Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 201:

  Given the following JSON query:

  $.resource[*].aws_s3_bucket exists

  Which tab is the correct place to add the JSON query when creating a config policy?

  A. Details
  B. Compliance Standards
  C. Remediation
  D. Build Your Rule (Run tab)
  E. Build Your Rule (Build tab)
  E. Build Your Rule (Build tab)

  ---

  Explanation

  When creating a Config policy in Prisma Cloud and incorporating a JSON query, the correct place to add this query is under the "Build Your Rule (Build tab)" (Option E). This section allows users to define the criteria and conditions for the policy, including specifying JSON or RQL (Resource Query Language) queries that articulate the policy's logic. The "Details" (Option A) tab is typically used for general information about the policy, such as its name and description. The "Compliance Standards" (Option B) tab is for associating the policy with specific compliance frameworks. The "Remediation" (Option C) tab provides guidance on how to remediate any issues detected by the policy. The "Build Your Rule (Run tab)" (Option D) is not a standard option in Prisma Cloud policy configuration.

• Question 202:

  Taking which action will automatically enable all seventy levels?

  A. Navigate to Policies > Settings and enable all severity levels in the alarm center.
  B. Navigate to Settings > Enterprise Settings and enable all severity levels in the alarm center.
  C. Navigate to Policies > Settings and ensure all severity levels are checked under "auto-enable default policies."
  D. Navigate to Settings > Enterprise Settings and ensure all severity levels are checked under "auto-enable default policies."
  D. Navigate to Settings > Enterprise Settings and ensure all severity levels are checked under "auto-enable default policies."

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/manage-prisma-cloud-policies

• Question 203:

  Which step should a SecOps engineer implement in order to create a network exposure policy that identifies instances accessible from any untrusted internet sources?

  A. In Policy Section-> Add Policy-> Config type -> Define Policy details Like Name,Severity-> Configure RQL query "config from network where source.network = UNTRUSTJNTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS*" -> define compliance standard -> Define recommendation for remediation and save.
  B. In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query "network from vpc.flow_record where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('Instance ))" -> define compliance standard -> Define recommendation for remediation and save.
  C. In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query "network from vpc.flow_record where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ( Instance ))" -> define compliance standard -> Define recommendation for remediation and save.
  D. In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query "config from network where source.network = UNTRUSTJNTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS'" -> Define recommendation for remediation and save.
  D. In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query "config from network where source.network = UNTRUSTJNTERNET and dest.resource.type = 'Instance' and dest.cloud.type = 'AWS'" -> Define recommendation for remediation and save.

  ---

  Explanation

• Question 204:

  A customer has a requirement to restrict any container from resolving the name www.evil-url.com.

  How should the administrator Configure Prisma Cloud Compute to satisfy this requirement?

  A. Choose "copy into rule" for any Container, set www.evil-url.com as a blocklisted DNS name in the Container policy and set the policy effect to alert.
  B. Set www.evil-url.com as a blocklisted DNS name in the default Container runtime policy, and set the effect to block.
  C. Choose "copy into rule" for any Container, set www.evil-url.com as a blocklisted DNS name, and set the effect to prevent.
  D. Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.
  D. Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.

  ---

  Explanation

  To restrict any container from resolving the name www.evil-url.com, the administrator should set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent. This configuration in Prisma Cloud, or similar CSPM tools, ensures that any attempt to resolve the specified blocklisted DNS name within any container will be prevented, thus enhancing security by proactively blocking potential communication with known malicious domains. Reference to this feature can be found in the documentation of CSPM tools that offer runtime protection for containers. These tools allow administrators to define security policies that can include DNS-based controls to prevent containers from accessing known malicious or undesirable URLs, thereby preventing potential data exfiltration, malware communication, or other security threats

• Question 205:

  DRAG DROP

  An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.

  In which order will the APIs be executed for this service?

  (Drag the steps into the correct order of occurrence, from the first step to the last.)

  Select and Place:

  

  

• Question 206:

  On which cloud service providers can new API release information for Prisma Cloud be received?

  A. AWS. Azure. GCP. Oracle, IBM
  B. AWS. Azure. GCP, IBM, Alibaba
  C. AWS. Azure. GCP. Oracle, Alibaba
  D. AWS. Azure. GCP, IBM
  D. AWS. Azure. GCP, IBM

  ---

  Explanation

  Prisma Cloud provides new API release information primarily for the three major cloud service providers: AWS, Azure, and GCP. Additionally, IBM Cloud is included in this support.

• Question 207:

  Which role does Prisma Cloud play when configuring SSO?

  A. JIT
  B. Service provider
  C. SAML
  D. Identity provider issuer
  B. Service provider

  ---

  Explanation

  When configuring Single Sign-On (SSO) in Prisma Cloud, the platform acts as the Service Provider (SP). In the SSO process, the Service Provider relies on an Identity Provider (IdP) to authenticate users. Prisma Cloud, as the SP, integrates with an IdP to allow users to log in using their existing credentials managed by the IdP. This setup simplifies the authentication process, enhances security by centralizing user credentials, and provides a seamless user experience.

• Question 208:

  DRAG DROP

  Put the steps of integrating Okta with Prisma Cloud in the right order in relation to CIEM or SSO okra integration.

  Select and Place:

  

  

• Question 209:

  During the Learning phase of the Container Runtime Model, Prisma Cloud enters a "dry run" period for how many hours?

  A. 4
  B. 48
  C. 1
  D. 24
  D. 24

  ---

  Explanation

• Question 210:

  Which three actions are required in order to use the automated method within Azure Cloud to streamline the process of using remediation in the identity and access management (IAM) module? (Choose three.)

  A. Install boto3 and requests library.
  B. Configure IAM Azure remediation script.
  C. Integrate with Azure Service Bus.
  D. Configure IAM AWS remediation script.
  E. Install azure.servicebus and requests library.
  B. Configure IAM Azure remediation script.
  C. Integrate with Azure Service Bus.
  E. Install azure.servicebus and requests library.

  ---

  Explanation

  To use the automated method within Azure Cloud for streamlining the process of using remediation in the identity and access management (IAM) module, the required actions include configuring the IAM Azure remediation script, integrating with Azure Service Bus, and installing the azure.servicebus and requests library. These steps ensure that the automated remediation system can communicate effectively with Azure services, execute the necessary remediation actions, and address IAM-related alerts by adjusting permissions and access controls as needed. This automation helps maintain a secure and compliant cloud environment by promptly addressing potential IAM issues. https://docs.paloaltonetworks.com/ prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-iam-security/remediate-alerts-for-iam-security