Exam PCSAE topic 1 question 46 discussion

Actual exam question from Palo Alto Networks's PCSAE

Question #: 46
Topic #: 1

An engineer's organization system is registered in the following manner: <SiteName-SystemID-Username>. The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate `˜User' indicator automatically once a system is found.
What is the most efficient way for the engineer to achieve this?

A. Create a custom indicator field named 'username' and link it to the internal system indicator
B. Change the reputation command for the internal system indicator type
C. Create a new indicator type of the internal username and set a formatting script to extract only the username
D. Create a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

Show Suggested Answer

Suggested Answer: B 🗳️
Reference:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-threat-intel-management-guide/manage-indicators/understand-indicators/ indicator-types/indicator-type-profile

by rmurugan at Oct. 17, 2021, 11:55 a.m.

Comments

Submit Cancel

randomnametester

Highly Voted 2 years, 3 months ago

C is best answer. System message does not start with dash so it will not come up in regex of D

upvoted 8 times

...

piipo

Most Recent 4 months, 1 week ago

Selected Answer: C

C is Correct

upvoted 1 times

...

rmurugan

2 years, 9 months ago

D seems the best answer

upvoted 3 times

...

Exam PCSAE All Questions

View all questions & answers for the PCSAE exam

Exam PCSAE topic 1 question 46 discussion

Comments

randomnametester

piipo

rmurugan

SY0-701