Palo Alto Networks PCCET Online Practice Questions and Exam Preparation

Palo Alto Networks PCCET Online Questions & Answers

• Question 161:

  What does SOAR technology use to automate and coordinate workflows?

  A. algorithms
  B. Cloud Access Security Broker
  C. Security Incident and Event Management
  D. playbooks
  D. playbooks

  ---

  Explanation/Reference:

  SOAR tools ingest aggregated alerts from detection sources (such as SIEMs, network security tools, and mailboxes) before executing automatable, process- driven playbooks to enrich and respond to these alerts.

• Question 162:

  Which type of file sharing occurs when an employee shares a file with another user who then shares with other people who shouldn't have access?

  A. Ghost
  B. Trusted
  C. Promiscuous
  D. Accidental
  C. Promiscuous

  ---

  Explanation/Reference:

• Question 163:

  Network vulnerability scanners and analyzers, such as Nessus and Wireshark, are used in which step of the cyberattack lifecycle?

  A. Installation
  B. Exploitation
  C. Reconnaissance
  D. Weaponization
  C. Reconnaissance

  ---

  Explanation/Reference:

• Question 164:

  In addition to local analysis, what can send unknown files to WildFire for discovery and deeper analysis to rapidly detect potentially unknown malware?

  A. Cortex XDR
  B. AutoFocus
  C. MineMild
  D. Cortex XSOAR
  A. Cortex XDR

  ---

  Explanation/Reference:

  In addition to local analysis, Cortex XDR can send unknown files to WildFire for discovery and deeper analysis to rapidly detect.

• Question 165:

  In SecOps, what are two of the components included in the identify stage? (Choose two.)

  A. Initial Research
  B. Change Control
  C. Content Engineering
  D. Breach Response
  A. Initial Research
  C. Content Engineering

• Question 166:

  Why have software developers widely embraced the use of containers?

  A. Containers require separate development and production environments to promote authentic code.
  B. Containers share application dependencies with other containers and with their host computer.
  C. Containers simplify the building and deploying of cloud native applications.
  D. Containers are host specific and are not portable across different virtual machine hosts.
  C. Containers simplify the building and deploying of cloud native applications.

• Question 167:

  What is the function of SOAR?

  A. It records, monitors, correlates, and analyzes the security events in an IT environment in real time.
  B. It helps with the coordination, execution, and automation of tasks between people and tools for faster response to cybersecurity attacks.
  C. It collects, integrates, and normalizes your security data to simplify your security operations.
  D. It provides prevention, detection, response, and investigation of attacks and threats by gathering and integrating all security data.
  D. It provides prevention, detection, response, and investigation of attacks and threats by gathering and integrating all security data.

  ---

  Explanation/Reference:

  Reference: https://www.paloaltonetworks.com/cyberpedia/what-is-soar#:~:text=Security%20orchestration%2C%20automation%20and%20response,all%20within%20a%20single%20platform

• Question 168:

  Which Palo Alto Networks product provides playbooks with 300+ multivendor integrations that help solve any security use case?

  A. Cortex XSOAR
  B. Prisma Cloud
  C. AutoFocus
  D. Cortex XDR
  A. Cortex XSOAR

  ---

  Explanation/Reference:

  SOAR tools ingest aggregated alerts from detection sources (such as SIEMs, network security tools, and mailboxes) before executing automatable, process- driven playbooks to enrich and respond to these alerts. https:// www.paloaltonetworks.com/cortex/security-operations-automation

• Question 169:

  Which type of Software as a Service (SaaS) application provides business benefits, is fast to deploy, requires minimal cost and is infinitely scalable?

  A. Benign
  B. Tolerated
  C. Sanctioned
  D. Secure
  C. Sanctioned

• Question 170:

  What are two effective ways to prevent port scanning? (Choose two.)

  A. Inspect network traffic flows.
  B. Install GlobalProtect.
  C. Implement continuous monitoring.
  D. Virtualize network traffic.
  A. Inspect network traffic flows.
  C. Implement continuous monitoring.

  ---

  Explanation/Reference: