Palo Alto Networks Certified Cybersecurity Associate PCCET Questions & Answers

• Question 1:

  Which term describes data packets that move in and out of the virtualized environment from the host network or a corresponding traditional data center?

  A. North-South traffic

  B. Intrazone traffic

  C. East-West traffic D. Interzone traffic

  Correct Answer: A

• Question 2:

  What does SOAR technology use to automate and coordinate workflows?

  A. algorithms

  B. Cloud Access Security Broker

  C. Security Incident and Event Management

  D. playbooks

  Correct Answer: D

  SOAR tools ingest aggregated alerts from detection sources (such as SIEMs, network security tools, and mailboxes) before executing automatable, process- driven playbooks to enrich and respond to these alerts.

• Question 3:

  Which product from Palo Alto Networks extends the Security Operating Platform with the global threat intelligence and attack context needed to accelerate analysis, forensics, and hunting workflows?

  A. Global Protect

  B. WildFire

  C. AutoFocus

  D. STIX

  Correct Answer: C

  page 173 "AutoFocus makes over a billion samples and sessions, including billions of artifacts, immediately actionable for security analysis and response efforts. AutoFocus extends the product portfolio with the global threat intelligence and attack context needed to accelerate analysis, forensics, and hunting workflows. Together, the platform and AutoFocus move security teams away from legacy manual approaches that rely on aggregating a growing number of detectionbased alerts and post-event mitigation, to preventing sophisticated attacks and enabling proactive hunting activities."

• Question 4:

  Which type of malware replicates itself to spread rapidly through a computer network?

  A. ransomware

  B. Trojan horse

  C. virus

  D. worm

  Correct Answer: D

  A worm replicates through the network while a virus replicates, not necessarily to spread through the network.

• Question 5:

  What does Palo Alto Networks Cortex XDR do first when an endpoint is asked to run an executable?

  A. run a static analysis

  B. check its execution policy

  C. send the executable to WildFire

  D. run a dynamic analysis

  Correct Answer: B

• Question 6:

  How does adopting a serverless model impact application development?

  A. costs more to develop application code because it uses more compute resources

  B. slows down the deployment of application code, but it improves the quality of code development

  C. reduces the operational overhead necessary to deploy application code

  D. prevents developers from focusing on just the application code because you need to provision the underlying infrastructure to run the code

  Correct Answer: C

  List three advantages of serverless computing over CaaS: - Reduce costs - Increase agility - Reduce operational overhead

• Question 7:

  Which NGFW feature is used to provide continuous identification, categorization, and control of known and previously unknown SaaS applications?

  A. User-ID

  B. Device-ID

  C. App-ID

  D. Content-ID

  Correct Answer: C

  App-IDTM technology leverages the power of the broad global community to provide continuous identification, categorization, and granular risk-based control of known and previously unknown SaaS applications, ensuring new applications are discovered automatically as they become popular.

• Question 8:

  Which of the following is an AWS serverless service?

  A. Beta

  B. Kappa

  C. Delta

  D. Lambda

  Correct Answer: D

  Examples of serverless environments include Amazon Lambda and Azure Functions. Many PaaS offerings, such as Pivotal Cloud Foundry, also are effectively serverless even if they have not historically been marketed as such. Although serverless may appear to lack the container-specific, cloud native attribute, containers are extensively used in the underlying implementations, even if those implementations are not exposed to end users directly.

• Question 9:

  In which two cloud computing service models are the vendors responsible for vulnerability and patch management of the underlying operating system? (Choose two.)

  A. SaaS

  B. PaaS

  C. On-premises

  D. IaaS

  Correct Answer: AB

• Question 10:

  Which TCP/IP sub-protocol operates at the Layer7 of the OSI model?

  A. UDP

  B. MAC

  C. SNMP

  D. NFS

  Correct Answer: C

  Application (Layer 7 or L7): This layer identifies and establishes availability of communication partners, determines resource availability, and synchronizes communication. Presentation (Layer 6 or L6): This layer provides coding and conversion functions (such as data representation, character conversion, data compression, and data encryption) to ensure that data sent from the Application layer of one system is compatible with the Application layer of the receiving system. Session (Layer 5 or L5): This layer manages communication sessions (service requests and service responses) between networked systems, including connection establishment, data transfer, and connection release. Transport (Layer 4 or L4): This layer provides transparent, reliable data transport and end-to-end transmission control.