Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 181:

  An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy `AWS S3 buckets are accessible to public`. The policy definition follows: config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[? (@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockconfiguration does not exist) or ((acl.grants[? (@.grantee=='AllUsers')] size > 0) and publicAccessBlockconfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockconfiguration.restrictPublicBuckets is false)) and websiteconfiguration does not exist"

  Why did this alert get generated?

  A. an event within the cloud account

  B. network traffic to the S3 bucket

  C. configuration of the S3 bucket

  D. anomalous behaviors

  Correct Answer: C

  websiteConfiguration does not exist concerns about config not traffic. Therefore correct answer is C

• Question 182:

  Which option identifies the Prisma Cloud Compute Edition?

  A. Package installed with APT

  B. Downloadable, self-hosted software

  C. Software-as-a-Service (SaaS)

  D. Plugin to Prisma Cloud

  Correct Answer: B

  Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/welcome/pcee_vs_pcce.html

• Question 183:

  A Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud. Which two steps can be performed by the Terraform script? (Choose two.)

  A. enable ow logs for Prisma Cloud.

  B. create the Prisma Cloud role.

  C. enable the required APIs for Prisma Cloud.

  D. publish the ow log to a storage bucket.

  Correct Answer: BC

• Question 184:

  An administrator sees that a runtime audit has been generated for a host.

  The audit message is:

  `Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix-script.stop. Low severity audit, event is automatically added to the runtime model`

  Which runtime host policy rule is the root cause for this runtime audit?

  A. Custom rule with specific configuration for file integrity

  B. Custom rule with specific configuration for networking

  C. Default rule that alerts on capabilities

  D. Default rule that alerts on suspicious runtime behavior

  Correct Answer: D

• Question 185:

  Which statement about build and run policies is true?

  A. Build policies enable you to check for security misconfigurations in the IaC templates.

  B. Every type of policy has auto-remediation enabled by default.

  C. The four main types of policies are: Audit Events, Build, Network, and Run.

  D. Run policies monitor network activities in the environment and check for potential issues during runtime.

  Correct Answer: A

• Question 186:

  Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

  A. copy the Console address and set the config map for the default namespace.

  B. create a new namespace in Kubernetes called admission-controller.

  C. enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.

  D. copy the admission controller configuration from the Console and apply it to Kubernetes.

  Correct Answer: D

  Reference: https://thenewstack.io/kubernetes-security-best-practices-to-keep-you-out-of-the-news/

• Question 187:

  A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

  A. The value of the mined currency exceeds $100.

  B. High CPU usage over time for the container is detected.

  C. Common cryptominer process name was found.

  D. The mined currency is associated with a user token.

  E. Common cryptominer port usage was found.

  Correct Answer: BCE

• Question 188:

  Which three steps are involved in onboarding an account for Data Security? (Choose three.)

  A. Create a read-only role with in-line policies

  B. Create a Cloudtrail with SNS Topic

  C. Enable Flow Logs

  D. Enter the RoleARN and SNSARN

  E. Create a S3 bucket

  Correct Answer: BDE

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security/enable-data-security-module/add-a-new-aws-account.html

• Question 189:

  An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has Configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console

  configuration. In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

  Which port will twistcli need to use to access the Prisma Compute APIs?

  A. 8084

  B. 443

  C. 8083

  D. 8081

  Correct Answer: C

  https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console

• Question 190:

  A customer finds that an open alert from the previous day has been resolved. No auto-remediation was Configured. Which two reasons explain this change in alert status? (Choose two.)

  A. user manually changed the alert status.

  B. policy was changed.

  C. resource was deleted.

  D. alert was sent to an external integration.

  Correct Answer: BC

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OQ2CAM