Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 111:

  The development team wants to fail CI jobs where a specific CVE is contained within the image.

  How should the development team Configure the pipeline or policy to produce this outcome?

  A. Set the specific CVE exception as an option in Jenkins or twistcli.
  B. Set the specific CVE exception as an option in Defender running the scan.
  C. Set the specific CVE exception as an option using the magic string in the Console.
  D. Set the specific CVE exception in Console's CI policy.
  D. Set the specific CVE exception in Console's CI policy.

  ---

  Explanation

  Reference tech docs:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/set_policy_ci_plugins.html

  Vulnerability rules that target the build tool can allow specific vulnerabilities by creating an exception and setting the effect to 'ignore'. Block them by creating an exception and setting hte effect to 'fail'. For example, you could create a vulnerability rule that explicitly allows CVE-2018-1234 to suppress warnings in the scan results. To fail CI jobs based on a specific CVE contained within an image, the development team should configure the policy within Prisma Cloud's Console, specifically within the Continuous Integration (CI) policy settings. By setting a specific CVE exception in the CI policy, the team can define criteria that will cause the CI process to fail if the specified CVE is detected in the scanned image. This approach allows for granular control over the build process, ensuring that images with known vulnerabilities are not promoted through the CI/CD pipeline, thereby maintaining the security posture of the deployed applications. This method is in line with best practices for integrating security into the CI/CD process, allowing for automated enforcement of security standards directly within the development pipeline.

• Question 112:

  Which two capabilities are part of Cloud Posture Security in the Palo Alto Networks Cloud Security Professional blueprint? (Choose two.)

  A. Data security posture management (DSPM)
  B. Web Application and API Security (WAAS)
  C. Kubernetes security posture management (KSPM)
  D. Software composition analysis (SCA)
  A. Data security posture management (DSPM)
  C. Kubernetes security posture management (KSPM)

  ---

  Explanation

  The correct answers are A and C because the blueprint lists Data Security Posture Management (DSPM) and Kubernetes Security Posture Management (KSPM) as cloud posture security elements. WAAS belongs to Cloud Runtime Security, and SCA belongs to Application Security, so B and D are incorrect.

• Question 113:

  A security team wants to block container runtime behavior that deviates from the learned model.

  Which type of policy should they use?

  A. Runtime policy
  B. Network policy
  C. Compliance policy
  D. Configuration policy
  A. Runtime policy

  ---

  Explanation

  Runtime policies enforce security rules based on real-time container behavior and can block malicious activities detected at runtime.

• Question 114:

  Which policy type in Prisma Cloud can protect against malware?

  A. Data
  B. config
  C. Network
  D. Event
  A. Data

  ---

  Explanation

  The Data policy type in Prisma Cloud is designed to protect against malware by scanning data and files for malicious content. This policy type helps in identifying and mitigating malware threats in the cloud environment.

• Question 115:

  When would a policy apply if the policy is set under Defend > Vulnerability > Images > Deployed?

  A. when a serverless repository is scanned
  B. when a Container is started form an Image
  C. when the Image is built and when a Container is started form an Image
  D. when the Image is built
  B. when a Container is started form an Image

  ---

  Explanation

  In Prisma Cloud, policies set under "Defend > Vulnerability > Images > Deployed" are specifically designed to apply at runtime, i.e., when a container is instantiated from an image. This ensures that any image, regardless of its point of origin or creation time, is evaluated against the defined vulnerability policies at the time it is deployed as a container in the environment. This runtime enforcement is crucial for catching vulnerabilities that may not have been present or detected during the image build phase, providing an additional layer of security for running applications.olicy

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/vulnerability_management/vuln_management_rules

• Question 116:

  Under which tactic is "Exploit Public-Facing Application" categorized in the ATT&CK framework?

  A. Defense Evasion
  B. Initial Access
  C. Execution
  D. Privilege Escalation
  B. Initial Access

  ---

  Explanation

  In the MITRE ATT&CK framework, the tactic "Exploit Public-Facing Application" is categorized under Initial Access. This tactic involves leveraging vulnerabilities in public-facing applications to gain unauthorized access to an organization's external services or applications. Initial Access tactics are concerned with the methods adversaries use to gain an initial foothold within a network, and exploiting public-facing applications is a common approach used by attackers to breach external defenses and establish a presence within a target network.

• Question 117:

  What are two built-in RBAC permission groups for Prisma Cloud? (Choose two.)

  A. Group Membership Admin
  B. Group Admin
  C. Account Group Admin
  D. Account Group Read Only
  C. Account Group Admin
  D. Account Group Read Only

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/prisma-cloud-administrator-roles

• Question 118:

  An administrator wants to study security capabilities focused on deployed workloads, runtime behavior, and protection of web applications and APIs.

  Which domain should the administrator focus on?

  A. Application Security
  B. Cloud Runtime Security
  C. Cortex Fundamentals
  D. SOC Fundamentals
  B. Cloud Runtime Security

  ---

  Explanation

  The correct answer is B because Cloud Runtime Security includes cloud workload protection, cloud detection and response, WAAS, vulnerability management, and agent management and deployment. Application Security focuses on development and scanning-related controls, while Cortex Fundamentals and SOC Fundamentals address broader platform and operational concepts, so A, C, and D are incorrect.

• Question 119:

  Which action would be applicable after enabling anomalous compute provisioning?

  A. It detects the activity caused by the spambot.
  B. It detects unusual server port activity or unusual protocol activity from a client within or outside the cloud environment.
  C. It detects potential creation of an unauthorized network of compute instances with AutoFocus.
  D. It detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking.
  D. It detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking.

  ---

  Explanation

  Enabling anomalous compute provisioning in Prisma Cloud allows for the detection of unusual and potentially unauthorized activities related to the creation of compute instances. This feature is particularly useful for identifying scenarios where an unauthorized network of compute instances might be established, either accidentally due to misconfigurations or maliciously for purposes such as cryptojacking. Cryptojacking involves the unauthorized use of someone else's compute resources to mine cryptocurrency, and anomalous compute provisioning can help in identifying such activities by highlighting unusual patterns in the provisioning of compute resources.

• Question 120:

  A customer wants to harden its environment from misconfiguration.

  Prisma Cloud Compute Compliance enforcement for hosts covers which three options? (Choose three.)

  A. Docker daemon configuration files
  B. Docker daemon configuration
  C. Host cloud provider tags
  D. Host configuration
  E. Hosts without Defender agents
  A. Docker daemon configuration files
  B. Docker daemon configuration
  D. Host configuration

  ---

  Explanation

  Prisma Cloud Compute Compliance enforcement for hosts covers several aspects to ensure a secure and compliant host environment, particularly within containerized environments. These include: Docker daemon configuration files: Ensuring that Docker daemon configuration files are set up according to best security practices is crucial. These files contain various settings that control the behavior of the Docker daemon, and misconfigurations can lead to security vulnerabilities. Docker daemon configuration: Beyond just the configuration files, the overall configuration of the Docker daemon itself is critical. This encompasses runtime settings and command-line options that determine how Docker containers are executed and managed on the host.

  Host configuration: The security of the underlying host on which Docker and other container runtimes are installed is paramount. This includes the configuration of the host's operating system, network settings, file permissions, and other system-level settings that can impact the security of the containerized applications running on top.

  By focusing on these areas, Prisma Cloud ensures that not just the containers but also the environment they run in is secure, adhering to compliance standards and best practices to mitigate risks associated with containerized deployments.