Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 1:

  DRAG DROP

  An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.

  In which order will the APIs be executed for this service?

  (Drag the steps into the correct order of occurrence, from the first step to the last.)

  Select and Place:

  

  

• Question 2:

  A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible.

  Which action should the SOC take to follow security best practices?

  A. Enable "AWS S3 bucket is publicly accessible" policy and manually remediate each alert.
  B. Enable "AWS RDS database instance is publicly accessible" policy and for each alert, check that it is a production instance, and then manually remediate.
  C. Enable "AWS S3 bucket is publicly accessible" policy and add policy to an auto-remediation alert rule.
  D. Enable "AWS RDS database instance is publicly accessible" policy and add policy to an auto-remediation alert rule.
  D. Enable "AWS RDS database instance is publicly accessible" policy and add policy to an auto-remediation alert rule.

• Question 3:

  What is the primary purpose of Prisma Cloud Code Security?

  A. To address cloud infrastructure misconfigurations in code before they become alerts or incidents
  B. To provide a platform for developers to create custom security policies for applications
  C. To offer instant feedback on application performance issues and bottlenecks
  D. To triage alerts and incidents in realtime during deployment
  A. To address cloud infrastructure misconfigurations in code before they become alerts or incidents

  ---

  Explanation

  Prisma Cloud Code Security is designed to integrate security into the DevOps process by scanning infrastructure as code (IaC) templates and configurations for potential security issues. This proactive approach allows developers and security teams to address misconfigurations and vulnerabilities in the code itself, before they are deployed into the cloud environment and become more challenging to resolve. By identifying and rectifying these issues early in the development lifecycle, organizations can reduce the risk of alerts and incidents arising from misconfigurations in their cloud infrastructure, leading to a more secure and compliant cloud environment.

• Question 4:

  You have onboarded a public cloud account into Prisma Cloud Enterprise. configuration Resource ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account. config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully.

  Why are no alerts being generated?

  A. The public cloud account is not associated with an alert Notification.
  B. The public cloud account does not have audit trail ingestion enabled.
  C. The public cloud account does not access to configuration resources.
  D. The public cloud account is not associated with an alert rule.
  D. The public cloud account is not associated with an alert rule.

  ---

  Explanation

  In Prisma Cloud Enterprise, for alerts to be generated for configuration assets in an onboarded public cloud account, it is essential that the account is associated with an alert rule that matches the enabled config policies. If the account is not linked to an alert rule or if the existing alert rules do not match the config policies, no alerts will be generated even though configuration resource ingestion is visible, and RQL statements return config resource results. This requirement emphasizes the need for a well-structured alerting mechanism to ensure that security incidents are promptly identified and addressed.

• Question 5:

  An administrator sees that a runtime audit has been generated for a host. The audit message is:

  `Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix-script.stop.

  Low severity audit, event is automatically added to the runtime model` Which runtime host policy rule is the root cause for this runtime audit?

  A. Custom rule with specific configuration for file integrity
  B. Custom rule with specific configuration for networking
  C. Default rule that alerts on capabilities
  D. Default rule that alerts on suspicious runtime behavior
  D. Default rule that alerts on suspicious runtime behavior

  ---

  Explanation

  For a runtime audit generated for a host with a message indicating a service attempting to obtain capability by executing a script, the root cause for this runtime audit is most likely related to D. Default rule that alerts on suspicious runtime behavior. This default rule is designed to flag unusual or potentially harmful activities that could indicate a security risk, prompting further investigation.

• Question 6:

  How are the following categorized?

  Backdoor account access

  Hijacked processes

  Lateral movement

  Port scanning

  A. audits
  B. incidents
  C. admission controllers
  D. models
  B. incidents

  ---

  Explanation

  The activities listed (Backdoor account access, Hijacked processes, Lateral movement, Port scanning) are categorized as incidents (option B). Incidents represent security events or patterns of activity that indicate potential security breaches or malicious behavior within the environment. Prisma Cloud identifies and classifies such activities as incidents to highlight significant security concerns that require investigation and potential remediation. This categorization helps security teams prioritize their response efforts, focusing on activities that pose a real threat to the integrity and security of the cloud environment. By distinguishing incidents from other types of security findings, Prisma Cloud enables more effective incident response and threat management processes.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_types

• Question 7:

  Which data security default policy is able to scan for vulnerabilities?

  A. Objects containing Vulnerabilities
  B. Objects containing Threats
  C. Objects containing Malware
  D. Objects containing Exploits
  C. Objects containing Malware

  ---

  Explanation

  The data security default policy capable of scanning for vulnerabilities is "Objects containing Malware". In cloud security, malware scanning is an essential feature of CSPM tools that allows for the identification of malicious software within objects stored in the cloud. A policy that scans for objects containing malware ensures that any files or code bases in the cloud environment are examined for potential threats, protecting the cloud resources from being compromised.

• Question 8:

  What are the two ways to scope a CI policy for image scanning? (Choose two.)

  A. container name
  B. image name
  C. hostname
  D. image labels
  B. image name
  D. image labels

  ---

  Explanation

  References:

  https://www.optiv.com/insights/source-zero/blog/defending-against-container-threats-palo-alto-prisma-cloudInPrismaCloud,CIpoliciesforimagescanningcanbescopedbasedontheimagenameandimagelabels.Thesescopingoptionsallowfortargetedscanningofimages,ensuringthatpoliciesareappliedtorelevantimagesbasedontheiridentifiersormetadata.

• Question 9:

  In Prisma Cloud, which page allows viewing alerts triggered by compliance policy violations?

  A. Monitor > Alerts
  B. Defend > Compliance
  C. Manage > Security Posture
  D. Settings > Compliance
  A. Monitor > Alerts

  ---

  Explanation

  Compliance alerts are typically viewed on the Monitor > Alerts page, where administrators can monitor and manage all security alerts.

• Question 10:

  The security team wants to enable the "block" option under compliance checks on the host.

  What effect will this option have if it violates the compliance check?

  A. The host will be taken o ine.
  B. Additional hosts will be prevented form starting.
  C. Containers on a host will be stopped.
  D. No containers will be allowed to start on that host.
  D. No containers will be allowed to start on that host.

  ---

  Explanation

  Enabling the "block" option under compliance checks on a host in Prisma Cloud signifies a strict enforcement policy, where any container that violates specified compliance checks will be prevented from starting on that host. This preventive measure is crucial for maintaining a secure and compliant cloud environment, ensuring that only containers that meet the organization's compliance and security standards are allowed to run. This approach aligns with Prisma Cloud's proactive security posture management, where potential risks are mitigated before they can impact the cloud environment.