Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 141:

  A customer wants to scan a serverless function as part of a build process. Which twistcli command can be used to scan serverless functions?

  A. twistcli function scan

  B. twistcli scan serverless

  C. twistcli serverless AWS

  D. twiscli serverless scan

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/serverless_functions

• Question 142:

  Per security requirements, an administrator needs to provide a list of people who are receiving e-mails for Prisma Cloud alerts. Where can the administrator locate this list of e-mail recipients?

  A. Target section within an Alert Rule.

  B. Notification Template section within Alerts.

  C. Users section within Settings.

  D. Set Alert Notification section within an Alert Rule.

  Correct Answer: D

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/send-prisma-cloud-alert-notifications-to-third-party-tools.html

• Question 143:

  Review this admission control policy:

  match[{"msg": msg}] {

  input.request.operation == "CREATE"

  input.request.kind.kind == "Pod"

  input.request.resource.resource == "pods"

  input.request.object.spec.containers[_].securityContext.privileged msg := "Privileged" }

  Which response to this policy will be achieved when the effect is set to `block`?

  A. The policy will block all pods on a Privileged host.

  B. The policy will replace Defender with a privileged Defender.

  C. The policy will alert only the administrator when a privileged pod is created.

  D. The policy will block the creation of a privileged pod.

  Correct Answer: D

  The question is mentioning about if the effect is set to "block"

  Which response to this policy will be achieved when the effect is set to `block`?

  Prevent will only terminates related process in container, otherwise block will block the resource creation.

  Answer is D

• Question 144:

  The compliance team needs to associate Prisma Cloud policies with compliance frameworks. Which option should the team select to perform this task?

  A. Custom Compliance

  B. Policies

  C. Compliance

  D. Alert Rules

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/compliance-dashboard.html

• Question 145:

  Which two processes ensure that builds can function after a Console upgrade? (Choose two.)

  A. allowing Jenkins to automatically update the plugin

  B. updating any build environments that have twistcli included to use the latest version

  C. configuring build pipelines to download twistcli at the start of each build

  D. creating a new policy that allows older versions of twistcli to connect the Console

  Correct Answer: BC

  A is wrong. Jenkins Plugin can not be upgraded automatically

• Question 146:

  Which container image scan is constructed correctly?

  A. twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

  B. twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

  C. twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 --container myimage/latest

  D. twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 --container myimage/latest --details

  Correct Answer: C

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

• Question 147:

  A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying. How should the customer automate vulnerability scanning for images deployed to Fargate?

  A. Set up a vulnerability scanner on the registry

  B. Embed a Fargate Defender to automatically scan for vulnerabilities

  C. Designate a Fargate Defender to serve a dedicated image scanner

  D. Use Cloud Compliance to identify misConfigured AWS accounts

  Correct Answer: B

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/install/install_defender/install_app_embedded_defender_fargate

• Question 148:

  A customer wants to turn on Auto Remediation.

  Which policy type has the built-in CLI command for remediation?

  A. Anomaly

  B. Audit Event

  C. Network

  D. config

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy.html

• Question 149:

  The InfoSec team wants to be notified via email each time a Security Group is misConfigured. Which Prisma Cloud tab should you choose to complete this request?

  A. Notifications

  B. Policies

  C. Alert Rules

  D. Events

  Correct Answer: C

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/create-an-alert-rule-for-build-time-checks.html

• Question 150:

  An administrator has access to a Prisma Cloud Enterprise.

  What are the steps to deploy a single container Defender on an ec2 node?

  A. Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.

  B. Execute the curl | bash script on the ec2 node.

  C. Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.

  D. Generate DaemonSet file and apply DaemonSet to the twistlock namespace.

  Correct Answer: B

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_defender/install_single_container_defender