Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 121:

  How many CLI remediation commands can be added in a custom policy sequence?

  A. 2
  B. 1
  C. 4
  D. 5
  D. 5

  ---

  Explanation

• Question 122:

  Which Prisma Cloud feature can be used to monitor unusual outbound network activity from containers?

  A. Anomaly policies
  B. Network policies
  C. Compliance policies
  D. IAM policies
  A. Anomaly policies

  ---

  Explanation

  Anomaly policies detect unusual network behavior, such as excessive outbound traffic from a container.

• Question 123:

  The security auditors need to ensure that given compliance checks are being run on the host.

  Which option is a valid host compliance policy?

  A. Ensure functions are not overly permissive.
  B. Ensure host devices are not directly exposed to containers.
  C. Ensure images are created with a non-root user.
  D. Ensure compliant Docker daemon configuration.
  D. Ensure compliant Docker daemon configuration.

  ---

  Explanation

  The question focuses on valid host compliance policies within a cloud environment. Among the given options, the most relevant to host compliance is ensuring compliant Docker daemon configuration. Docker daemon configurations are

  critical for securing the host environment where containers are run. A compliant Docker daemon configuration involves setting security-related options to ensure the Docker engine operates securely. This can include configurations related to

  TLS for secure communication, logging levels, authorization plugins, and user namespace remapping for isolation.

  Ensuring functions are not overly permissive (Option A) and ensuring images are created with a non-root user (Option C) are more directly related to the security best practices for serverless functions and container images, respectively,

  rather than host-specific compliance checks. Ensuring host devices are not directly exposed to containers (Option B) is also important for security, but it falls under the broader category of container runtime security rather than host-specific

  compliance.

  Thus, the most valid host compliance policy from the given options is to ensure a compliant Docker daemon configuration, as it directly impacts the security posture of the host environment in a containerized infrastructure. This aligns with best

  practices for securing Docker environments and is a common recommendation in container security guidelines, including those from Docker and cybersecurity frameworks.

  References:

  Docker Documentation: Security configuration and best practices for Docker engine: https://docs.docker.com/engine/security/

  CIS Docker Benchmark: Providing consensus-based best practices for securing Docker environments: https://www.cisecurity.org/benchmark/docker/

• Question 124:

  During an initial deployment of Prisma Cloud Compute, the customer sees vulnerabilities in their environment. Which statement correctly describes the default vulnerability policy?

  A. It blocks all containers that contain a vulnerability.
  B. It alerts on any container with more than three critical vulnerabilities.
  C. It blocks containers after 30 days if they contain a critical vulnerability.
  D. It alerts on all vulnerabilities, regardless of severity.
  D. It alerts on all vulnerabilities, regardless of severity.

  ---

  Explanation

  By default, Prisma Cloud's vulnerability policy is configured to alert on all detected vulnerabilities across containers and images, without filtering based on the severity of the vulnerabilities. This default setting ensures that administrators are made aware of all potential security issues, providing them with comprehensive visibility into the security posture of their environment. Administrators can then assess and prioritize these vulnerabilities based on their context, severity, and impact on the organization's assets.

• Question 125:

  Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

  A. Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.
  B. Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.
  C. Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment.
  D. Let Defenders automatically upgrade.
  A. Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.
  B. Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.

  ---

  Explanation

• Question 126:

  Which scanning method should be used to check container images for vulnerabilities before deployment?

  A. CI/CD pipeline integration
  B. Manual scanning at runtime
  C. Cloud storage scanning
  D. AWS Lambda scanning
  A. CI/CD pipeline integration

  ---

  Explanation

  CI/CD integration allows Prisma Cloud to scan images before they are deployed.

• Question 127:

  Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

  A. Visibility, Compliance, Governance, and Threat Detection and Response
  B. Network, Anomaly, and Audit Event
  C. Visibility, Security, and Compliance
  D. Foundations, Advanced, and Optimize
  A. Visibility, Compliance, Governance, and Threat Detection and Response

  ---

  Explanation

  The Adoption Advisor uses four categories to measure adoption progress for Cloud Security Posture Management: Visibility, Compliance, Governance, and Threat Detection and Response. Visibility helps to identify the resources in the environment and to ensure that security controls are in place. Compliance helps to ensure that the environment is meeting regulatory and industry standards. Governance helps to ensure that the environment is secure and managed according to policy. Threat Detection and Response helps to detect and respond to threats quickly and effectively.

  The Adoption Advisor in Prisma Cloud uses categories such as Visibility, Compliance, Governance, and Threat Detection and Response to measure adoption progress for Cloud Security Posture Management (CSPM). These categories represent key areas of focus for effectively managing and securing cloud environments. Visibility refers to the ability to see and understand all cloud resources and their configurations. Compliance involves ensuring that cloud resources comply with regulatory standards and best practices. Governance encompasses the policies and procedures that control cloud resource usage and security. Threat Detection and Response involves identifying and mitigating security threats to the cloud environment. By measuring adoption progress across these categories, organizations can assess how well they are utilizing CSPM capabilities to secure their cloud environments.

  https://www.paloaltonetworks.com/blog/prisma-cloud/operationalize-prisma-cloud-adoption-advisor/

• Question 128:

  Which IAM RQL query would correctly generate an output to view users who enabled console access with both access keys and passwords?

  A. config from network where api.name = `aws-iam-get-credential-report' AND json.rule = cert_1_active is true or cert_2_active is true and password_enabled equals "true"
  B. config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"
  C. config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is false or access_key_2_active is true and password_enabled equals "*"
  D. config where api.name = `aws-iam-get-credential-report' AND json.rule= access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"
  B. config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"

  ---

  Explanation

  Only "B" is proper query on Prisma

• Question 129:

  A user from an organization is unable to log in to Prisma Cloud Console after having logged in the previous day.

  Which area on the Console will provide input on this issue?

  A. SSO
  B. Audit Logs
  C. Users and Groups
  D. Access Control
  B. Audit Logs

  ---

  Explanation

  In the event a user is unable to log in to the Prisma Cloud Console, Audit Logs serve as a critical area for investigating the issue. Audit Logs provide a detailed record of activities, including login attempts, within the Prisma Cloud environment. By examining the Audit Logs, administrators can identify failed login attempts, understand the reasons behind login failures (e.g., incorrect credentials, account lockouts, or access policy changes), and take appropriate actions to resolve the login issues, ensuring users can access the console as expected.

• Question 130:

  In which Console menu would an administrator verify whether a custom compliance check is failing or passing?

  A. Monitor > Compliance
  B. Defend > Compliance
  C. Container Security > Compliance
  D. Custom > Compliance
  A. Monitor > Compliance

  ---

  Explanation

  In Prisma Cloud, the "Monitor > Compliance" menu is the centralized location where administrators can verify the status of custom compliance checks, along with predefined compliance standards and frameworks. This section provides a comprehensive view of the organization's compliance posture, displaying whether specific compliance checks are passing or failing. It allows for detailed insights into compliance status across cloud environments, helping administrators identify areas of non-compliance, understand the reasons behind compliance failures, and take corrective actions to address any identified issues. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/custom_compliance_checks