Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 21:

  The compliance team needs to associate Prisma Cloud policies with compliance frameworks.

  Which option should the team select to perform this task?

  A. Custom Compliance
  B. Policies
  C. Compliance
  D. Alert Rules
  B. Policies

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/compliance-dashboard.html

• Question 22:

  Which resources can be added in scope while creating a vulnerability policy for continuous integration?

  A. Images and cluster
  B. Images and labels
  C. Images and containers
  D. Labels and AccountID
  B. Images and labels

• Question 23:

  You are an existing customer of Prisma Cloud Enterprise. You want to onboard a public cloud account and immediately see all of the alerts associated with this account based off ALL of your tenant's existing enabled policies. There is no requirement to send alerts from this account to a downstream application at this time.

  Which option shows the steps required during the alert rule creation process to achieve this objective?

  A. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select select all policies checkbox as part of the alert rule Confirm the alert rule
  B. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select one or more policies checkbox as part of the alert rule Confirm the alert rule
  C. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select one or more policies as part of the alert rule Add alert Notifications Confirm the alert rule
  D. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select select all policies checkbox as part of the alert rule Add alert Notifications Confirm the alert rule
  A. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select select all policies checkbox as part of the alert rule Confirm the alert rule

  ---

  Explanation

  To immediately see all alerts associated with a newly onboarded public cloud account based on existing enabled policies, it is essential to assign the account to an account group and then create an alert rule that applies to this account group.

  By selecting "select all policies," the alert rule will trigger alerts for all existing enabled policies without the need to specify individual policies or add alert notifications for downstream applications.

• Question 24:

  Which two attributes of policies can be fetched using API? (Choose two.)

  A. policy label
  B. policy signature
  C. policy mode
  D. policy violation
  A. policy label
  C. policy mode

  ---

  Explanation

  Using the Prisma Cloud API, users can fetch various attributes of policies, including the policy label (Option A) and policy mode (Option C). The policy label helps in categorizing and organizing policies, while the policy mode determines how the policy is enforced (e.g., alert, enforce). The policy signature (Option B) is not a standard attribute exposed via the API for fetching, as it relates more to the internal identification and handling of policies. The policy violation (Option D) is an outcome or event resulting from a policy breach, not an attribute of the policy itself that can be fetched via the API.

  https://prisma.pan.dev/api/cloud/cspm/policy/

• Question 25:

  DRAG DROP

  An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

  In which order should the API calls be used to accomplish this task?

  (Drag the steps into the correct order from the first step to the last.)

  Select and Place:

  

  

• Question 26:

  Which two fields are required to Configure SSO in Prisma Cloud? (Choose two.)

  A. Prisma Cloud Access SAML URL
  B. Identity Provider Issuer
  C. certificate
  D. Identity Provider Logout URL
  B. Identity Provider Issuer
  C. certificate

  ---

  Explanation

  Configuring Single Sign-On (SSO) in Prisma Cloud requires the Identity Provider Issuer (Option B) and Certificate (Option C). The Identity Provider Issuer is a unique identifier for the SSO identity provider and is used by Prisma Cloud to establish trust and validate SSO responses. The Certificate, typically an X.509 certificate, is used to sign SSO assertions and ensure the security of the SSO communication. The Prisma Cloud Access SAML URL (Option A) is provided by Prisma Cloud to configure the SSO on the identity provider's side, not the other way around. The Identity Provider Logout URL (Option D) is used for single logout configurations but is not a required field for basic SSO configuration in Prisma Cloud.

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMYeCAM

• Question 27:

  A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.

  What will be the effect if the security team chooses to Relearn on this image?

  A. The model is deleted, and Defender will relearn for 24 hours.
  B. The anomalies detected will automatically be added to the model.
  C. The model is deleted and returns to the initial learning state.
  D. The model is retained, and any new behavior observed during the new learning period will be added to the existing model.
  D. The model is retained, and any new behavior observed during the new learning period will be added to the existing model.

  ---

  Explanation

  In Prisma Cloud, when anomalies are detected and the security team chooses to Relearn on a specific image, the existing behavioral model for that image is not deleted. Instead, the system retains the model and enters a new learning period, during which it observes the behavior of the container based on the image. If new behaviors are observed during this period, they are added to the existing model, thereby refining and updating the model to reflect the current operational profile of the container. This approach allows for dynamic adaptation to changes in container behavior while preserving the valuable insights and patterns already established in the model. The Relearn function is part of Prisma Cloud's adaptive capabilities, enabling it to maintain accurate and up-to-date behavioral models that reflect the evolving nature of containerized applications.

  References:

  https://digitalguardian.com/blog/ve-steps-incident-response

• Question 28:

  Which two IDE plugins are supported by Prisma Cloud as part of its DevOps Security? (Choose two.)

  A. BitBucket
  B. Visual Studio Code
  C. CircleCI
  D. IntelliJ
  B. Visual Studio Code
  D. IntelliJ

  ---

  Explanation

  Prisma Cloud supports integration with various Integrated Development Environments (IDEs) as part of its DevOps Security offerings, including Visual Studio Code (Option B) and IntelliJ (Option D). These integrations allow developers to scan their Infrastructure as Code (IaC) templates and application code for vulnerabilities and compliance issues directly within their preferred development environments, promoting a "shift left" security approach. BitBucket (Option A) and CircleCI (Option C) are more commonly associated with Continuous Integration/Continuous Deployment (CI/CD) pipelines rather than being IDEs.

• Question 29:

  Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

  A. Host
  B. Container
  C. Functions
  D. Image
  D. Image

  ---

  Explanation

  In the context of Defend > Compliance > Containers and Images > CI within Prisma Cloud by Palo Alto Networks, the compliance checks are focused on the security posture and compliance of container images. Therefore, the type of compliance check available under this section would be related to Images, ensuring they adhere to security best practices and compliance standards before being deployed.

• Question 30:

  The InfoSec team wants to be notified via email each time a Security Group is misConfigured.

  Which Prisma Cloud tab should you choose to complete this request?

  A. Notifications
  B. Policies
  C. Alert Rules
  D. Events
  C. Alert Rules

  ---

  Explanation

  In Prisma Cloud, to notify the InfoSec team via email about misconfigured Security Groups, the appropriate tab to use is "Alert Rules." Alert rules in Prisma Cloud define the conditions under which alerts are generated and the notification channels, including email, where these alerts are sent. By configuring alert rules related to Security Group misconfigurations, the platform can automatically notify the team when such an event occurs, ensuring prompt awareness and response to potential security issues.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/create-an-alert-rule-for-build-time-checks.html