Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 141:

  What is the correct method for ensuring key-sensitive data related to SSNs and credit card numbers cannot be viewed in Dashboard > Data view during investigations?

  A. Go to Settings > Data > Snippet Masking and select Full Mask.
  B. Go to Settings > Data > Data Patterns, search for SSN Pattern, edit it, and modify the proximity keywords.
  C. Go to Settings > Cloud Accounts > Edit Cloud Account > Assign Account Group and select a group with limited permissions.
  D. Go to Policies > Data > Clone > Modify Objects containing Financial Information publicly exposed and change the file exposure to Private.
  A. Go to Settings > Data > Snippet Masking and select Full Mask.

  ---

  Explanation

  To ensure that sensitive data such as SSNs and credit card numbers are not visible in Dashboard > Data view during investigations, the correct method is to go to Settings > Data > Snippet Masking and select Full Mask (A). This feature in Prisma Cloud allows administrators to mask sensitive data snippets within the dashboard, ensuring that such information is obfuscated and not exposed to unauthorized viewers. Full Masking provides a robust level of protection by completely hiding the sensitive values, thereby enhancing data privacy and compliance with regulations that mandate the protection of personal and financial information.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security/monitor-data-security-scan-prisma-cloud/mask-sensitive-data-on-prisma-cloud

• Question 142:

  The development team is building pods to host a web front end, and they want to protect these pods with an application firewall.

  Which type of policy should be created to protect this pod from Layer7 attacks?

  A. The development team should create a WAAS rule for the host where these pods will be running.
  B. The development team should create a WAAS rule targeted at all resources on the host.
  C. The development team should create a runtime policy with networking protections.
  D. The development team should create a WAAS rule targeted at the image name of the pods.
  D. The development team should create a WAAS rule targeted at the image name of the pods.

  ---

  Explanation

  Image is the correct way of scoping the rule. Although host and image can be used to scope the rule. but the host can have other application pods which can be none web apps. scoping based on Image will make sure the rule only applies to the containers created from the web image.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/deploy_waas

• Question 143:

  Which three Orchestrator types are supported when deploying Defender? (Choose three.)

  A. Red Hat OpenShift
  B. Amazon ECS
  C. Docker Swarm
  D. Azure ACS
  E. Kubernetes
  A. Red Hat OpenShift
  B. Amazon ECS
  E. Kubernetes

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/deploy-defender/orchestrator

• Question 144:

  Which API calls can scan an image named myimage: latest with twistcli and then retrieve the results from Console?

  A. $ twistcli images scan \ --address \ --user \ --password \ --verbose \ myimage: latest
  B. $ twistcli images scan \ --address \ --user \ --password \ --details \ myimage: latest
  C. $ twistcli images scan \ --address \ --user \ --password \ myimage: latest
  D. $ twistcli images scan \ --address \ --user \ --password \ --console \ myimage: latest
  B. $ twistcli images scan \ --address \ --user \ --password \ --details \ myimage: latest

• Question 145:

  Which type of query is used for scanning Infrastructure as Code (laC) templates?

  A. API
  B. XML
  C. JSON
  D. RQL
  C. JSON

• Question 146:

  DRAG DROP

  Order the steps involved in onboarding an AWS Account for use with Data Security feature.

  Select and Place:

  

  

• Question 147:

  Which three types of runtime rules can be created? (Choose three.)

  A. Processes
  B. Network-outgoing
  C. Filesystem
  D. Kubernetes-audit
  E. Waas-request
  A. Processes
  B. Network-outgoing
  C. Filesystem

  ---

  Explanation

  In Prisma Cloud, runtime rules are created to monitor and control the behavior of applications and services during their execution to ensure compliance with security policies. The three types of runtime rules that can be created in Prisma Cloud are:

  Processes: These rules monitor and control the execution of processes within the environment. They can be used to detect unauthorized or malicious processes and take actions such as alerting, blocking, or terminating the processes.

  Network-outgoing: These rules govern the outbound network connections from the applications or containers. They help in controlling access to external resources, preventing data exfiltration, and ensuring that the communication complies with the security policies.

  Filesystem: Filesystem rules are related to the access and modification of the file system by applications or containers. These rules can help in detecting unauthorized access, changes to sensitive files, and ensuring that the applications adhere to the least privilege principle in terms of file access. These runtime rules are essential for maintaining the security and integrity of applications running in cloud environments, especially in dynamic and distributed architectures where traditional perimeter-based security controls may not be sufficient.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/custom_runtime_rules

• Question 148:

  Which two required request headers interface with Prisma Cloud API? (Choose two.)

  A. Content-type:application/json
  B. x-redlock-auth
  C. >x-redlock-request-id
  D. Content-type:application/xml
  A. Content-type:application/json
  B. x-redlock-auth

  ---

  Explanation

  Interfacing with the Prisma Cloud API, especially for tasks such as automation, integration, and advanced querying, requires specific request headers for authentication and data format specification. "Content-type:application/json" is essential for indicating that the request body is formatted as JSON, which is a widely accepted data interchange format. The "x-redlock-auth" header is critical for passing the API access key or token, which authenticates the request to Prisma Cloud's API. This authentication mechanism ensures secure access to Prisma Cloud's capabilities while maintaining the integrity and confidentiality of the interactions.

  References:

  https://prisma.pan.dev/api/cloud/api-headers/

• Question 149:

  What is required for Prisma Cloud to successfully execute auto-remediation commands?

  A. Access to the cloud platform only for Azure
  B. Write access to the cloud platform
  C. Read access to the cloud platform
  D. Prisma Cloud requires no access to the cloud platform
  B. Write access to the cloud platform

  ---

  Explanation

  For Prisma Cloud to execute auto-remediation commands, it requires write access to the cloud platform. This is because auto-remediation involves making changes to configurations or settings within the cloud environment to rectify security issues. Thus, the correct answer is B: Write access to the cloud platform.

• Question 150:

  A Prisma Cloud Administrator needs to enable a Registry Scanning for a registry that stores Windows images.

  Which of the following statement is correct regarding this process?

  A. They can deploy any type of container defender to scan this registry.
  B. There are Windows host defenders deployed in your environment already.
  C. There are Windows host defenders deployed in your environment already. Therefore, they do not need to deploy any additional defenders.
  D. A defender is not required to configure this type of registry scan.
  B. There are Windows host defenders deployed in your environment already.

  ---

  Explanation

  When enabling Registry Scanning in Prisma Cloud for a registry that stores Windows images, it's important to note that Windows host defenders must be deployed in the environment to scan these images effectively. The Windows host defenders are specialized versions of the Prisma Cloud Defender that are designed to run on Windows operating systems. They provide the necessary functionality to scan Windows container images stored in registries, identifying vulnerabilities and ensuring the images comply with security policies before they are deployed. This requirement underscores the importance of having the appropriate Defender deployments that match the operating systems of the images being scanned.