최신Palo Alto Networks XSOAR Engineer - XSOAR-Engineer무료샘플문제
문제1
To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?
To avoid exceeding API quotas for third-party services, indicators are only updated after the indicator cache expiration period. What is the default cache expiration period for indicators in XSOAR (minutes/days)?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제2
Match the corresponding action with the appropriate playbook tasks.
Match the corresponding action with the appropriate playbook tasks.
정답:
Reference:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/playbooks/playbooks- overview.html
문제3
A large number of incidents were deleted by mistake.
Which two architecture components can be used to recover the lost data? (Choose two.)
A large number of incidents were deleted by mistake.
Which two architecture components can be used to recover the lost data? (Choose two.)
정답: C,D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제4
In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)
In which two ways can data be transferred between playbooks and sub-playbooks? (Choose two.)
정답: B,D
문제5
A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named
"BlockedSenders_Email."
Which built-in command should be used within the playbook to add this email address to the specified list?.
A playbook needs to dynamically add an email sender's address to a Cortex XSOAR list named
"BlockedSenders_Email."
Which built-in command should be used within the playbook to add this email address to the specified list?.
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제6
Which two capabilities do Automation script settings include? (Choose two.)
Which two capabilities do Automation script settings include? (Choose two.)
정답: A,B
문제7
What is the default task type when creating an empty task?
What is the default task type when creating an empty task?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제8
An administrator wants to run an automation in the War Room to set the incident field "Description" to
"Confirmed Phishing". Which command should they enter in the War Room CLI?
An administrator wants to run an automation in the War Room to set the incident field "Description" to
"Confirmed Phishing". Which command should they enter in the War Room CLI?
정답: B
문제9
Which option is available in XSOAR to create the body of a Threat Intel Report?
Which option is available in XSOAR to create the body of a Threat Intel Report?
정답: A
설명: (ITDumpsKR 회원만 볼 수 있음)
문제10
An engineer would like to present a trend using widgets to compare to a previous week's data. Which two methods will allow the engineer to meet the requirement? (Choose two.)
An engineer would like to present a trend using widgets to compare to a previous week's data. Which two methods will allow the engineer to meet the requirement? (Choose two.)
정답: A,C
문제11
When using the playbook debugger, what may be the cause of a starred incident missing from the Test Data selections?.
When using the playbook debugger, what may be the cause of a starred incident missing from the Test Data selections?.
정답: D
설명: (ITDumpsKR 회원만 볼 수 있음)
문제12
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critical issues:
* Rate limits being hit on integrated reputation services
* Incidents associated with hundreds of indicators
Given the settings below, what would prevent the issues in this use case?
Incident Type: AD-Analysis -
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user -
Mark results as note: False -
Indicator Extract Mode: Inline -
Quiet Mode: False -
Task 2: ad-disable-account -
Mark results as note: True -
Indicator Extract Mode: None -
Quiet Mode: True -
Task 3: servicenow-update-ticket -
Mark results as note: False -
Indicator Extract Mode: Use System Default
Quiet Mode: False
A playbook loop that interacts with Active Directory for user details (yielding extensive data) is altered to extract newly acquired indicators of compromise (IOCs). This change results in two critical issues:
* Rate limits being hit on integrated reputation services
* Incidents associated with hundreds of indicators
Given the settings below, what would prevent the issues in this use case?
Incident Type: AD-Analysis -
Extract Indicators on Incident Creation: Use System Default (None)
Extract Indicators on Field Change: Inline
Task 1: ad-get-user -
Mark results as note: False -
Indicator Extract Mode: Inline -
Quiet Mode: False -
Task 2: ad-disable-account -
Mark results as note: True -
Indicator Extract Mode: None -
Quiet Mode: True -
Task 3: servicenow-update-ticket -
Mark results as note: False -
Indicator Extract Mode: Use System Default
Quiet Mode: False
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)
문제13
An incident has been created in the following state:
There is no playbook attached.
The War Room is available, but no commands have been run yet.
What is the status of the incident?.
An incident has been created in the following state:
There is no playbook attached.
The War Room is available, but no commands have been run yet.
What is the status of the incident?.
정답: C
설명: (ITDumpsKR 회원만 볼 수 있음)