Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 171:

  The Prisma Cloud administrator has Configured a new policy.

  Which steps should be used to assign this policy to a compliance standard?

  A. Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

  B. Create the Compliance Standard from Compliance tab, and then select Add to Policy.

  C. Open the Compliance Standards section of the policy, and then save.

  D. Custom policies cannot be added to existing standards.

  Correct Answer: A

  The point is user created a new policy, you can't modify existing policies that were created by Prisma (default) but you can modify your own custom policies.

  Answer A is correct.

  Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

• Question 172:

  The development team wants to block Cross Site Scripting attacks from pods in its environment. How should the team construct the CNAF policy to protect against this attack?

  A. create a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to prevent .

  B. create a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.

  C. create a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.

  D. create a Container CNAF policy, targeted at a specific resource, and they should set Explicitly allowed inbound IP sources to the IP address of the pod.

  Correct Answer: C

• Question 173:

  Which intensity setting for anomaly alerts is used for the measurement of 100 events over 30 days?

  A. High

  B. Medium

  C. Low

  D. Very High

  Correct Answer: B

  Reference:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/de ne-prisma-cloud- enterprise- settings.html

• Question 174:

  Given this information: The Console is located at https://prisma-console.mydomain.local The username is: cluster The password is: password123 The image to scan is: myimage:latest

  Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?

  A. twistcli images scan --console-address https://prisma-console.mydomain.local -u cluster -p password123 --details myimage:latest

  B. twistcli images scan --console-address prisma-console.mydomain.local -u cluster -p password123 --vulnerability-details myimage:latest

  C. twistcli images scan --address prisma-console.mydomain.local -u cluster -p password123 --vulnerability-details myimage:latest

  D. twistcli images scan --address https://prisma-console.mydomain.local -u cluster -p password123 --details myimage:latest

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

• Question 175:

  A customer has Prisma Cloud Enterprise and host Defenders deployed.

  What are two options that allow an administrator to upgrade Defenders? (Choose two.)

  A. with auto-upgrade, the host Defender will auto-upgrade.

  B. auto deploy the Lambda Defender.

  C. click the update button in the web-interface.

  D. generate a new DaemonSet file.

  Correct Answer: AC

• Question 176:

  Which options show the steps required to upgrade Console when using projects?

  A. Upgrade all Supervisor Consoles Upgrade Central Console

  B. Upgrade Central Console Upgrade Central Console Defenders

  C. Upgrade Defender Upgrade Central Console Upgrade Supervisor Consoles

  D. Upgrade Central Console Upgrade all Supervisor Consoles

  Correct Answer: A

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

• Question 177:

  Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

  A. The console cannot natively run in an ECS cluster. A onebox deployment should be used.

  B. Download and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition

  C. Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition

  D. Download and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

  Correct Answer: D

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_amazon_ecs.html

• Question 178:

  A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment. Which action needs to be set for `do not use privileged containers`?

  A. Prevent

  B. Alert

  C. Block

  D. Fail

  Correct Answer: C

  Block

• Question 179:

  Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

  A. Host

  B. Container

  C. Functions

  D. Image

  Correct Answer: D

  Concerns CI images compliance policy.

• Question 180:

  The security team wants to protect a web application container from an SQLi attack. Which type of policy should the administrator create to protect the container?

  A. CNAF

  B. Runtime

  C. Compliance

  D. CNNF

  Correct Answer: A

  Reference:

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/ rewalls/waas