Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 191:

  An administrator for Prisma Cloud needs to obtain a graphical view to monitor all connections, including connections across hosts and connections to any Configured network objects.

  Which setting does the administrator enable or Configure to accomplish this task?

  A. ADEM
  B. WAAS Analytics
  C. Telemetry
  D. Cloud Native Network Firewall
  E. Host Insight
  D. Cloud Native Network Firewall

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/firewalls/cnnf_self_hosted.htmlToobtainagraphicalviewtomonitorallconnections,includingthoseacrosshostsandtoconfigurednetworkobjectswithinPrismaCloud,theappropriatefeaturetoenableorconfigureistheCloudNativeNetworkFirewall(OptionD).PrismaCloud'sCloudNativeNetworkFirewallprovidesvisibilityintonetworktrafficandallowsforthemonitoringandcontrolofnetworkflowswithinthecloudenvironment,effectivelyenablingadministratorstovisualizeandsecureinter-hostcommunicationsandconnectionstonetworkobjects.ADEM(OptionA)andWAASAnalytics(OptionB)arenotrelatedtoPrismaCloud'scapabilitiesformonitoringconnections.Telemetry(OptionC)involvesthecollectionofdataandmetricsbutdoesnotspecificallyprovideagraphicalviewofconnections.HostInsight(OptionE)focusesonprovidingvisibilityintohost-relatedactivitiesandvulnerabilitiesbutdoesnotspecificallydealwithmonitoringnetworkconnectionsinthegraphicalmannerdescribed.

• Question 192:

  An organization wants to restrict outbound internet access from containers.

  Which feature can help achieve this?

  A. Network segmentation policies
  B. Configuration policies
  C. Compliance policies
  D. Auto-remediation rules
  A. Network segmentation policies

  ---

  Explanation

  Network segmentation policies help restrict outbound access and prevent data exfiltration.

• Question 193:

  A customer does not want alerts to be generated from network traffic that originates from trusted internal networks.

  Which setting should you use to meet this customer's request?

  A. Trusted Login IP Addresses
  B. Anomaly Trusted List
  C. Trusted Alert IP Addresses
  D. Enterprise Alert Disposition
  C. Trusted Alert IP Addresses

  ---

  Explanation

  B --> Anomaly Trusted List--Exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default. C --> Trusted Alert IP Addresses--If you have internal networks that connect to your public cloud

  infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted ... Prisma Cloud default network policies that look for internet exposed instances also do not generate alerts when the source IP address is included in the trusted IP address list and the account hijacking anomaly policy filters out activities from known IP addresses. Also, when you use RQL to query network traffic, you can filter out traffic from known networks that are included in the trusted IP address list. For a customer who does not want alerts to be generated from network traffic originating from trusted internal networks, the appropriate setting is C. Trusted Alert IP Addresses. This setting allows for specifying certain IP addresses as trusted, meaning alerts will not be triggered by activities from these IPs, ensuring that internal network traffic is not flagged as potentially malicious.

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/trusted-ip-addresses-on-prisma-cloud.html

• Question 194:

  Which capability is associated with Cloud Runtime Security rather than Cloud Posture Security?

  A. Agentless scanning
  B. Unified compliance management
  C. Web Application and API Security (WAAS)
  D. Identity security
  C. Web Application and API Security (WAAS)

  ---

  Explanation

  The correct answer is C because WAAS is explicitly listed under Cloud Runtime Security. Agentless scanning, unified compliance management, and identity security are all listed as Cloud Posture Security elements, so A, B, and D are incorrect.

• Question 195:

  DRAG DROP

  Move the steps to the correct order to set up and execute a serverless scan using AWS DevOps.

  Select and Place:

  

  

• Question 196:

  What are the subtypes of configuration policies in Prisma Cloud?

  A. Security and Compliance
  B. Build and Deploy
  C. Build and Run
  D. Monitor and Analyze
  C. Build and Run

  ---

  Explanation

  In Prisma Cloud, configuration policies are categorized to align with the different phases of the cloud security lifecycle, emphasizing a holistic approach to cloud security management. The subtypes "Build and Run" encapsulate this approach by covering both the development phase (Build) - where cloud resources and applications are designed and created, and the operational phase (Run) - where these resources and applications are deployed and actively used. This categorization ensures that security and compliance are integral throughout the lifecycle, from the initial creation of cloud infrastructure and applications to their deployment and day-to-day operation, thereby enhancing the overall security posture.

• Question 197:

  What are two alarm types that are registered after alarms are enabled? (Choose two.)

  A. Onboarded Cloud Accounts status
  B. Resource status
  C. Compute resources
  D. External integrations status
  A. Onboarded Cloud Accounts status
  D. External integrations status

  ---

  Explanation

  Upon enabling alarms in Prisma Cloud, two critical alarm types that are registered are Onboarded Cloud Accounts status (A) and External integrations status (D). These alarms are pivotal for maintaining the health and security of the cloud environment. The Onboarded Cloud Accounts status alarms alert administrators about the connectivity and health of cloud accounts integrated with Prisma Cloud, ensuring continuous monitoring and security coverage. The External integrations status alarms provide notifications regarding the operational status of third-party services and tools integrated with Prisma Cloud, such as SIEMs, ticketing systems, or other security tools, ensuring that these integrations function correctly to support comprehensive security and incident response workflows.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alarms/prisma-cloud-alarms

• Question 198:

  A customer wants to scan a serverless function as part of a build process.

  Which twistcli command can be used to scan serverless functions?

  A. twistcli function scan <SERVERLESS_FUNCTION.ZIP>
  B. twistcli scan serverless <SERVERLESS_FUNCTION.ZIP>
  C. twistcli serverless AWS <SERVERLESS_FUNCTION.ZIP>
  D. twiscli serverless scan <SERVERLESS_FUNCTION.ZIP>
  D. twiscli serverless scan <SERVERLESS_FUNCTION.ZIP>

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/serverless_functions

• Question 199:

  Which compliance frameworks are supported by Prisma Cloud? (Choose two)

  A. PCI DSS
  B. GDPR
  C. CCNA
  D. ITIL
  A. PCI DSS
  B. GDPR

  ---

  Explanation

  Prisma Cloud supports multiple compliance frameworks, including PCI DSS and GDPR.

• Question 200:

  Which file extension type is supported for Malware scanning in Prisma Cloud Data Security (PCDS)?

  A. .bat
  B. .apk
  C. .vb
  D. .py
  B. .apk

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security/monitor-data-security-scan-prisma-cloud/supported-file-extensions