Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 91:

  Which two statements are true about the differences between build and run config policies? (Choose two.)

  A. Run and Network policies belong to the configuration policy set.
  B. Build and Audit Events policies belong to the configuration policy set.
  C. Run policies monitor resources, and check for potential issues after these cloud resources are deployed.
  D. Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.
  E. Run policies monitor network activities in your environment, and check for potential issues during runtime.
  C. Run policies monitor resources, and check for potential issues after these cloud resources are deployed.
  D. Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.

  ---

  Explanation

  In the context of Prisma Cloud, Build and Run policies serve distinct purposes in securing cloud environments. Build policies are designed to evaluate Infrastructure as Code (IaC) templates before deployment. These policies help identify and remediate security misconfigurations in the development phase, ensuring that vulnerabilities are addressed before the infrastructure is provisioned. This proactive approach enhances security by preventing misconfigurations from reaching production environments. On the other hand, Run policies are applied to resources that are already deployed in the cloud. These policies continuously monitor the cloud environment, detecting and alerting on potential security issues that arise in the runtime. Run policies help maintain the security posture of cloud resources by identifying deviations from established security baselines and enabling quick remediation of identified issues. Both Build and Run policies are integral to a comprehensive cloud security strategy, addressing security concerns at different stages of the cloud resource lifecycle--from development and deployment to ongoing operation.

• Question 92:

  Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

  A. copy the Console address and set the config map for the default namespace.
  B. create a new namespace in Kubernetes called admission-controller.
  C. enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.
  D. copy the admission controller configuration from the Console and apply it to Kubernetes.
  D. copy the admission controller configuration from the Console and apply it to Kubernetes.

  ---

  Explanation

  When configuring Kubernetes to use Prisma Cloud Compute as an admission controller, a crucial step involves

  D. copy the admission controller configuration from the Console and apply it to Kubernetes. This step is essential for integrating Prisma Cloud Compute's security controls directly into the Kubernetes admission process, enabling real-time security assessments and policy enforcement for new or modified resources within the cluster.

  https://thenewstack.io/kubernetes-security-best-practices-to-keep-you-out-of-the-news/

• Question 93:

  A customer wants to monitor its Amazon Web Services (AWS) accounts via Prisma Cloud, but only needs the resource configuration to be monitored at present. Which two pieces of information are needed to onboard this account? (Choose two.)

  A. CloudTrail
  B. Role ARN
  C. Active Directory ID
  D. External ID
  B. Role ARN
  D. External ID

  ---

  Explanation

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OD3CAMandlang=en_US%E2%80%A9

• Question 94:

  What is an example of an outbound Notification within Prisma Cloud?

  A. AWS Inspector
  B. Qualys
  C. Tenable
  D. PagerDuty
  D. PagerDuty

  ---

  Explanation

  Outbound notifications in Prisma Cloud refer to the integration with external systems or services for the purpose of alerting or incident management. Option D: PagerDuty is an example of an outbound notification within Prisma Cloud.

  PagerDuty is a popular incident response and alerting service that teams use to manage, track, and respond to incidents in real-time. Prisma Cloud's integration with PagerDuty allows organizations to automatically forward alerts from Prisma

  Cloud to PagerDuty, enabling streamlined incident management and response workflows.

  References:

  Prisma Cloud Integration Documentation: Provides instructions for integrating Prisma Cloud with various external services, including PagerDuty, to enhance alerting and incident management capabilities. Incident Management Best Practices:

  Discusses strategies for effective incident management, highlighting the role of integrations with external alerting services like PagerDuty in improving response times and incident resolution.

• Question 95:

  An administrator sees that a runtime audit has been generated for a host. The audit message is:

  `Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix-script.stop. Low severity audit, event is automatically added to the runtime model`

  Which runtime host policy rule is the root cause for this runtime audit?

  A. Custom rule with specific configuration for file integrity
  B. Custom rule with specific configuration for networking
  C. Default rule that alerts on capabilities
  D. Default rule that alerts on suspicious runtime behavior
  D. Default rule that alerts on suspicious runtime behavior

  ---

  Explanation

  For a runtime audit generated for a host with a message indicating a service attempting to obtain capability by executing a script, the root cause for this runtime audit is most likely related to

  D. Default rule that alerts on suspicious runtime behavior. This default rule is designed to flag unusual or potentially harmful activities that could indicate a security risk, prompting further investigation.

