Palo Alto Networks PAN-CSP Online Practice Questions and Exam Preparation

Palo Alto Networks PAN-CSP Online Questions & Answers

• Question 31:

  If you are required to run in an air-gapped environment, which product should you install?

  A. Prisma Cloud Jenkins Plugin
  B. Prisma Cloud Compute Edition
  C. Prisma Cloud with self-hosted plugin
  D. Prisma Cloud Enterprise Edition
  B. Prisma Cloud Compute Edition

  ---

  Explanation

  References:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud.htmlPrismaCloudComputeEditionisthesuitableproductforair-gappedenvironments,wherethereisnodirectinternetaccess.Thiseditioncanbeinstalledandoperatedinisolatedenvironments,providingcloudsecuritycapabilitieswithouttheneedforexternalconnectivity.

• Question 32:

  An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has Configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration. In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

  Which port will twistcli need to use to access the Prisma Compute APIs?

  A. 8084
  B. 443
  C. 8083
  D. 8081
  C. 8083

  ---

  Explanation

  https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console

• Question 33:

  What is the function of the external ID when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud?

  A. It is a unique identifier needed only when Monitor & Protect mode is selected.
  B. It is the resource name for the Prisma Cloud Role.
  C. It is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.
  D. It is the default name of the PrismaCloudApp stack.
  C. It is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.

  ---

  Explanation

  The external ID plays a crucial role when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud. It serves as a UUID (Universally Unique Identifier) that establishes a trust relationship between the Prisma Cloud account and the AWS account. This trust relationship is essential for allowing Prisma Cloud to securely extract data and perform security monitoring and compliance checks within the AWS environment. The use of an external ID ensures that Prisma Cloud can access the necessary information from the AWS account without compromising the security of the AWS account's credentials, adhering to the principle of least privilege and enhancing the overall security posture.

• Question 34:

  Prisma Cloud supports which three external systems that allow the import of vulnerabilities and provide additional context on risks in the cloud? (Choose three.)

  A. Splunk
  B. Qualys
  C. Amazon Inspector
  D. Amazon GuardDuty
  E. ServiceNow
  B. Qualys
  C. Amazon Inspector
  D. Amazon GuardDuty

  ---

  Explanation

  Similarly, Prisma Cloud integration with external systems such as Amazon GuardDuty, AWS Inspector, Qualys, and Tenable allow you to import vulnerabilities and provide additional context on risks in the cloud.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud

• Question 35:

  Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

  A. Visibility, Compliance, Governance, and Threat Detection and Response
  B. Network, Anomaly, and Audit Event
  C. Visibility, Security, and Compliance
  D. Foundations, Advanced, and Optimize
  A. Visibility, Compliance, Governance, and Threat Detection and Response

  ---

  Explanation

  The Adoption Advisor uses four categories to measure adoption progress for Cloud Security Posture Management: Visibility, Compliance, Governance, and Threat Detection and Response. Visibility helps to identify the resources in the environment and to ensure that security controls are in place. Compliance helps to ensure that the environment is meeting regulatory and industry standards. Governance helps to ensure that the environment is secure and managed according to policy. Threat Detection and Response helps to detect and respond to threats quickly and effectively.

  The Adoption Advisor in Prisma Cloud uses categories such as Visibility, Compliance, Governance, and Threat Detection and Response to measure adoption progress for Cloud Security Posture Management (CSPM). These categories represent key areas of focus for effectively managing and securing cloud environments. Visibility refers to the ability to see and understand all cloud resources and their configurations. Compliance involves ensuring that cloud resources comply with regulatory standards and best practices. Governance encompasses the policies and procedures that control cloud resource usage and security. Threat Detection and Response involves identifying and mitigating security threats to the cloud environment. By measuring adoption progress across these categories, organizations can assess how well they are utilizing CSPM capabilities to secure their cloud environments.

  https://www.paloaltonetworks.com/blog/prisma-cloud/operationalize-prisma-cloud-adoption-advisor/

• Question 36:

  A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment.

  Which action needs to be set for `do not use privileged containers`?

  A. Prevent
  B. Alert
  C. Block
  D. Fail
  C. Block

  ---

  Explanation

  Block-Defender stops the entire container if a process that violates your policy attempts to run.

  https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect

• Question 37:

  Prisma Cloud Compute has been installed on Onebox. After Prisma Cloud Console has been accessed. Defender is disconnected and keeps returning the error "No console connectivity" in the logs.

  What could be causing the disconnection between Console and Defender in this scenario?

  A. Port 8083 is not open for Console and Defender communication.
  B. The license key provided to the Console is invalid.
  C. Onebox script installed an older version of the Defender.
  D. Port 8084 is not open for Console and Defender communication.
  D. Port 8084 is not open for Console and Defender communication.

  ---

  Explanation

  By default, Defender is configured to communicate with Console on port 8084. If port 8084 is closed, then Defender cannot communicate with Console.

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNWXCA4#:~:text=If%20port%208084%20is%20closed%2C%20then%20Defender%20cannot%20communicate%20with%20Console.&text=Resolve%20the%20issue%20by%20setting,%3E%20Load%20Balancer%20%3E%20Defender).

• Question 38:

  Which two bot categories belong to unknown bots under Web-Application and API Security (WAAS) bot protection? (Choose two.)

  A. News bots
  B. Search engine crawlers
  C. Web scrapers
  D. HTTP libraries
  C. Web scrapers
  D. HTTP libraries

  ---

  Explanation

  Under Web-Application and API Security (WAAS) bot protection in Prisma Cloud, unknown bots are categorized based on their behavior and characteristics. Web scrapers and HTTP libraries fall into the category of unknown bots. Web scrapers are automated scripts or programs that extract data from websites, often without permission, while HTTP libraries are tools used for making HTTP requests. Both can be used benignly but may also be employed in malicious activities, hence their classification as unknown bots requiring further analysis.

• Question 39:

  A DevOps team wants to scan Terraform templates for security misconfigurations.

  Which Prisma Cloud feature should they use?

  A. Code Security
  B. Runtime Policies
  C. Network Security
  D. Incident Response
  A. Code Security

  ---

  Explanation

  Prisma Cloud Code Security scans IaC templates, such as Terraform, for security misconfigurations.

• Question 40:

  Which RQL query is used to detect certain high-risk activities executed by a root user in AWS?

  A. event from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'
  B. event from cloud.security_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'
  C. config from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey', 'DeleteAlarms' ) AND user = 'root'
  D. event from cloud.audit_logs where Risk.Level = 'high' AND user = 'root'
  A. event from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'

  ---

  Explanation

  https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples

  https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples#idda895fd2-4496-4b31-9766-7d50215dcc18