Summer Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: ecus65

Paloalto Networks PCSAE - Palo Alto Networks Certified Security Automation Engineer

Paloalto Networks PCSAE Premium Access     Download Demo    
Page: 5 / 5
Total 156 questions

A SOC analyst needs to retrieve the list of all open phishing incidents in the last 30 days. What is the correct query to use?

A.

-status:closed -category:job type:Phishing created:>="30 days ago"

B.

status:closed -category:job & type:Phishing created:>="30 days ago"

C.

-status:closed -category:job & type:Phishing created:<="30 days ago"

D.

-status:closed -category:job type:Phishing created:="30 days ago"

Incidents need to be filtered by all of the following criteria:

1.Status – Pending

2.Exclude Category – Job

3.Severity – High

4.Owner – None (No owner assigned)

5.Type – Phishing

6.Email Subject – “You have won a million dollars”

What is the correct query syntax for the above incident search filter?

A.

status==“Pending“ && category!=”job” && severity==”High” && owner==”None” && type==”Phishing” && emailsubject==”You have won a million dollars”

B.

Status:Pending and –Category:job and Severity:High and Owner:”” and Type:Phishing and Email Subject:You have won a million dollars

C.

status:Pending and –category:job and severity:High and owner:”” and type:Phishing and emailsubject:”You have won a million dollars”

D.

status:Pending or –category:job or severity:High or owner:”” or type:Phishing or emailsubject:”You have won a million dollars”

Which two options may be added when a content pack is being installed? (Choose two.)

A.

Lists

B.

Roles

C.

Other content packs

D.

Indicator layouts

Which two statements accurately describe layouts? (Choose two.)

A.

Layouts override classification and mapping

B.

New tabs can be added to the incident layout

C.

Layouts can display incident information and custom fields

D.

Layouts add or remove custom fields from an incident type

Which two options will troubleshoot an integration’s fetch incidents command? (Choose two.)

A.

In the instance settings, enable the fetch incidents parameter and wait for one minute

B.

Create a one task playbook with a fetch-incident command

C.

execute !-fetch

D.

execute !-fetch