• Question 96:

  Given the following audit event activity snippet:

  {

  "payload": {

  "requestMetadata": {

  "callerSuppliedUserAgent": "google-cloud-sdk gcloud/274.0.1 command/gcloud.compute.firewall-rules.delete invocation-id/edda7aa325264545a4322f5160c15791 environment/None environment-version/None interactive/False from-script/

  False python/2.7.15 term/ (Linux 4.14.186-146.268.amzn2.x86_64), gzip(gfe)",

  "callerIp": "52.87.62.40"

  },

  "request": {

  "@type": "type.googleapis.com/compute.firewalls.delete"

  }

  }

  }

  Which RQL will be triggered by the audit event?

  A. event from cloud.audit_logs where operation IN ('cloudsql.instances.update', 'cloudsql.sslCerts.create', 'cloudsql.instances.create', 'cloudsql.instances.delete')
  B. event from cloud.audit_logs where operation IN ('storage.buckets.create', 'storage.setIamPermissions', 'storage.buckets.delete')
  C. event from cloud.audit_logs where operation IN ('AuthorizeSecurityGroupEgress', 'AuthorizeSecurityGroupIngress', 'CreateVpc', 'DeleteFlowLogs', 'DeleteVpc', 'ModifyVpcAttribute', 'RevokeSecurityGroupIngress')
  D. event from cloud.audit_logs where operation IN ('v1.compute.networks.delete', 'beta.compute.networks.insert', 'v1.compute.routes.delete', 'v1.compute.firewalls.insert', 'v1.compute.firewalls.delete')
  D. event from cloud.audit_logs where operation IN ('v1.compute.networks.delete', 'beta.compute.networks.insert', 'v1.compute.routes.delete', 'v1.compute.firewalls.insert', 'v1.compute.firewalls.delete')

  ---

  Explanation

• Question 97:

  Which three types of buckets exposure are available in the Data Security module? (Choose three.)

  A. Public
  B. Private
  C. International
  D. Differential
  E. Conditional
  A. Public
  B. Private
  E. Conditional

  ---

  Explanation

  In the Data Security module of cloud security platforms like Prisma Cloud, the types of bucket exposures typically include Public (option A), Private (option B), and Conditional (option E). Public buckets are accessible by anyone on the internet, posing a significant data leakage risk. Private buckets are restricted to authorized users only, offering a higher level of security. Conditional exposure involves buckets that may be accessible under certain conditions or to specific users, requiring careful configuration and policy enforcement to prevent unauthorized access. International (option C) and Differential (option D) do not represent standard types of bucket exposures in cloud security contexts.s exposure are available in the Data Security module? (Choose three.)

• Question 98:

  A Prisma Cloud Administrator needs to enable a Registry Scanning for a registry that stores Windows images. Which of the following statement is correct regarding this process?

  A. They can deploy any type of container defender to scan this registry.
  B. There are Windows host defenders deployed in your environment already.
  C. There are Windows host defenders deployed in your environment already. Therefore, they do not need to deploy any additional defenders.
  D. A defender is not required to configure this type of registry scan.
  B. There are Windows host defenders deployed in your environment already.

  ---

  Explanation

  When enabling Registry Scanning in Prisma Cloud for a registry that stores Windows images, it's important to note that Windows host defenders must be deployed in the environment to scan these images effectively. The Windows host defenders are specialized versions of the Prisma Cloud Defender that are designed to run on Windows operating systems. They provide the necessary functionality to scan Windows container images stored in registries, identifying vulnerabilities and ensuring the images comply with security policies before they are deployed. This requirement underscores the importance of having the appropriate Defender deployments that match the operating systems of the images being scanned.

• Question 99:

  DRAG DROP

  Match the correct scanning mode for each given operation.

  (Select your answer from the pull-down list. Answers may be used more than once or not at all.)

  Select and Place:

  

  

• Question 100:

  Which three incident types will be re ected in the Incident Explorer section of Runtime Defense? (Choose three.)

  A. Crypto miners
  B. Brute Force
  C. Cross-Site Scripting
  D. Port Scanning
  E. SQL Injection
  A. Crypto miners
  B. Brute Force
  D. Port Scanning

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_types