Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 101:

  Which two frequency options are available to create a compliance report within the console? (Choose two.)

  A. One-time
  B. Monthly
  C. Recurring
  D. Weekly
  A. One-time
  C. Recurring

  ---

  Explanation

• Question 102:

  What happens when a role is deleted in Prisma Cloud?

  A. The access key associated with that role is automatically deleted.
  B. Any integrations that use the access key to make calls to Prisma Cloud will stop working.
  C. The users associated with that role will be deleted.
  D. Any user who uses that key will be deleted.
  A. The access key associated with that role is automatically deleted.

  ---

  Explanation

• Question 103:

  An administrator sees that a runtime audit has been generated for a container.

  The audit message is:

  "/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr"

  Which protection in the runtime rule would cause this audit?

  A. Networking
  B. File systems
  C. Processes
  D. Container
  C. Processes

  ---

  Explanation

  The protection in the runtime rule that would cause the audit message indicating "/bin/ls launched and is explicitly blocked in the runtime rule" is related to "Processes". In container security, a runtime rule set to monitor and restrict processes can block specific executables or commands from running within a container. If the rule is triggered, it indicates that a process that is explicitly denied by the policy attempted to execute, which in this case is the 'ls' command.

• Question 104:

  DRAG DROP

  You wish to create a custom policy with build and run subtypes.

  Match the query types for each example.

  (Select your answer from the pull-down list. Answers may be used more than once or not at all.)

  Select and Place:

  

  

• Question 105:

  Which component(s), if any, will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?

  A. Defenders
  B. Console
  C. Jenkins
  D. twistcli
  B. Console

  ---

  Explanation

  In Prisma Cloud Enterprise Edition, Palo Alto Networks hosts and runs the Console component. The Console serves as the central management interface for Prisma Cloud, allowing customers to configure policies, view alerts, and manage their cloud security posture without the need to host this component themselves.

• Question 106:

  A Systems Engineer is the administrator of a self-hosted Prisma Cloud console. They upgraded the console to the latest version. However, after the upgrade, the console does not show all the policies configured. Before they upgraded the console, they created a backup manually and exported it to a local drive. Now they have to install a Prisma Cloud to restore from the backup that they manually created.

  Which Prisma Cloud version can they can restore with the backup?

  A. Any version of Prisma Cloud Self-Hosted Console
  B. The same version of the Prisma Cloud Self-Hosted Console that the backup created
  C. Up to N-2 versions of the Prisma Cloud Self-Hosted Console that the backup created
  D. The latest version of Prisma Cloud Self-Hosted Console
  C. Up to N-2 versions of the Prisma Cloud Self-Hosted Console that the backup created

  ---

  Explanation

  In scenarios where a backup is created manually before upgrading a self-hosted console, it is crucial to restore the system using the backup that matches the version of the Prisma Cloud Self-Hosted Console from which it was taken. This ensures compatibility and integrity of the data and configurations. Using a backup with a different version of the console may lead to inconsistencies or loss of information due to potential changes in the software's data structures or features between versions. Therefore, to ensure a successful restoration, the backup must be applied to the same version of the Prisma Cloud Self- Hosted Console that it was created from.

• Question 107:

  Which options show the steps required after upgrade of Console?

  A. Uninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender
  B. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders
  C. Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable
  D. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
  C. Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable

  ---

  Explanation

• Question 108:

  A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible.

  Which action should the SOC take to follow security best practices?

  A. Enable "AWS S3 bucket is publicly accessible" policy and manually remediate each alert.
  B. Enable "AWS RDS database instance is publicly accessible" policy and for each alert, check that it is a production instance, and then manually remediate.
  C. Enable "AWS S3 bucket is publicly accessible" policy and add policy to an auto-remediation alert rule.
  D. Enable "AWS RDS database instance is publicly accessible" policy and add policy to an auto-remediation alert rule.
  D. Enable "AWS RDS database instance is publicly accessible" policy and add policy to an auto-remediation alert rule.

  ---

  Explanation

• Question 109:

  Which component in Prisma Cloud Compute is responsible for enforcing runtime protection on cloud workloads?

  A. Defender
  B. Console
  C. Twistlock
  D. Jenkins Plugin
  A. Defender

  ---

  Explanation

  Defender is the Prisma Cloud agent that enforces runtime security rules and monitors activity within cloud workloads.

• Question 110:

  Console is running in a Kubernetes cluster, and Defenders need to be deployed on nodes within this cluster.

  How should the Defenders in Kubernetes be deployed using the default Console service name?

  A. From the deployment page in Console, choose "twistlock-console" for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.
  B. From the deployment page, configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes.
  C. From the deployment page in Console, choose "twistlock-console" for Console identifier and run the "curl | bash" script on the master Kubernetes node.
  D. From the deployment page in Console, choose "pod name" for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace.
  A. From the deployment page in Console, choose "twistlock-console" for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

  ---

  Explanation

  In Kubernetes environments, deploying Defenders to protect nodes involves leveraging DaemonSets, which ensure that every node in the cluster runs a copy of a specific pod. When the Console is running within a Kubernetes cluster, it's essential to correctly reference the Console service to ensure seamless communication between Defenders and the Console. Option A is the most straightforward and Kubernetes-native method for deploying Defenders. By choosing "twistlock-console" as the Console identifier on the deployment page within the Console, users can generate a DaemonSet configuration file tailored for the Twistlock namespace. This approach ensures that the Defenders are correctly configured to communicate with the Console, providing comprehensive security coverage across the Kubernetes nodes. This method aligns with best practices for deploying security agents in Kubernetes and is supported by Prisma Cloud (formerly Twistlock) documentation, which provides step-by-step instructions for deploying Defenders using DaemonSets.