Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 201:

  Which RQL will trigger the following audit event activity?

  

  A. event from cloud.audit_logs where operation = ConsoleLogin AND user = ‘root

  Correct Answer: A

  Event Query- Used to detect and investigate console and API access events, monitor privileged activities, detect account compromise, and detect unusual user behavior in your cloud environments. See Event Query Attributes and Examples (https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/event-query#id7f21ba55-c711-4996-be59-3e6ce80ea9e4) The RQL "event from cloud.audit_logs where operation = ConsoleLogin AND user = ‘root’

• Question 202:

  Which report includes an executive summary and a list of policy violations, including a page with details for each policy?

  A. Compliance Standard

  B. Business Unit

  C. Cloud Security Assessment

  D. Detailed

  Correct Answer: C

  The Cloud Security Assessment report is a PDF report that summarizes the risks from open alerts in the monitored cloud accounts for a specific cloud type. The report includes an executive summary and a list of policy violations, including a page with details for each policy that includes the description and the compliance standards that are associated with it, the number of resources that passed and failed the check within the specified time period.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/generate-reports-on-prisma-cloud-alerts

• Question 203:

  Prisma Cloud Compute has been installed on Onebox. After Prisma Cloud Console has been accessed. Defender is disconnected and keeps returning the error "No console connectivity" in the logs. What could be causing the disconnection between Console and Defender in this scenario?

  A. Port 8083 is not open for Console and Defender communication.

  B. The license key provided to the Console is invalid.

  C. Onebox script installed an older version of the Defender.

  D. Port 8084 is not open for Console and Defender communication.

  Correct Answer: D

  By default, Defender is configured to communicate with Console on port 8084. If port 8084 is closed, then Defender cannot communicate with Console. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNWXCA4#:~:text=If%20port%208084%20is%20closed%2C%20then%20Defender%20cannot%20communicate%20with%20Console.andtext=Resolve%20the% 20issue%20by%20setting,%3E%20Load%20Balancer%20%3E%20Defender).

• Question 204:

  Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

  A. Visibility, Compliance, Governance, and Threat Detection and Response

  B. Network, Anomaly, and Audit Event

  C. Visibility, Workload Scanning, and Compliance

  D. Foundations, Advanced, and Optimize

  Correct Answer: A

  https://www.paloaltonetworks.com/blog/prisma-cloud/operationalize-prisma-cloud-adoption-advisor/

• Question 205:

  A customer wants to monitor its Amazon Web Services (AWS) accounts via Prisma Cloud, but only needs the resource configuration to be monitored at present. Which two pieces of information are needed to onboard this account? (Choose two.)

  A. CloudTrail

  B. Role ARN

  C. Active Directory ID

  D. External ID

  Correct Answer: BD

  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OD3CAMandlang=en_US%E2%80%A9

• Question 206:

  Which policy type should be used to detect and alert on cryptominer network activity?

  A. Anomaly

  B. Config-run

  C. Config-build

  D. Audit event

  Correct Answer: A

  Suspicious network actors—Exposes suspicious connections by inspecting the network traffic to and from your cloud environment and correlating it with AutoFocus, Palo Alto Networks threat intelligence feed. AutoFocus identifies IP addresses involved in suspicious or malicious activity and classifies them into one of eighteen categories. Some examples of the categories are Backdoor, Botnet, Cryptominer, DDoS, Ransomware, Rootkit, and Worm. There are thirty-six policies, two for each of the eighteen categories—internal and external.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies

• Question 207:

  Given the following information, which twistcli command should be run if an administrator were to exec into a running container and scan it from within using an access token for authentication?

  Console is located at https://prisma-console.mydomain.local Token is: TOKEN_VALUE Report ID is: REPORT_ID Container image running is: myimage:latest

  A. twistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details myimage:latest

  B. twistcli images scan --console-address https://prisma-console.mydomain.local --auth-token TOKEN_VALUE --containerized --vulnerability-details REPORT_ID

  C. twistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details REPORT_ID

  D. twistcli images scan --console-address https://prisma-console.mydomain.local --auth-token MY_TOKEN --local-scan --details myimage:latest

  Correct Answer: C

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

• Question 208:

  Prisma Cloud supports which three external systems that allow the import of vulnerabilities and provide additional context on risks in the cloud? (Choose three.)

  A. Splunk

  B. Qualys

  C. Amazon Inspector

  D. Amazon GuardDuty

  E. ServiceNow

  Correct Answer: BCD

  Similarly, Prisma Cloud integration with external systems such as Amazon GuardDuty, AWS Inspector, Qualys, and Tenable allow you to import vulnerabilities and provide additional context on risks in the cloud.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud

• Question 209:

  Which two statements explain differences between build and run config policies? (Choose two.)

  A. Run and Network policies belong to the configuration policy set.

  B. Build policies allow checking for security misconfigurations in the IaC templates and ensure these issues do not get into production.

  C. Run policies monitor network activities in the environment and check for potential issues during runtime.

  D. Run policies monitor resources and check for potential issues after these cloud resources are deployed.

  Correct Answer: BD

  The Run policies monitor resources and check for potential issues once these cloud resources are deployed

  Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not make their way into production.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy

• Question 210:

  Which two integrated development environment (IDE) plugins are supported by Prisma Cloud as part of its Code Security? (Choose two.)

  A. BitBucket

  B. Visual Studio Code

  C. CircleCI

  D. IntelliJ

  Correct Answer: BD

  https://live.paloaltonetworks.com/t5/blogs/what-is-changing-for-ci-cd-plugins/ba-p/461676