PCSAE Sample Questions & Answers

The Data Collection task is the correct choice for implementing approval workflows. It can be configured to present a question with specific options (e.g., 'Approve', 'Deny') to a user or role (Tier 2 Analyst). The playbook execution pauses at this task until the required input is provided. The subsequent tasks can then use the response from the data collection task in a conditional path to either execute the destructive action or skip it.

This statement is false. A fundamental feature of XSOAR is the ability to run integration commands directly from the War Room command-line interface (CLI). This is crucial for interactive investigation, testing integration connectivity, and performing ad-hoc actions without needing a pre-built playbook. Commands are accessible via the ! prefix, for example, !ip ip=8.8.8.8.

The 'split' transformer is specifically designed for this task. It takes a string and a delimiter as arguments and returns an array of substrings. Applying a split transformer with a comma delimiter to the input string "1.1.1.1,2.2.2.2,3.3.3.3" will correctly produce the required JSON array ["1.1.1.1", "2.2.2.2", "3.3.3.3"] that can be used for looping in a sub-playbook.

In Cortex XSOAR, the visibility of specific tabs within an incident layout can be controlled by role. When configuring a layout, each tab (section) has a 'Roles' setting that dictates which user roles can view it. The most probable cause is that the 'Malware Analysis' tab has been explicitly configured to be visible only to the 'Senior Analyst' role (or a similar high-privilege role) and not the 'SOC Analyst' role, even if both roles have access to the incident type itself.

The incident ingestion process for fetching integrations relies on two key components: a Classifier and a Mapper. The Classifier inspects the raw incoming data (the 'fetch blob') to determine which Incident Type it should be assigned. Once classified, the Mapper takes the data from the blob and maps its key-value pairs to the specific fields within the designated XSOAR Incident Type. Without both, the fetched data cannot be correctly turned into a structured incident.

Quiet Mode is a performance tuning feature that prevents command results, inputs, and outputs from being written to the War Room and context data. This is particularly useful for high-frequency, low-importance commands (like polling tasks) or those that produce verbose outputs that are not needed for subsequent playbook logic. By enabling Quiet Mode, you reduce the load on the database and Elasticsearch, which can help clear the command execution queue and improve overall system performance.

Cortex XSOAR dashboards have built-in, role-based access controls. When creating or editing a dashboard, the 'Permissions' setting allows the creator to specify which roles can view or edit it. To meet the requirement, the engineer should set the permissions to the role(s) assigned to the SOC team (e.g., 'SOC Analyst', 'SOC Manager') and no others. This ensures only users with those roles will see and be able to access the dashboard.

The 'Local Changes' page is the designated interface for managing content synchronization in a dev-prod setup. The correct process is to go to this page in the development instance, find the specific playbook that was modified, select it, and use the 'Push' action. This commits the change for that specific content item to the remote Git repository. Subsequently, an administrator on the production instance can go to the same page and use the 'Pull' action to retrieve and apply the update from the repository.