● Palo Alto Networks XSOAR Engineer Exam Materials
Hello Dears, these questions were captured from the real Palo Alto Networks XSOAR Engineer Exam. They can certainly help you prepare for the exam; however, they are not considered a 100% validated or fully corrected dump and passing cannot be guaranteed, for this reason, we are offering this material at a lower price, please note that this clarification applies only to the Palo Alto Networks XSOAR Engineer Exam, All other dumps available on our website are fully guaranteed, once the dump is fully prepared and validated, we will write another comment, Good luck with your exam preparation.
Question #1
Question #2
Which Cortex XSOAR built-in command directly updates an incident's core properties, such as severity or status? (Choose one answer)
- A. updateContext
- B. set
- C. setincident
- D. addEntry
Question #3
What is the unique identifier for a note in the incident War Room? (Choose one answer)
- A. Field ID
- B. Incident ID
- C. Entry ID
- D. Note ID
Question #4
Which command adds or updates a description to an incident that can be used within widgets? (Choose one answer)
- A. !setIncident description="This is an updated description."
- B. !Set key="description" value=This is an updated description.
- C. !Set key="description" value="This is an updated description."
- D. !setIncident description=This is an updated description.
Question #5
What is an outcome of using sections within a tab when customizing an incident layout? (Choose one answer)
- A. Enforcing mandatory fields that must be completed before an incident can be closed
- B. Restricting access to sensitive fields based on user roles, ensuring data privacy within the specific incident type
- C. Triggering specific automations or playbooks when data within that section is modified during an investigation
- D. Grouping related fields and information logically, improving readability and data entry efficiency
Question #6
Previous playbook tasks have built out the context in the image below.
User: [
0: {
Department: "Sales"
Employee ID: 10
Name: "Elvis Presley"
}
1: {
Department: "Accounting"
Employee ID: 20
Name: "Johny Cash"
}
2: {
Department: "Sales"
Employee ID: 30
}
3: {
Department: "Engineering"
Employee ID: 40
Name: "Little Richard"
}
]
When specifying ${User.Name} as an input for a sub playbook task which has the default loop configuration, how many times will the sub-playbook be executed?
(Choose one answer)
- A. 0
- B. 1
- C. 3
- D. 4
Question #7
A feed has the highest configured reliability; however, even when it sets an indicator as suspicious or benign, it has a different final verdict in Cortex XSOAR.
Based on the image below, what could be the reason for this behavior?
Filter by Traffic Light Protocol Color
Select
Indicator Reputation
Malicious
Source Reliability
B - Usually reliable
Indicator Expiration Method
Indicator Type
(Choose one answer)
- A. Source Reliability needs to be increased to "A - Completely reliable."
- B. The Traffic Light Protocol Color is empty.
- C. Indicator Reputation from the feed is set to "Malicious."
- D. The Indicator Expiration Method needs to be set to "Never Expire."
Question #8
Which two actions will group similar incidents that share a common root cause or represent different aspects of a larger problem? (Choose two answers)
- A. Merge Incidents
- B. Relate Incidents
- C. Add Child Incidents
- D. Join Incidents
Question #9
In a Dev/Prod deployment model, what is available only in the development tenant? (Choose one answer)
- A. Custom integration instances
- B. Content Repository page
- C. "Export all custom content" feature
- D. Marketplace
Question #10
Based on the image below, which key from the context points to the string GOGL?
IP: […] 10 items
VirusTotal: […] 1 item
Whois: [
IP: [
asn_registry: "arin"
entities: [
0: "GOGL"
]
raw: NULL
query: "8.8.8.8"
network: {
ip_version: "v4"
raw: NULL
handle: "NET-8-8-8-0-2"
name: "GOGL"
end_address: "8.8.8.255"
status: [
0: "active"
]
remarks: NULL
cidr: "8.8.8.0/24"
country: NULL
start_address: "8.8.8.0"
events: [
0: {
action: "last changed"
}
]
}
]
]
(Choose one answer)
- A. Whois.IP.entities
- B. Whois.IP.asn_registry.entities
- C. Whois.IP.network.name
- D. Whois.IP.[0].network.name
When re-assigning an existing incident to a new incident type, an engineer is concerned about the preservation of
critical data currently stored in fields that are only associated to the original incident type.
Upon making the change, in which state will the critical data be in the now unassociated fields? (Choose one answer)