PCSAE Practice Questions

Question 1

Multiple company assets were reported by vulnerability scanners as being vulnerable to CVE-2017-11882. This vulnerability affects applications installed on workstations. The SOC team needs to take action and apply the new vulnerability patch that was just released. The team must first create a cause for each of the identified assets in ServiceNow IT Service Management (ITSM), in order to notify the IT department. Next, the team creates a task in the main playbook, which extracts the list of assets from the scanner report.

After the list of assets are created, what are the two solutions that the SOC team could take so that a case could be created and a patch installed? (Choose two.)

Accepted Answer

Create a sub-playbook with a single input containing the computer names that will loop 'For Each Input' and perform the following tasks:
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent

Accepted Answer

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
- Increase the iterator value by one each time
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent

Answer

Create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Condition: AreValuesEqual -- Exit on yes -- left:1, right 1) and perform the following tasks:
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent

Answer

Set a key for storing the iteration number and create a sub-playbook with a single input containing the computer names that will loop until the last item from the asset list (Exit condition: iterator equal to count of the number of item in the list) and perform the following tasks:
- Increase the iterator value by one each time
- Active Directory User Enrichment based on the computerName
- Create the ServiceNow Record by adding the enrichment information
- Mark the ticket severity as Urgent

Question 2

What are three different loop types in a playbook? (Choose three.)

Accepted Answer

Data collection

Accepted Answer

Conditional

Accepted Answer

For-each

Answer

Automation

Answer

Built-in

Question 3

What is the correct definition regarding integration parameters and command arguments?

Accepted Answer

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Answer

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are shared with other commands and must be present for each command.

Answer

Parameters are local variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Answer

Parameters are global variables which means that every command can use these configurable options in order to run. Arguments are specific to only one command.

Question 4

Where can engineers add the post-processing scripts to incidents?

Accepted Answer

Post-processing scripts must be added from the Incident Type editor

Answer

The post-processing tag must be added to the automation

Answer

Post-processing scripts must be added at the end of playbooks

Answer

Post-processing scripts must be added from the Post-Process Rules editor

Question 5

After enriching a username using Active Directory, an engineer would like to send an email to the user's manager. However, this functionality is not part of the command output. The engineer checks with raw- response=true and notices that the manager's email is returned, but not saved in the context.

How can the engineer save the data so it will be accessible?

Answer Options

AMark ignore output = true

BUse extend-context

CUse raw-response = save

DMark ignore input = true

Correct Answer: B

Accepted Answer

Use extend-context

Answer

Mark ignore output = true

Answer

Use raw-response = save

Answer

Mark ignore input = true

Free Palo Alto Networks PCSAE Exam Practice Questions & Explanations