Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 251:

  A customer does not want alerts to be generated from network traffic that originates from trusted internal networks. Which setting should you use to meet this customer's request?

  A. Trusted Login IP Addresses
  B. Anomaly Trusted List
  C. Trusted Alert IP Addresses
  D. Enterprise Alert Disposition
  C. Trusted Alert IP Addresses

  ---

  Explanation

  B --> Anomaly Trusted List--Exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default. C --> Trusted Alert IP Addresses--If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted ... Prisma Cloud default network policies that look for internet exposed instances also do not generate alerts when the source IP address is included in the trusted IP address list and the account hijacking anomaly policy filters out activities from known IP addresses. Also, when you use RQL to query network traffic, you can filter out traffic from known networks that are included in the trusted IP address list. For a customer who does not want alerts to be generated from network traffic originating from trusted internal networks, the appropriate setting is

  C. Trusted Alert IP Addresses. This setting allows for specifying certain IP addresses as trusted, meaning alerts will not be triggered by activities from these IPs, ensuring that internal network traffic is not flagged as potentially malicious.

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/trusted-ip-addresses-on-prisma- cloud.html

• Question 252:

  Which three types of runtime rules can be created? (Choose three.)

  A. Processes
  B. Network-outgoing
  C. Filesystem
  D. Kubernetes-audit
  E. Waas-request
  A. Processes
  B. Network-outgoing
  C. Filesystem

  ---

  Explanation

  In Prisma Cloud, runtime rules are created to monitor and control the behavior of applications and services during their execution to ensure compliance with security policies. The three types of runtime rules that can be created in Prisma Cloud are: Processes: These rules monitor and control the execution of processes within the environment. They can be used to detect unauthorized or malicious processes and take actions such as alerting, blocking, or terminating the processes. Network-outgoing: These rules govern the outbound network connections from the applications or containers. They help in controlling access to external resources, preventing data exfiltration, and ensuring that the communication complies with the security policies. Filesystem: Filesystem rules are related to the access and modification of the file system by applications or containers. These rules can help in detecting unauthorized access, changes to sensitive files, and ensuring that the applications adhere to the least privilege principle in terms of file access. These runtime rules are essential for maintaining the security and integrity of applications running in cloud environments, especially in dynamic and distributed architectures where traditional perimeter-based security controls may not be sufficient. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/custom_runtime_rules

• Question 253:

  When an alert Notification from the alarm center is deleted, how many hours will a similar alarm be suppressed by default?

  A. 12
  B. 8
  C. 24
  D. 4
  C. 24

  ---

  Explanation

• Question 254:

  Which command should be used in the Prisma Cloud twistcli tool to scan the nginx:latest image for vulnerabilities and compliance issues?

  A. $ twistcli images scan --console-address --user --password --output-file scan-results.json nginx:latest
  B. $ twistcli images scan --address --user --password --details nginx:latest
  C. $ twistcli images build --console-address --user --password --details nginx:latest
  D. $ twistcli images scan --address --username --password --details nginx:latest
  B. $ twistcli images scan --address --user --password --details nginx:latest

  ---

  Explanation

• Question 255:

  An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy `AWS S3 buckets are accessible to public`. The policy definition follows:

  config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[? (@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockconfiguration does not exist) or ((acl.grants[? (@.grantee=='AllUsers')] size > 0) and publicAccessBlockconfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockconfiguration.restrictPublicBuckets is false)) and websiteconfiguration does not exist" Why did this alert get generated?

  A. an event within the cloud account
  B. network traffic to the S3 bucket
  C. configuration of the S3 bucket
  D. anomalous behaviors
  C. configuration of the S3 bucket

  ---

  Explanation

  The alert "AWS S3 buckets are accessible to public" is generated due to the configuration of the S3 bucket, which has been set in a way that allows public access. The policy definition provided checks for various conditions that would make an S3 bucket publicly accessible, such as grants to 'AllUsers', the absence of a 'publicAccessBlockConfiguration', or specific configurations that do not restrict public access. Therefore, the alert is triggered by the configuration settings of the S3 bucket that violate the policy's criteria for public accessibility.

