Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 21:

  Which serverless cloud provider is covered by the "overly permissive service access" compliance check?

  A. Alibaba
  B. Azure
  C. Amazon Web Services (AWS)
  D. Google Cloud Platform (GCP)
  C. Amazon Web Services (AWS)

  ---

  Explanation

  The "overly permissive service access" compliance check is specifically designed to evaluate and ensure that cloud services are not granted more permissions than necessary, which could lead to potential security risks. Among the listed options, Amazon Web Services (AWS) is known for its extensive service offerings and the complexity of its Identity and Access Management (IAM) configurations. Prisma Cloud, a comprehensive cloud security platform by Palo Alto Networks, provides extensive support for AWS, including checks for overly permissive service access. This ensures that AWS environments adhere to the principle of least privilege, reducing the attack surface by limiting access to the minimum necessary to perform required tasks. Prisma Cloud's capabilities in AWS environments are detailed in various resources, including documentation and guides provided by Palo Alto Networks, which highlight its effectiveness in identifying and mitigating risks associated with excessive permissions in AWS services.

• Question 22:

  The compliance team needs to associate Prisma Cloud policies with compliance frameworks. Which option should the team select to perform this task?

  A. Custom Compliance
  B. Policies
  C. Compliance
  D. Alert Rules
  B. Policies

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/compliance-dashboard.html

• Question 23:

  Which three OWASP protections are part of Prisma Cloud Web-Application and API Security (WAAS) rule? (Choose three.)

  A. DoS Protection
  B. Local file inclusion
  C. SQL injection
  D. Suspicious binary
  E. Shellshock
  B. Local file inclusion
  C. SQL injection
  E. Shellshock

  ---

  Explanation

  In the Prisma Cloud Web-Application and API Security (WAAS) rules, protections against OWASP-recognized vulnerabilities like Local file inclusion, SQL injection, and Shellshock are included. Local file inclusion involves unauthorized access to files on the server, potentially leading to sensitive information disclosure. SQL injection targets data-driven applications by inserting malicious SQL statements into an entry field, while Shellshock exploits vulnerabilities in Bash, a widely used Unix shell, to execute arbitrary commands. These protections are part of Prisma Cloud's comprehensive approach to securing web applications and APIs against common and severe vulnerabilities. https://www.paloaltonetworks.com/prisma/cloud/web-application-API-security

• Question 24:

  Which three Orchestrator types are supported when deploying Defender? (Choose three.)

  A. Red Hat OpenShift
  B. Amazon ECS
  C. Docker Swarm
  D. Azure ACS
  E. Kubernetes
  A. Red Hat OpenShift
  B. Amazon ECS
  E. Kubernetes

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/deploy-defender/orchestrator

• Question 25:

  What will happen when a Prisma Cloud Administrator has Configured agentless scanning in an environment that also has Host and Container Defenders deployed?

  A. Agentless scan will automatically be disabled, so Defender scans are the only scans occurring.
  B. Agentless scans do not con ict with Defender scans, so both will run.
  C. Defender scans will automatically be disabled, so agentless scans are the only scans occurring.
  D. Both agentless and Defender scans will be disabled and an error message will be received.
  B. Agentless scans do not con ict with Defender scans, so both will run.

  ---

  Explanation

  In a Prisma Cloud environment where both agentless scanning and Defender-based scans (Host and Container Defenders) are configured, there is no inherent conflict between these two scanning methods. Both agentless scans and Defender scans are designed to complement each other, providing comprehensive coverage and depth in the security analysis of the environment. Agentless scans offer a broad, less intrusive overview, while Defender scans provide deep, detailed insights into the security posture. Therefore, both types of scans will run concurrently, enhancing the overall security visibility and protection of the environment without disabling or interfering with each other's operations.

• Question 26:

  An administrator for Prisma Cloud needs to obtain a graphical view to monitor all connections, including connections across hosts and connections to any Configured network objects.

  Which setting does the administrator enable or Configure to accomplish this task?

  A. ADEM
  B. WAAS Analytics
  C. Telemetry
  D. Cloud Native Network Firewall
  E. Host Insight
  D. Cloud Native Network Firewall

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud- compute-edition-admin/firewalls/cnnf_self_hosted.html To obtain a graphical view to monitor all connections, including those across hosts and to configured network objects within Prisma Cloud, the appropriate feature to enable or configure is the Cloud Native Network Firewall (Option D). Prisma Cloud's Cloud Native Network Firewall provides visibility into network traffic and allows for the monitoring and control of network flows within the cloud environment, effectively enabling administrators to visualize and secure inter-host communications and connections to network objects. ADEM (Option A) and WAAS Analytics (Option B) are not related to Prisma Cloud's capabilities for monitoring connections. Telemetry (Option C) involves the collection of data and metrics but does not specifically provide a graphical view of connections. Host Insight (Option E) focuses on providing visibility into host-related activities and vulnerabilities but does not specifically deal with monitoring network connections in the graphical manner described.

• Question 27:

  The development team is building pods to host a web front end, and they want to protect these pods with an application firewall.

  Which type of policy should be created to protect this pod from Layer7 attacks?

  A. The development team should create a WAAS rule for the host where these pods will be running.
  B. The development team should create a WAAS rule targeted at all resources on the host.
  C. The development team should create a runtime policy with networking protections.
  D. The development team should create a WAAS rule targeted at the image name of the pods.
  D. The development team should create a WAAS rule targeted at the image name of the pods.

  ---

  Explanation

  Image is the correct way of scoping the rule. Although host and image can be used to scope the rule. but the host can have other application pods which can be none web apps. scoping based on Image will make sure the rule only applies to the containers created from the web image. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/deploy_waas

• Question 28:

  Which two services require external Notifications to be enabled for policy violations in the Prisma Cloud environment? (Choose two.)

  A. Splunk
  B. QROC
  C. SQS
  D. Email
  A. Splunk
  C. SQS

  ---

  Explanation

  B - not couse there is no such integration like QROC

  D - not couse: "For all channels except email, to enable notification of policy violations in your cloud environments in your existing operational workflows, you must Configure External Integrations on Prisma Cloud."

• Question 29:

  Which port should a security team use to pull data from Console's API?

  A. 53
  B. 25
  C. 8084
  D. 8083
  D. 8083

  ---

  Explanation

• Question 30:

  A Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud.

  Which two steps can be performed by the Terraform script? (Choose two.)

  A. enable ow logs for Prisma Cloud.
  B. create the Prisma Cloud role.
  C. enable the required APIs for Prisma Cloud.
  D. publish the ow log to a storage bucket.
  B. create the Prisma Cloud role.
  C. enable the required APIs for Prisma Cloud.

  ---

  Explanation

  When a Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud, the Terraform script can perform several steps to facilitate this integration. The steps include

  B. create the Prisma Cloud role, which is essential for defining the permissions and capabilities that Prisma Cloud will have within the GCP environment, and

  C. enable the required APIs for Prisma Cloud, ensuring that Prisma Cloud can access the necessary GCP services and features for comprehensive cloud security management.