Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 231:

  Which resources can be added in scope while creating a vulnerability policy for continuous integration?

  A. Images and cluster

  B. Images and labels

  C. Images and containers

  D. Labels and AccountID

  Correct Answer: B

• Question 232:

  A container and image compliance rule has been configured by enabling all checks; however, upon review, the container's compliance view reveals only the entries in the image below.

  

  What is the appropriate action to take next?

  A. Deploy defenders to scan complete container compliance.

  B. Change the rule options to list both failed and passed checks in the compliance rule edit window.

  C. Wait until Prisma Cloud finishes the compliance scan and recheck.

  D. Change the rule options to list only failed checks in the compliance rule edit window.

  Correct Answer: B

• Question 233:

  What is the primary purpose of Prisma Cloud Code Security?

  A. To address cloud infrastructure misconfigurations in code before they become alerts or incidents

  B. To provide a platform for developers to create custom security policies for applications

  C. To offer instant feedback on application performance issues and bottlenecks

  D. To triage alerts and incidents in realtime during deployment

  Correct Answer: A

• Question 234:

  How does assigning an account group to an administrative user on Prisma Cloud help restrict access to resources?

  A. It restricts access to all resources and data within the cloud account.

  B. It restricts access only to certain types of resources within the cloud account.

  C. It restricts access only to the resources and data that pertains to the cloud account(s) within an account group.

  D. It does not restrict access to any resources within the cloud account.

  Correct Answer: C

• Question 235:

  Which three AWS policy types and identities are used to calculate the net effective permissions? (Choose three.)

  A. AWS IAM group

  B. AWS IAM role

  C. AWS service control policies (SCPs)

  D. AWS IAM tag policy

  E. AWS IAM User

  Correct Answer: ABC

  https://docs.prismacloud.io/en/classic/cspm-admin-guide/prisma-cloud-iam-security/context-used-to-calculate-effective-permissions

• Question 236:

  Based on the following information, which RQL query will satisfy the requirement to identify VM hosts deployed to organization public cloud environments exposed to network traffic from the internet and affected by Text4Shell RCE (CVE2022-42889) vulnerability?

  Network flow logs from all virtual private cloud (VPC) subnets are ingested to the Prisma Cloud Enterprise Edition tenant. All virtual machines (VMs) have Prisma Cloud Defender deployed.

  A. network from vpc.flow_record where bytes > 0 AND dest.resource IN (resource where finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')) AND source.publicnetwork IN ('Internet IPs', 'Suspicious IPs')

  B. config from vpc.flow_record where bytes > 0 AND dest.resource IN (resource where finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')) AND source.publicnetwork = ('Internet IPs' or 'Suspicious IPs')

  C. network from vpc.flow_record where bytes > 0 AND finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889') AND source.publicnetwork = 'Internet IPs'

  D. config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = publicIpAddress exists AND finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')

  Correct Answer: A

• Question 237:

  Which of the following is not a supported external integration for receiving Prisma Cloud Code Security notifications?

  A. ServiceNow

  B. Splunk

  C. Microsoft Teams

  D. Cortex XSOAR

  Correct Answer: C

• Question 238:

  Which type of RQL query should be run to determine if AWS Elastic Compute Cloud (EC2) instances without encryption was enabled?

  A. NETWORK

  B. CONFIG

  C. EVENT

  D. SECURITY

  Correct Answer: B

• Question 239:

  Which RQL query is used to detect certain high-risk activities executed by a root user in AWS?

  A. event from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'

  B. event from cloud.security_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'

  C. config from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey', 'DeleteAlarms' ) AND user = 'root'

  D. event from cloud.audit_logs where Risk.Level = 'high' AND user = 'root'

  Correct Answer: A

  https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples#idda895fd2-4496-4b31-9766-7d50215dcc18

• Question 240:

  What is required for Prisma Cloud to successfully execute auto-remediation commands?

  A. Access to the cloud platform only for Azure

  B. Write access to the cloud platform

  C. Read access to the cloud platform

  D. Prisma Cloud requires no access to the cloud platform

  Correct Answer: B