PCSAE Exam Questions

A SOC manager built a dashboard and would like to share the dashboard with other team members. How would the SOC manager create a dashboard that meets this requirement?

Which two methods will allow data to be saved in incident fields within a playbook? (Choose two.)

Which built-in automation/command cab be used to change an incident's type?

An engineer notices that playbooks only start once the user clicks the `investigate' button and he/she would like the playbook to start automatically. How can this be implemented?

Where is incident data stored?

If disk use is 45%, which color is the disk status indicator on the System Health dashboard?

What are two sources of alert enrichment for Cortex XSOAR? (Choose two.)

Which two statements describe how timers are configured to start and stop automatically in a playbook? (Choose two.)

How long is the trial period for paid content packs?

Which three support types are included in the Marketplace Content Packs? (Choose three.)

Which three authentication methods are supported when logging into XSOAR? (Choose three.)

Which two components have their own context data? (Choose two.)

What are two main uses of context data? (Choose two.)

Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE- 2017-11882. This vulnerability affects applications installed on workstations. The SOC t...

When creating a new tab in the layout, which section cannot be added?

Which type of task is used to interact with users through a survey?

Mapping of threat intel feeds enables which two abilities? (Choose two.)

Where can the entire history of group interactions involving an attack response be seen?

Which two capabilities do Automation script settings include? (Choose two.)

What is a primary use case of data collection tasks?

In which three locations can an engineer try to find information, when troubleshooting a failed integration instance error produced by the test button? (Choose three.)

In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)

By default, which components does an XSOAR implementation include?

Which three statements are true about the Marketplace? (Choose three.)

Which command is used to retrieve lists to use in a playbook task?

Which is the default global registry for Docker?

Which three scripting languages can an engineer use to write XSOAR automations? (Choose three.)

After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The...

Where can engineers add the post-processing scripts to incidents?

An engineer would like to present a trend using widgets to compare to a previous week's dat

What happens when an integration is deprecated?

Which investigation element is best suited for collaboration among users?

Which two causes may be occurring if an integration test is working, but the integration is not fetching incidents? (Choose two.)

What can be added to offload integration instance processing from the main server?

Which XSOAR architecture would be recommended for Managed Security Service Providers (MSSP)?

An incident field is created having the display name as Source_IP. How can the field be accessed?

An engineer deployed two different instances of Active Directory for each organization site. As part of account enrichment use case, the engineer would like to delete a user from o...

An engineer is developing a playbook that will be run multiple times for testing purposes. What is the recommended first task to be used in the playbook?

What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

While testing a custom integration, an XSOAR engineer noticed that the incident fetch interval is missing. How can this be fixed?

What is the default landing page for a new user in XSOAR?

On the System Diagnostics page, what is the default minimum size for a Work Plan to be considered big?

Which development languages are supported when creating XSOAR automation scripts?

What will happen if a playbook debugger is left running for more than 24 hours?

You need to retrieve a list of all malicious hashes over the last 30 days. What is the correct query to use?

What is the default configuration for indicator auto-extraction when incidents are created?

What are the out-of-the-box aggregate values that can be applied on widgets data?

What assigns newly ingested event attributes to incident fields?

The XSOAR administrator is writing an automation and would like to return an error entry back into XSOAR if a particular command errors out. How can this be achieved?

An organization has recently acquired another company as its subsidiary. The subsidiary has its infrastructure on AWS cloud as illustrated in the image below: The organization want...