Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 161:

  Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

  A. single sign-on

  B. SAML

  C. basic authentication

  D. access key

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with-prisma-cloud/access-the-prisma-cloud-api.html

• Question 162:

  Which option shows the steps to install the Console in a Kubernetes Cluster?

  A. Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

  B. Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

  C. Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

  D. Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

  Correct Answer: B

• Question 163:

  How are the following categorized?

  Backdoor account access Hijacked processes Lateral movement Port scanning

  A. audits

  B. incidents

  C. admission controllers

  D. models

  Correct Answer: B

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_types

• Question 164:

  What is the behavior of Defenders when the Console is unreachable during upgrades?

  A. Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.

  B. Defenders will fail closed until the web-socket can be re-established.

  C. Defenders will fail open until the web-socket can be re-established.

  D. Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

• Question 165:

  The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely. Which strategy should the administrator use to achieve this goal?

  A. Disable the policy

  B. Set the Alert Disposition to Conservative

  C. Change the Training Threshold to Low

  D. Set Alert Disposition to Aggressive

  Correct Answer: B

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise-settings

• Question 166:

  A security team has a requirement to ensure the environment is scanned for vulnerabilities. What are three options for configuring vulnerability policies? (Choose three.)

  A. individual actions based on package type

  B. output verbosity for blocked requests

  C. apply policy only when vendor fix is available

  D. individual grace periods for each severity level

  E. customize message on blocked requests

  Correct Answer: BCD

  Reference:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/vulnerability_management/ vuln_management_rules.html

• Question 167:

  A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company's AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is

  currently not using AWS Organizations and will require each account to be onboarded individually.

  The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts.

  Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

  A. https://api.prismacloud.io/cloud/

  B. https://api.prismacloud.io/account/aws

  C. https://api.prismacloud.io/cloud/aws

  D. https://api.prismacloud.io/accountgroup/aws

  Correct Answer: C

  https://prisma.pan.dev/api/cloud/cspm/cloud-accounts#operation/add-cloud-account

• Question 168:

  An organization wants to be notified immediately to any `High Severity` alerts for the account group `Clinical Trials` via Slack. Which option shows the steps the organization can use to achieve this goal?

  A. 1. Configure Slack Integration 2. Create an alert rule and select Clinical Trials as the account group 3. Under the Select Policies tab, filter on severity and select High4 . Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to As it Happens

  B. 1. Create an alert rule and select Clinical Trials as the account group 2. Under the Select Policies tab, filter on severity and select High3 . Under the Set Alert Notification tab, choose Slack and populate the channel 4. Set Frequency to As it Happens5 . Set up the Slack Integration to complete the configuration

  C. 1. Configure Slack Integration 2. Create an alert rule 3. Under the Select Policies tab, filter on severity and select High4 . Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to As it Happens

  D. 1. Under the Select Policies tab, filter on severity and select High2 . Under the Set Alert Notification tab, choose Slack and populate the channel 3. Set Frequency to As it Happens4 . Configure Slack Integration 5. Create an Alert rule

  Correct Answer: A

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/alerts/slack.html

• Question 169:

  Which options show the steps required after upgrade of Console?

  A. Uninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender

  B. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders

  C. Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable

  D. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console

  Correct Answer: C

• Question 170:

  An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML. Console Address: $CONSOLE_ADDRESS Websocket Address: $WEBSOCKET_ADDRESS User: $ADMIN_USER

  Which command generates the YAML file for Defender install?

  A. /twistcli defender \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS

  B. /twistcli defender export kubernetes \ --address $WEBSOCKET_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS

  C. /twistcli defender YAML kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

  D. /twistcli defender export kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html