Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 131:

  The security team wants to protect a web application container from an SQLi attack.

  Which type of policy should the administrator create to protect the container?

  A. CNAF
  B. Runtime
  C. Compliance
  D. CNNF
  A. CNAF

  ---

  Explanation

  To protect a web application container from an SQL Injection (SQLi) attack, the administrator should create a Cloud Native Application Firewall (CNAF) policy. CNAF policies are designed to protect applications running in containers from various types of attacks, including SQLi, by inspecting the traffic going to and from the containerized applications and blocking malicious requests.

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/firewalls/waas

• Question 132:

  What are two ways to scan container images in Jenkins pipelines? (Choose two.)

  A. twistcli
  B. Jenkins Docker plugin
  C. Compute Jenkins plugin
  D. Compute Azure DevOps plugin
  E. Prisma Cloud Visual Studio Code plugin with Jenkins integration
  A. twistcli
  C. Compute Jenkins plugin

  ---

  Explanation

  To scan container images in Jenkins pipelines, two effective methods are using twistcli and the Compute Jenkins plugin. twistcli is a command-line tool provided by Prisma Cloud that allows for the scanning of container images for vulnerabilities and compliance issues directly from the CI/CD pipeline. It can be integrated into Jenkins jobs as a build or post-build step to automatically scan images as part of the build process. The Compute Jenkins plugin is specifically designed for integration with Jenkins, providing a more seamless and automated way to include Prisma Cloud's security scanning capabilities within Jenkins pipelines. This plugin enables Jenkins to trigger image scans with Prisma Cloud directly and can fail builds based on scan results, ensuring that only secure and compliant images are pushed through the CI/CD pipeline. Both twistcli and the Compute Jenkins plugin are designed to integrate Prisma Cloud's security capabilities into the CI/CD process, enabling DevOps teams to identify and fix security issues early in the development lifecycle.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/jenkins_plugin.html

• Question 133:

  Which statement is true regarding CloudFormation templates?

  A. Scan support does not currently exist for nested references, macros, or intrinsic functions.
  B. A single template or a zip archive of template files cannot be scanned with a single API request.
  C. Request-Header-Field 'cloudformation-version' is required to request a scan.
  D. Scan support is provided for JSON, HTML and YAML formats.
  A. Scan support does not currently exist for nested references, macros, or intrinsic functions.

  ---

  Explanation

  CloudFormation templates, used to describe and provision all the infrastructure resources in cloud environments, support various elements including resources, mappings, parameters, and outputs. However, scan support for CloudFormation templates does not currently exist for nested references, macros, or intrinsic functions (option A). These advanced CloudFormation features can introduce complexity in scanning and interpreting the templates accurately for security and compliance checks.

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-devops-security/use-the-prisma-cloud-iac-scan-rest-api.html

• Question 134:

  Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

  A. Scope - Scans run on a particular host
  B. Credential
  C. Apply rule only when vendor fixes are available
  D. Failure threshold
  E. Grace Period
  C. Apply rule only when vendor fixes are available
  D. Failure threshold
  E. Grace Period

• Question 135:

  What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

  A. policy
  B. incident
  C. audit
  D. anomaly
  B. incident

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_explorer.html

  An automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks is known as an "incident". Incidents provide a consolidated view of related security events, making it easier for administrators to understand the scope and potential impact of an attack, and to take appropriate response actions.

• Question 136:

  Which two filters are available in the SecOps dashboard? (Choose two.)

  A. Time range
  B. Account Groups
  C. Service Name
  D. Cloud Region
  A. Time range
  B. Account Groups

  ---

  Explanation

  In the SecOps dashboard of a cloud security platform like Prisma Cloud, filters such as Time range and Account Groups are essential for narrowing down the data or security alerts based on specific time periods or organizational structures.

  The Time range filter allows users to view incidents or compliance data for a particular timeframe, facilitating trend analysis and focusing on recent events. The Account Groups filter enables the segregation of data based on different cloud accounts or organizational units, making it easier for security teams to manage and prioritize security tasks according to the business structure or cloud architecture.

• Question 137:

  Which three steps are involved in onboarding an account for Data Security? (Choose three.)

  A. Create a read-only role with in-line policies
  B. Create a Cloudtrail with SNS Topic
  C. Enable Flow Logs
  D. Enter the RoleARN and SNSARN
  E. Create a S3 bucket
  B. Create a Cloudtrail with SNS Topic
  D. Enter the RoleARN and SNSARN
  E. Create a S3 bucket

  ---

  Explanation

  Onboarding an account for Data Security involves several critical steps to ensure comprehensive coverage and effective monitoring. The steps involved include

  B. Create a Cloudtrail with SNS Topic to track and manage API calls and relevant notifications,

  D. Enter the RoleARN and SNSARN to provide necessary access and integration points for data security functions, and

  E. Create a S3 bucket which serves as a storage solution for logging and data capture essential for security analysis.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security/enable-data-security-module/add-a-new-aws-account.html

• Question 138:

  In WAAS Access control file upload controls, which three file types are supported out of the box? (Choose three.)

  A. Text
  B. Images
  C. Audio
  D. Documents
  E. Journal
  B. Images
  C. Audio
  D. Documents

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/waas_access_control

• Question 139:

  Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

  A. Visibility, Compliance, Governance, and Threat Detection and Response
  B. Network, Anomaly, and Audit Event
  C. Visibility, Workload Scanning, and Compliance
  D. Foundations, Advanced, and Optimize
  A. Visibility, Compliance, Governance, and Threat Detection and Response

  ---

  Explanation

  https://www.paloaltonetworks.com/blog/prisma-cloud/operationalize-prisma-cloud-adoption-advisor/

• Question 140:

  Which command correctly outputs scan results to stdout in tabular format and writes scan results to a JSON file while still sending the results to Console?

  A. $ twistcli images scan --address --user --password --stdout-tabular --output-file scan-results.json nginx:latest
  B. $ twistcli images scan --address --username --password --details --json-output scan-results.json nginx:latest
  C. $ twistcli images scan --address --user --password --details --file-output scan-results.json nginx:latest
  D. $ twistcli images scan --address --u --p --details --output-file scan-results.json nginx:latest
  A. $ twistcli images scan --address --user --password --stdout-tabular --output-file scan-results.json nginx:latest