor

D. Post-processing scripts must be added from the Post-Process Rules editor

What are inputs and outputs in reference to a Playbook Development Lifecycle? (Choose three.)

A. Inputs are data pieces that are present in the playbook

B. Inputs are data pieces that are present in the task

C. Outputs are used as incident trigger for playbook

D. Outputs can be derived from the result of a task or command

E. Inputs are the data fields parsed by the Classifier

By default, which components does an XSOAR implementation include?

A. XSOAR server, XSOAR engine

B. Application server, distributed DB server

C. Application server, distributed DB server, Backup server

D. All in one server

Which two options may be added when a content pack is being installed? (Choose two.)

A. Lists

B. Roles

C. Other content packs

D. Indicator layouts

B. To automate tasks such as parsing a file or enriching indicators

C. To generate new widgets for a dashboard

D. To determine different paths in a playbook

What are three different loop types in a playbook? (Choose three.)

A. Automation

B. Built-in

C. Data collection

D. Conditional

E. For-each

An engineer's organization system is registered in the following manner: . The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be

created as a separate `User' indicator automatically once a system is found.

What is the most efficient way for the engineer to achieve this?

A. Create a custom indicator field named `username' and link it to the internal system indicator

B. Change the reputation command for the internal system indicator type

C. Create a new indicator type of the internal username and set a formatting script to extract only the username

D. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

Which of the following is a feature of XSOAR automations?

A. can run on multiple docker containers

B. can be set to run on a scheduled basis in the automation settings

C. can be password protected

D. can be written in C++

Which task type would be used to verify/check that an integration was enabled?

A. Standard task

B. Conditional task

C. Section Header task

D. Data Collection task

An administrator has noticed that an incident fetch has failed, causing several internal workflows to be backed up. The administrator would like to receive notifications the next time the incident fetch fails.

How can they achieve this?

A. Create a custom playbook that sends an email each time the fetch fails.

B. Create a new integration that monitors the incident fetch and sends an email if the fetch fails.

C. Schedule a job that runs and monitors incidents in XSOAR that will send an email if there are no new incidents.

D. Add a server config to notify when incident fetch fails.