Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 121:

  If you are required to run in an air-gapped environment, which product should you install?

  A. Prisma Cloud Jenkins Plugin

  B. Prisma Cloud Compute Edition

  C. Prisma Cloud with self-hosted plugin

  D. Prisma Cloud Enterprise Edition

  Correct Answer: B

• Question 122:

  What are the two ways to scope a CI policy for image scanning? (Choose two.)

  A. container name

  B. image name

  C. hostname

  D. image labels

  Correct Answer: BD

• Question 123:

  Which policy type in Prisma Cloud can protect against malware?

  A. Data

  B. config

  C. Network

  D. Event

  Correct Answer: A

• Question 124:

  A customer has Configured the JIT, and the user created by the process is trying to log in to the Prisma Cloud console. The user encounters the following error message:

  

  What is the reason for the error message?

  A. The attribute name is not set correctly in JIT settings.

  B. The user does not exist.

  C. The user entered an incorrect password

  D. The role is not assigned for the user.

  Correct Answer: D

  https://docs.paloaltonetworks.com/prisma/prisma-sd-wan/prisma-sd-wan-admin/prisma-sd-wan-administrator-authorization-and-authentication/single-sign-on-access-using-saml/saml-setup-errors

• Question 125:

  You are an existing customer of Prisma Cloud Enterprise. You want to onboard a public cloud account and immediately see all of the alerts associated with this account based off ALL of your tenant's existing enabled policies. There is no

  requirement to send alerts from this account to a downstream application at this time.

  Which option shows the steps required during the alert rule creation process to achieve this objective?

  A. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select select all policies checkbox as part of the alert rule Confirm the alert rule

  B. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select one or more policies checkbox as part of the alert rule Confirm the alert rule

  C. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select one or more policies as part of the alert rule Add alert Notifications Confirm the alert rule

  D. Ensure the public cloud account is assigned to an account group Assign the Confirmed account group to alert rule Select select all policies checkbox as part of the alert rule Add alert Notifications Confirm the alert rule

  Correct Answer: A

  because you want to see alerts for ALL policies and downstream notifications are not required

• Question 126:

  Which component(s), if any, will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?

  A. Defenders

  B. Console

  C. Jenkins

  D. twistcli

  Correct Answer: B

• Question 127:

  Which port should a security team use to pull data from Console's API?

  A. 53

  B. 25

  C. 8084

  D. 8083

  Correct Answer: D

• Question 128:

  Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

  A. Scope - Scans run on a particular host

  B. Credential

  C. Apply rule only when vendor fixes are available

  D. Failure threshold

  E. Grace Period

  Correct Answer: CDE

• Question 129:

  Which `kind` of Kubernetes object is Configured to ensure that Defender is acting as the admission controller?

  A. MutatingWebhookconfiguration

  B. DestinationRules

  C. ValidatingWebhookconfiguration

  D. PodSecurityPolicies

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/access_control/open_policy_agent.html

• Question 130:

  An administrator sees that a runtime audit has been generated for a Container. The audit message is `DNS resolution of suspicious name wikipedia.com. type A`. Why would this message appear as an audit?

  A. The DNS was not learned as part of the Container model or added to the DNS allow list.

  B. This is a DNS known to be a source of malware.

  C. The process calling out to this domain was not part of the Container model.

  D. The Layer7 firewall detected this as anomalous behavior.

  Correct Answer: A