Palo Alto Networks PCCET Online Practice Questions and Exam Preparation

Palo Alto Networks PCCET Online Questions & Answers

• Question 111:

  What is the primary security focus after consolidating data center hypervisor hosts within trust levels?

  A. control and protect inter-host traffic using routers configured to use the Border Gateway Protocol (BGP) dynamic routing protocol
  B. control and protect inter-host traffic by exporting all your traffic logs to a sysvol log server using the User Datagram Protocol (UDP)
  C. control and protect inter-host traffic by using IPv4 addressing
  D. control and protect inter-host traffic using physical network security appliances
  D. control and protect inter-host traffic using physical network security appliances

  ---

  Explanation/Reference:

  page 211 "Consolidating servers within trust levels: Organizations often consolidate servers within the same trust level into a single virtual computing environment:

  ... ... ... This virtual systems capability enables a single physical device to be used to simultaneously meet the unique requirements of multiple VMs or groups of VMs. Control and protection of inter-host traffic with physical network security

  appliances that are properly positioned and configured is the primary security focus."

• Question 112:

  What differentiates Docker from a bare metal hypervisor?

  A. Docker lets the user boot up one or more instances of an operating system on the same host whereas hypervisors do not
  B. Docker uses more resources than a bare metal hypervisor
  C. Docker is more efficient at allocating resources for legacy systems
  D. Docker uses OS-level virtualization, whereas a bare metal hypervisor runs independently from the OS
  D. Docker uses OS-level virtualization, whereas a bare metal hypervisor runs independently from the OS

  ---

  Explanation/Reference:

• Question 113:

  Which product from Palo Alto Networks extends the Security Operating Platform with the global threat intelligence and attack context needed to accelerate analysis, forensics, and hunting workflows?

  A. Global Protect
  B. WildFire
  C. AutoFocus
  D. STIX
  C. AutoFocus

  ---

  Explanation/Reference:

  page 173 "AutoFocus makes over a billion samples and sessions, including billions of artifacts, immediately actionable for security analysis and response efforts. AutoFocus extends the product portfolio with the global threat intelligence and attack context needed to accelerate analysis, forensics, and hunting workflows. Together, the platform and AutoFocus move security teams away from legacy manual approaches that rely on aggregating a growing number of detectionbased alerts and post-event mitigation, to preventing sophisticated attacks and enabling proactive hunting activities."

• Question 114:

  Network traffic capture and endpoint data capture are elements of which pillar of SecOps?

  A. Technology
  B. Interfaces
  C. People
  D. Visibility
  D. Visibility

  ---

  Explanation/Reference:

• Question 115:

  Which core NGFW subscription service defends networks from advanced persistent threats (APTs)?

  A. WildFire
  B. DNS Security
  C. Threat Prevention
  D. URL Filtering
  C. Threat Prevention

  ---

  Explanation/Reference:

• Question 116:

  In which type of Wi-Fi attack does the attacker intercept and redirect the victim's web traffic to serve content from a web server it controls?

  A. Evil Twin
  B. Emotet
  C. Meddler-in-the-middle
  D. Jasager
  C. Meddler-in-the-middle

  ---

  Explanation/Reference:

  Reference: https://www.techtarget.com/iotagenda/definition/man-in-the-middle-attack-MitM#:~:text=In%20an%20MiTM%20attack%2C%20a,user%20and%20the%20web%20application

• Question 117:

  What is used to orchestrate, coordinate, and control clusters of containers?

  A. Kubernetes
  B. Prisma Saas
  C. Docker
  D. CN-Series
  A. Kubernetes

  ---

  Explanation/Reference:

  As containers grew in popularity and used diversified orchestrators such as Kubernetes (and its derivatives, such as OpenShift), Mesos, and Docker Swarm, it became increasingly important to deploy and operate containers at scale. https:// www.dynatrace.com/news/blog/kubernetes-vs-docker/

• Question 118:

  Which option is an example of a North-South traffic flow?

  A. Lateral movement within a cloud or data center
  B. An internal three-tier application
  C. Client-server interactions that cross the edge perimeter
  D. Traffic between an internal server and internal user
  C. Client-server interactions that cross the edge perimeter

  ---

  Explanation/Reference:

  North-south refers to data packets that move in and out of the virtualized environment from the host network or a corresponding traditional data center. North-south traffic is secured by one or more physical form factor perimeter edge firewalls.

• Question 119:

  A native hypervisor runs:

  A. with extreme demands on network throughput
  B. only on certain platforms
  C. within an operating system's environment
  D. directly on the host computer's hardware
  D. directly on the host computer's hardware

  ---

  Explanation/Reference:

  Type 1 (native or bare metal). Runs directly on the host computer's hardware Type 2 (hosted). Runs within an operating system environment

• Question 120:

  On an endpoint, which method should you use to secure applications against exploits?

  A. endpoint-based firewall
  B. strong user passwords
  C. full-disk encryption
  D. software patches
  D. software patches

  ---

  Explanation/Reference:

  New software vulnerabilities and exploits are discovered all the time and thus diligent software patch management is required by system and security administrators in every organization.