Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 101:

  A customer wants to monitor the company's AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now.

  Which two pieces of information do you need to onboard this account? (Choose two.)

  A. Cloudtrail

  B. Subscription ID

  C. Active Directory ID

  D. External ID

  E. Role ARN

  Correct Answer: DE

• Question 102:

  What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

  A. policy

  B. incident

  C. audit

  D. anomaly

  Correct Answer: B

• Question 103:

  An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds. What does the administrator need to Configure?

  A. A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS

  B. A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF

  C. A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

  D. A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

  Correct Answer: C

• Question 104:

  A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible. Which action should the SOC take to follow security best practices?

  A. Enable "AWS S3 bucket is publicly accessible" policy and manually remediate each alert.

  B. Enable "AWS RDS database instance is publicly accessible" policy and for each alert, check that it is a production instance, and then manually remediate.

  C. Enable "AWS S3 bucket is publicly accessible" policy and add policy to an auto-remediation alert rule.

  D. Enable "AWS RDS database instance is publicly accessible" policy and add policy to an auto-remediation alert rule.

  Correct Answer: D

• Question 105:

  The development team is building pods to host a web front end, and they want to protect these pods with an application firewall. Which type of policy should be created to protect this pod from Layer7 attacks?

  A. The development team should create a WAAS rule for the host where these pods will be running.

  B. The development team should create a WAAS rule targeted at all resources on the host.

  C. The development team should create a runtime policy with networking protections.

  D. The development team should create a WAAS rule targeted at the image name of the pods.

  Correct Answer: D

  Image is the correct way of scoping the rule. Although host and image can be used to scope the rule. but the host can have other application pods which can be none web apps. scoping based on Image will make sure the rule only applies to the containers created from the web image. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/deploy_waas

• Question 106:

  Which of the following are correct statements regarding the use of access keys? (Choose two.)

  A. Access keys must have an expiration date

  B. Up to two access keys can be active at any time

  C. System Admin can create access key for all users

  D. Access keys are used for API calls

  Correct Answer: BD

• Question 107:

  Given the following RQL:

  

  Which audit event snippet is identified by the RQL?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

  "backendServices.delete"

• Question 108:

  Given the following audit event activity snippet:

  

  Which RQL will be triggered by the audit event?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: D

  Code try to invoke action "compute.firewalls.delete"

• Question 109:

  Which three fields are mandatory when authenticating the Prisma Cloud plugin in the IntelliJ application? (Choose three.)

  A. Secret Key

  B. Prisma Cloud API URL

  C. Tags

  D. Access Key

  E. Asset Name

  Correct Answer: ABD

• Question 110:

  Which data security default policy is able to scan for vulnerabilities?

  A. Objects containing Vulnerabilities

  B. Objects containing Threats

  C. Objects containing Malware

  D. Objects containing Exploits

  Correct Answer: C

  This policy scans for objects containing Malware using Wildfire as a Service.