Palo Alto Networks PCSAE Exam - Topic 1 Question 15 Discussion

Actual exam question for Palo Alto Networks's PCSAE exam

Question #: 15
Topic #: 1

An engineer's organization system is registered in the following manner: . The engineer created a new indicator type for detecting systems using regex. The engineer would now like the username to be created as a separate 'User' indicator automatically once a system is found.

What is the most efficient way for the engineer to achieve this?

ACreate a custom indicator field named 'username' and link it to the internal system indicator

BChange the reputation command for the internal system indicator type

CCreate a new indicator type of the internal username and set a formatting script to extract only the
username

DCreate a new indicator type of the internal username and have the regex included on any string that has dash at the beginning

Show Suggested Answer

Suggested Answer: B

by Elouise at May 06, 2022, 09:06 PM

Limited Time Offer

25%

Off

Get Premium PCSAE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Teddy

4 months ago

Wait, can regex really handle that? Sounds a bit risky!

upvoted 0 times

...

Rikki

4 months ago

I agree with C, it’s straightforward and efficient!

upvoted 0 times

...

Hildred

4 months ago

Not sure about D, regex can be tricky with dashes.

upvoted 0 times

...

Leslie

4 months ago

I think option A could work too, but it might be more complex.

upvoted 0 times

...

Dacia

4 months ago

Option C seems like the best choice for extracting the username.

upvoted 0 times

...

Quentin

5 months ago

I'm leaning towards option D, but I'm not sure if including regex for strings with a dash at the beginning is the right way to go. It feels a bit off.

upvoted 0 times

...

Wendell

5 months ago

I feel like creating a new indicator type for the username makes sense, especially if we can set a script to extract it. That seems efficient.

upvoted 0 times

...

Rickie

5 months ago

I remember a similar question where we had to extract data using regex, but I can't recall if changing the reputation command is the best approach here.

upvoted 0 times

...

Katina

5 months ago

I think creating a custom indicator field for 'username' could work, but I'm not entirely sure if it would automatically link to the system indicator.

upvoted 0 times

...

Audry

5 months ago

I'm a little confused by this question. Patching and administration both involve configuration management, so I'm not sure if those are completely wrong answers. I'll have to review my notes on this topic before deciding.

upvoted 0 times

...

Jenelle

5 months ago

I remember something about using events for debugging, but it feels like option C is not the complete answer here.

upvoted 0 times

...

Ora

5 months ago

I'm pretty sure the answer is B - listening. Being an attentive listener and really understanding the customer's needs is key to a positive sales experience.

upvoted 0 times

...

Soledad

5 months ago

Ah, this is a tricky one. I'm not entirely sure if a reverse proxy is the only solution here. What about using DNS to map different subdomains to the individual apps? Or could a firewall be used to route the traffic? I'll have to review my notes on network architectures to decide on the best approach.

upvoted 0 times

...