Palo Alto Networks Certified Security Automation Engineer (PCSAE) — Question 20

When mapping incoming data to incident fields, which statement is correct?

Answer options

• A. Data that is not mapped is placed under labels
• B. Only text fields are classified
• C. Classification cannot be used if mapping is enabled
• D. Every incoming field must be mapped

Correct answer: A

Explanation

The correct answer is A because any incoming data that doesn't have a corresponding mapped field will be categorized under labels for easier identification. B is incorrect as mapping can include various data types, not just text fields. C is false since mapping and classification can coexist, and D is incorrect because not every field needs to be mapped, allowing for flexibility in data handling.