PCSAE Exam Questions

Which two incident search queries are valid? (Choose two.)

What is the correct expression to use when filtering only PDF files?

Whar are possible war room result (entry) types?

An engineer asked for a specific command in an integration but the capability does not exist. The engineer decided to edit the existing integration by copying the integration and a...

How is data transferred between playbook tasks?

A large number of incidents were deleted by mistake. Which two architecture components can be used to recover the lost data? (Choose two.)

Which two statements accurately describe layouts? (Choose two.)

An engineer's organization system is registered in the following manner: <SiteName-SystemID-Username>. The engineer created a new indicator type for detecting systems using regex....

Which two options are the most effective for moving content between two environments? (Choose two.)

Which three options can be defined in the layout settings? (Choose three.)

What can be used as integration parameters?

Which two features does XSOAR offer to help recover from a server failure? (Choose two.)

When uploading content, which two options could the upload include? (Choose two.)

An engineer defined a dashboard which allows important metrics to be displayed. The engineer would like to make this dashboard the default dashboard. How can it be accomplished?

How would context data be filtered to receive only malicious indicator values with DBotScore?

Can an automation script execute an integration command and an integration command execute an automation script?

Which two options will troubleshoot an integration's fetch incidents command? (Choose two.)

Incidents need to be filtered by all of the following criteria: 1. Status - Pending 2. Exclude Category - Job 3. Severity - High 4. Owner - None (No owner assigned) 5. Type - Phish...

What does Script helper contain?

When mapping incoming data to incident fields, which statement is correct?

Which two situations would an engineer consider when configuring classification and mapping for an incident type? (Choose two.)

Which two options may be added when a content pack is being installed? (Choose two.)

What are two primary uses of standard tasks? (Choose two.)

An engineer would like to change an incident's SLA according to the severity field changes. How can the engineer achieve this task?

What are three different loop types in a playbook? (Choose three.)

What are two common use cases for conditional tasks? (Choose two.)

An engineer wants to customize the regex for the default IP indicator type. How can this change be implemented?

In which two scenarios would it be appropriate to implement a loop for a sub-playbook? (Choose two.)

Which configuration is a valid distributed database (DB) implementation?

An engineer would like to add a custom field to the New Job form for a job triggered from a threat intel feed. How would the engineer implement this?

An automation returned an output called: csvReport. What filter would be used to check if the automation returned results?

What is the difference between labels and fields?

What is the default task type when creating an empty task?

Which two methods are used to add new content to the XSOAR Content Repository? (Choose two.)

In which two options can an automation script be executed? (Choose two.)

By default, automation written in which language will be executed in a Docker container?

What is the correct definition regarding integration parameters and command arguments?

In which two locations can filters and transformers be used in XSOAR? (Choose two.)

Which three actions can an engineer take on the troubleshooting page? (Choose three.)

An XSOAR Engineer has developed a playbook and would like to contribute it to the XSOAR Marketplace to share with other users. Which two options are available to the Engineer for c...

Which two input requirements are needed to train a machine learning model? (Choose two.)

Which two solutions are available to scale an overloaded XSOAR environment? (Choose two.)

Management would like to get an incident report automatically following an incident's closure. How would this be accomplished?

Which two reasons would lead an engineer to create a custom widget? (Choose two.)

How do incidents relate to indicators?

In Cortex XSOAR, what do integrations do?

Which two advanced attributes can be applied to incident fields when editing? (Choose two.)

Given an incident with three files, how could the name of the second file be referenced?

Which component can be part of a load balancing group?

Which method accesses a field called `User Mail' in a playbook?