• Question 256:

  Given the following information, which twistcli command should be run if an administrator were to exec into a running container and scan it from within using an access token for authentication?

  1. Console is located at https://prisma-console.mydomain.local

  2. Token is: TOKEN_VALUE

  3. Report ID is: REPORT_ID

  4. Container image running is: myimage:latest

  A. twistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details myimage:latest
  B. twistcli images scan --console-address https://prisma-console.mydomain.local --auth-token TOKEN_VALUE --containerized --vulnerability-details REPORT_ID
  C. twistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details REPORT_ID
  D. twistcli images scan --console-address https://prisma-console.mydomain.local --auth-token MY_TOKEN --local-scan --details myimage:latest
  C. twistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details REPORT_ID

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

• Question 257:

  What is the primary purpose of Prisma Cloud Code Security?

  A. To address cloud infrastructure misconfigurations in code before they become alerts or incidents
  B. To provide a platform for developers to create custom security policies for applications
  C. To offer instant feedback on application performance issues and bottlenecks
  D. To triage alerts and incidents in realtime during deployment
  A. To address cloud infrastructure misconfigurations in code before they become alerts or incidents

  ---

  Explanation

  Prisma Cloud Code Security is designed to integrate security into the DevOps process by scanning infrastructure as code (IaC) templates and configurations for potential security issues. This proactive approach allows developers and security teams to address misconfigurations and vulnerabilities in the code itself, before they are deployed into the cloud environment and become more challenging to resolve. By identifying and rectifying these issues early in the development lifecycle, organizations can reduce the risk of alerts and incidents arising from misconfigurations in their cloud infrastructure, leading to a more secure and compliant cloud environment.

• Question 258:

  Which ban for DoS protection will enforce a rate limit for users who are unable to post five (5) ". tar.gz" files within five (5) seconds?

  A. One with an average rate of 5 and file extensions match on ". tar.gz" on Web Application and API Security (WAAS)
  B. One with an average rate of 5 and file extensions match on ". tar.gz" on Cloud Native Network Firewall (CNNF)
  C. One with a burst rate of 5 and file extensions match on ". tar.gz" on Web Application and API Security (WAAS) *
  D. One with a burst rate of 5 and file extensions match on ". tar.gz" on Cloud Native Network Firewall (CNNF)
  C. One with a burst rate of 5 and file extensions match on ". tar.gz" on Web Application and API Security (WAAS) *

  ---

  Explanation

• Question 259:

  Which options show the steps required to upgrade Console when using projects?

  A. Upgrade all Supervisor Consoles Upgrade Central Console
  B. Upgrade Central Console Upgrade Central Console Defenders
  C. Upgrade Defender Upgrade Central Console Upgrade Supervisor Consoles
  D. Upgrade Central Console Upgrade all Supervisor Consoles
  A. Upgrade all Supervisor Consoles Upgrade Central Console

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

• Question 260:

  A customer has a requirement to scan serverless functions for vulnerabilities. What is the correct option to Configure scanning?

  A. Configure serverless radar from the Defend > Compliance > Cloud Platforms page.
  B. Embed serverless Defender into the function.
  C. Configure a function scan policy from the Defend > Vulnerabilities > Functions page.
  D. Use Lambda layers to deploy a Defender into the function.
  C. Configure a function scan policy from the Defend > Vulnerabilities > Functions page.

  ---

  Explanation

  In Prisma Cloud, the capability to scan serverless functions, such as AWS Lambda functions, for vulnerabilities is an integral part of ensuring cloud security posture management (CSPM) and compliance. Specifically, option C is correct because Prisma Cloud provides a dedicated section for defining policies related to serverless function vulnerabilities under the "Defend > Vulnerabilities > Functions" page. This feature allows administrators to create and manage policies that automatically scan serverless functions for known vulnerabilities, ensuring that the functions comply with the organization's security standards before they are deployed. This approach aligns with Prisma Cloud's comprehensive security model that covers various aspects of cloud security, including serverless functions, as outlined in the "Guide to Cloud Security Posture Management Tools" document