Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 221:

  In Prisma Cloud, which page allows viewing alerts triggered by compliance policy violations?

  A. Monitor > Alerts
  B. Defend > Compliance
  C. Manage > Security Posture
  D. Settings > Compliance
  A. Monitor > Alerts

  ---

  Explanation

  Compliance alerts are typically viewed on the Monitor > Alerts page, where administrators can monitor and manage all security alerts.

• Question 222:

  A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying. How should the customer automate vulnerability scanning for images deployed to Fargate?

  A. Set up a vulnerability scanner on the registry
  B. Embed a Fargate Defender to automatically scan for vulnerabilities
  C. Designate a Fargate Defender to serve a dedicated image scanner
  D. Use Cloud Compliance to identify misConfigured AWS accounts
  B. Embed a Fargate Defender to automatically scan for vulnerabilities

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/install/install_defender/install_app_embedded_defender_fargate

• Question 223:

  What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

  A. policy
  B. incident
  C. audit
  D. anomaly
  B. incident

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_explorer.html

  An automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks is known as an "incident". Incidents provide a consolidated view of related security events, making it easier for administrators to understand the scope and potential impact of an attack, and to take appropriate response actions.

• Question 224:

  Which of the following is a reason for alert dismissal?

  A. SNOOZED_AUTO_CLOSE
  B. ALERT_RULE_ADDED
  C. POLICY_UPDATED
  D. USER_DELETED
  C. POLICY_UPDATED

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/prisma-cloud-alert-resolution-reasons

• Question 225:

  Which two proper agentless scanning modes are supported with Prisma Cloud? (Choose two).

  A. Spoke Account Mode
  B. Hub Account Mode
  C. Same Account Mode
  D. Main Account Mode
  B. Hub Account Mode
  C. Same Account Mode

  ---

  Explanation

  Prisma Cloud supports agentless scanning in two primary modes:

  1.Same Account Mode ?Scans resources within the same cloud account where Prisma Cloud is deployed.

  2.Hub Account Mode ?Uses a centralized account to scan multiple cloud accounts (spoke accounts).

• Question 226:

  Which `kind` of Kubernetes object is Configured to ensure that Defender is acting as the admission controller?

  A. MutatingWebhookconfiguration
  B. DestinationRules
  C. ValidatingWebhookconfiguration
  D. PodSecurityPolicies
  C. ValidatingWebhookconfiguration

  ---

  Explanation

  In the context of Kubernetes, an admission controller is a piece of code that intercepts requests to the Kubernetes API server before the persistence of the object, but after the request is authenticated and authorized. The admission controller

  lets you apply complex validation and policy controls to objects before they are created or updated. The ValidatingWebhookConfiguration is a Kubernetes object that tells the API server to send an admission validation request to a service (the

  admission webhook) when a request to create, update, or delete a Kubernetes object matches the rules defined in the configuration. The webhook can then approve or deny the request based on custom logic. The

  MutatingWebhookConfiguration is similar but is used to modify objects before they are created or updated, which is not the primary function of an admission controller acting in a protective or validating capacity.

  DestinationRules are related to Istio service mesh and are not relevant to Kubernetes admission control.

  PodSecurityPolicies (PSPs) are a type of admission controller in Kubernetes but they are predefined by Kubernetes and do not require a specific configuration object like ValidatingWebhookConfiguration. PSPs are also deprecated in recent

  versions of Kubernetes.

  Therefore, the correct answer is

  C. ValidatingWebhookConfiguration, as it is the Kubernetes object used to configure admission webhooks for validating requests, which aligns with the role of Defender acting as an admission controller in

  Prisma Cloud.

  References from the provided documents:

  The documents uploaded do not contain specific details about Kubernetes objects or Prisma Cloud's integration with Kubernetes. However, this explanation aligns with general Kubernetes practices and Prisma Cloud's capabilities in securing

  Kubernetes environments.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud- compute-edition- admin/access_control/open_policy_agent.html

• Question 227:

  An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has Configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console

  configuration. In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

  Which port will twistcli need to use to access the Prisma Compute APIs?

  A. 8084
  B. 443
  C. 8083
  D. 8081
  C. 8083

  ---

  Explanation

  https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console

• Question 228:

  An administrator has a requirement to ingest all Console and Defender logs to Splunk. Which option will satisfy this requirement in Prisma Cloud Compute?

  A. Enable the API settings for logging.
  B. Enable the CSV export in the Console.
  C. Enable the syslog option in the Console
  D. Enable the Splunk option in the Console.
  C. Enable the syslog option in the Console

  ---

  Explanation

• Question 229:

  What are two ways to scan container images in Jenkins pipelines? (Choose two.)

  A. twistcli
  B. Jenkins Docker plugin
  C. Compute Jenkins plugin
  D. Compute Azure DevOps plugin
  E. Prisma Cloud Visual Studio Code plugin with Jenkins integration
  A. twistcli
  C. Compute Jenkins plugin

  ---

  Explanation

  To scan container images in Jenkins pipelines, two effective methods are using twistcli and the Compute Jenkins plugin. twistcli is a command-line tool provided by Prisma Cloud that allows for the scanning of container images for vulnerabilities and compliance issues directly from the CI/CD pipeline. It can be integrated into Jenkins jobs as a build or post-build step to automatically scan images as part of the build process. The Compute Jenkins plugin is specifically designed for integration with Jenkins, providing a more seamless and automated way to include Prisma Cloud's security scanning capabilities within Jenkins pipelines. This plugin enables Jenkins to trigger image scans with Prisma Cloud directly and can fail builds based on scan results, ensuring that only secure and compliant images are pushed through the CI/CD pipeline. Both twistcli and the Compute Jenkins plugin are designed to integrate Prisma Cloud's security capabilities into the CI/CD process, enabling DevOps teams to identify and fix security issues early in the development lifecycle. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/jenkins_plugin.html

• Question 230:

  What are two alarm types that are registered after alarms are enabled? (Choose two.)

  A. Onboarded Cloud Accounts status
  B. Resource status
  C. Compute resources
  D. External integrations status
  A. Onboarded Cloud Accounts status
  D. External integrations status

  ---

  Explanation

  Upon enabling alarms in Prisma Cloud, two critical alarm types that are registered are Onboarded Cloud Accounts status (A) and External integrations status (D). These alarms are pivotal for maintaining the health and security of the cloud environment. The Onboarded Cloud Accounts status alarms alert administrators about the connectivity and health of cloud accounts integrated with Prisma Cloud, ensuring continuous monitoring and security coverage. The External integrations status alarms provide notifications regarding the operational status of third-party services and tools integrated with Prisma Cloud, such as SIEMs, ticketing systems, or other security tools, ensuring that these integrations function correctly to support comprehensive security and incident response workflows. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alarms/prisma-cloud-alarms