Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 271:

  If you are required to run in an air-gapped environment, which product should you install?

  A. Prisma Cloud Jenkins Plugin
  B. Prisma Cloud Compute Edition
  C. Prisma Cloud with self-hosted plugin
  D. Prisma Cloud Enterprise Edition
  B. Prisma Cloud Compute Edition

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud.html

  Prisma Cloud Compute Edition is the suitable product for air-gapped environments, where there is no direct internet access. This edition can be installed and operated in isolated environments, providing cloud security capabilities without the need for external connectivity.

• Question 272:

  What is required for Prisma Cloud to successfully execute auto-remediation commands?

  A. Access to the cloud platform only for Azure
  B. Write access to the cloud platform
  C. Read access to the cloud platform
  D. Prisma Cloud requires no access to the cloud platform
  B. Write access to the cloud platform

  ---

  Explanation

  For Prisma Cloud to execute auto-remediation commands, it requires write access to the cloud platform. This is because auto-remediation involves making changes to configurations or settings within the cloud environment to rectify security issues. Thus, the correct answer is B: Write access to the cloud platform.

• Question 273:

  A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

  A. The value of the mined currency exceeds $100.
  B. High CPU usage over time for the container is detected.
  C. Common cryptominer process name was found.
  D. The mined currency is associated with a user token.
  E. Common cryptominer port usage was found.
  B. High CPU usage over time for the container is detected.
  C. Common cryptominer process name was found.
  E. Common cryptominer port usage was found.

  ---

  Explanation

• Question 274:

  DRAG DROP

  An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

  In which order should the API calls be used to accomplish this task?

  (Drag the steps into the correct order from the first step to the last.)

  Select and Place:

  

  

• Question 275:

  Which three public cloud providers are supported for VM image scanning? (Choose three.)

  A. GCP
  B. Alibaba
  C. Oracle
  D. AWS
  E. Azure
  A. GCP
  D. AWS
  E. Azure

  ---

  Explanation

  VM image scanning is a critical component of cloud security, allowing organizations to identify vulnerabilities within virtual machine images before deployment. The three major public cloud providers supported for VM image scanning are Google Cloud Platform (GCP), Amazon Web Services (AWS), and Microsoft Azure. These platforms offer extensive infrastructure services and are commonly used in various industries, making them primary targets for VM image scanning integration. GCP, AWS, and Azure each provide capabilities to store, manage, and deploy VM images through their respective services such as Google Compute Engine, AWS EC2, and Azure Virtual Machines. By integrating VM image scanning with these services, organizations can ensure that their VM images are free from known vulnerabilities and comply with security best practices before being deployed in the cloud environment. This approach to VM image scanning is consistent with Prisma Cloud's comprehensive security strategy, which emphasizes the importance of securing cloud workloads across the entire development lifecycle. By supporting VM image scanning across GCP, AWS, and Azure, Prisma Cloud enables organizations to maintain a consistent security posture across multiple cloud environments, mitigating the risk of deploying vulnerable or misconfigured VM images that could lead to security breaches.

  References: Documentation from GCP, AWS, and Azure on VM management and security best practices provide foundational knowledge for understanding how VM image scanning integrates with each cloud provider's infrastructure services. Prisma Cloud's documentation and best practices guides offer insights into how VM image scanning is implemented within its security platform to protect cloud workloads across GCP, AWS, and Azure.

• Question 276:

  How often do Defenders share logs with Console?

  A. Every 10 minutes
  B. Every 30 minutes
  C. Every 1 hour
  D. Real time
  B. Every 30 minutes

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/audit/log_rotation

• Question 277:

  Based on the following information, which RQL query will satisfy the requirement to identify VM hosts deployed to organization public cloud environments exposed to network traffic from the internet and affected by Text4Shell RCE (CVE2022-42889) vulnerability?

  1.Network flow logs from all virtual private cloud (VPC) subnets are ingested to the Prisma Cloud Enterprise Edition tenant.

  2.All virtual machines (VMs) have Prisma Cloud Defender deployed.

  A. network from vpc.flow_record where bytes > 0 AND dest.resource IN (resource where finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')) AND source.publicnetwork IN ('Internet IPs', 'Suspicious IPs')
  B. config from vpc.flow_record where bytes > 0 AND dest.resource IN (resource where finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')) AND source.publicnetwork = ('Internet IPs' or 'Suspicious IPs')
  C. network from vpc.flow_record where bytes > 0 AND finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889') AND source.publicnetwork = 'Internet IPs'
  D. config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-instances' AND json.rule = publicIpAddress exists AND finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')
  A. network from vpc.flow_record where bytes > 0 AND dest.resource IN (resource where finding.type IN ('Host Vulnerability') AND finding.source IN ('Prisma Cloud') AND finding.name IN ('CVE-2022-42889')) AND source.publicnetwork IN ('Internet IPs', 'Suspicious IPs')

  ---

  Explanation

  The RQL query in Option A is designed to identify VM hosts that are exposed to internet traffic and are affected by the Text4Shell RCE vulnerability (CVE-2022-42889). This query looks for network flow records with byte transfers indicating activity and filters for resources with host vulnerability findings sourced from 'Prisma Cloud'. It also checks for exposure to suspicious or internet IPs, satisfying the criteria for the given scenario.

• Question 278:

  A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80.

  Which port should the team specify in the CNAF rule to protect the application?

  A. 443
  B. 80
  C. 8080
  D. 8888
  C. 8080

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/ rewalls/deploy_cnaf.html

• Question 279:

  Which of the following are correct statements regarding the use of access keys? (Choose two.)

  A. Access keys must have an expiration date
  B. Up to two access keys can be active at any time
  C. System Admin can create access key for all users
  D. Access keys are used for API calls
  B. Up to two access keys can be active at any time
  D. Access keys are used for API calls

  ---

  Explanation

  Regarding the use of access keys, it is correct that up to two access keys can be active at any time for a single IAM user in AWS, and access keys are used for programmatic API calls to AWS services. This allows for rotation of keys without immediate invalidation of the old key and ensures secure access to AWS services via APIs.

• Question 280:

  What are the two ways to scope a CI policy for image scanning? (Choose two.)

  A. container name
  B. image name
  C. hostname
  D. image labels
  B. image name
  D. image labels

  ---

  Explanation

  https://www.optiv.com/insights/source-zero/blog/defending-against-container- threats-palo-alto-prisma-cloud

  In Prisma Cloud, CI policies for image scanning can be scoped based on the image name and image labels. These scoping options allow for targeted scanning of images, ensuring that policies are applied to relevant images based on their identifiers or metadata.