Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 31:

  DRAG DROP

  Order the steps involved in onboarding an AWS Account for use with Data Security feature.

  Select and Place:

  

  

• Question 32:

  An administrator has been tasked with a requirement by your DevSecOps team to write a script to continuously query programmatically the existing users, and the user's associated permission levels, in a Prisma Cloud Enterprise tenant. Which public documentation location should be reviewed to help determine the required attributes to carry out this step?

  A. Prisma Cloud Administrator's Guide (Compute)
  B. Prisma Cloud API Reference
  C. Prisma Cloud Compute API Reference
  D. Prisma Cloud Enterprise Administrator's Guide
  B. Prisma Cloud API Reference

  ---

  Explanation

  Prisma Cloud Enterprise is CSPM + CWP but Prisma Cloud Compute API Ref doesn't exist anymore

• Question 33:

  Which three serverless runtimes are supported by Prisma Cloud for vulnerability and compliance scans? (Choose three.)

  A. Swift
  B. Python
  C. Dart
  D. Java
  E. Node.js
  B. Python
  D. Java
  E. Node.js

  ---

  Explanation

  Prisma Cloud supports several serverless runtimes for vulnerability and compliance scans, including Python, Java, and Node.js. These runtimes are widely used in the development of serverless applications, which are designed to run in stateless compute containers that are event-triggered and fully managed by cloud services. By providing vulnerability and compliance scans for these serverless runtimes, Prisma Cloud helps organizations identify and remediate security issues within their serverless applications, ensuring that they adhere to security best practices and compliance standards. This capability is crucial for maintaining the security and integrity of serverless architectures, where traditional security approaches may not be applicable. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_defender/install_serverless_defender

• Question 34:

  Which two bot categories belong to unknown bots under Web-Application and API Security (WAAS) bot protection? (Choose two.)

  A. News bots
  B. Search engine crawlers
  C. Web scrapers
  D. HTTP libraries
  C. Web scrapers
  D. HTTP libraries

  ---

  Explanation

  Under Web-Application and API Security (WAAS) bot protection in Prisma Cloud, unknown bots are categorized based on their behavior and characteristics. Web scrapers and HTTP libraries fall into the category of unknown bots. Web scrapers are automated scripts or programs that extract data from websites, often without permission, while HTTP libraries are tools used for making HTTP requests. Both can be used benignly but may also be employed in malicious activities, hence their classification as unknown bots requiring further analysis.

• Question 35:

  A customer has serverless functions that are deployed in multiple clouds.

  Which serverless cloud provider is covered be "overly permissive service access" compliance check?

  A. Alibaba
  B. GCP
  C. AWS
  D. Azure
  C. AWS

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin- compute/compliance/serverless.html

  The serverless cloud provider covered by the "overly permissive service access" compliance check is AWS (Amazon Web Services). AWS Lambda, which is the serverless computing platform provided by AWS, may have functions that are assigned more permissions than they require to perform their operations, leading to security risks.

  In the context of CSPM tools, such as Prisma Cloud, checks for overly permissive service access would typically include examining the policies attached to AWS Lambda functions to ensure that they adhere to the principle of least privilege. Such checks help identify and rectify overly broad permissions that could potentially be exploited by attackers.

  The reference for this can be found in AWS best practices for Lambda security, which emphasize the importance of granting minimal privileges necessary for the Lambda function to perform its tasks, thereby reducing the potential attack surface.

• Question 36:

  Which data security default policy is able to scan for vulnerabilities?

  A. Objects containing Vulnerabilities
  B. Objects containing Threats
  C. Objects containing Malware
  D. Objects containing Exploits
  C. Objects containing Malware

  ---

  Explanation

  The data security default policy capable of scanning for vulnerabilities is "Objects containing Malware". In cloud security, malware scanning is an essential feature of CSPM tools that allows for the identification of malicious software within objects stored in the cloud. A policy that scans for objects containing malware ensures that any files or code bases in the cloud environment are examined for potential threats, protecting the cloud resources from being compromised.

• Question 37:

  An organization wants to be notified immediately to any `High Severity` alerts for the account group `Clinical Trials` via Slack.

  Which option shows the steps the organization can use to achieve this goal?

  A. 1. Configure Slack Integration 2.Create an alert rule and select Clinical Trials as the account group 3.Under the Select Policies tab, filter on severity and select High 4.Under the Set Alert Notification tab, choose Slack and populate the channel 5.Set Frequency to As it Happens
  B. 1. Create an alert rule and select Clinical Trials as the account group 2.Under the Select Policies tab, filter on severity and select High 3.Under the Set Alert Notification tab, choose Slack and populate the channel 4.Set Frequency to As it Happens 5.Set up the Slack Integration to complete the configuration
  C. 1. Configure Slack Integration 2.Create an alert rule 3.Under the Select Policies tab, filter on severity and select High 4 . Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to As it Happens
  D. 1. Under the Select Policies tab, filter on severity and select High 2.Under the Set Alert Notification tab, choose Slack and populate the channel 3.Set Frequency to As it Happens 4.Configure Slack Integration 5.Create an Alert rule
  A. 1. Configure Slack Integration 2.Create an alert rule and select Clinical Trials as the account group 3.Under the Select Policies tab, filter on severity and select High 4.Under the Set Alert Notification tab, choose Slack and populate the channel 5.Set Frequency to As it Happens

  ---

  Explanation

  To achieve immediate notification for "High Severity" alerts for a specific account group via Slack, the steps outlined in option A provide a comprehensive and effective approach. Firstly, configuring the Slack Integration establishes the necessary communication channel between Prisma Cloud and the Slack workspace. Creating an alert rule with the specified account group and severity filters ensures that only relevant alerts trigger notifications. Selecting Slack as the notification channel and setting the frequency to "As it Happens" ensures real-time alerting for critical issues. This method leverages Prisma Cloud's alerting capabilities and Slack's real-time messaging platform to promptly notify the security team, enabling swift action to mitigate risks. This approach is in line with Prisma Cloud's flexible and configurable alerting system, designed to integrate with various external platforms for efficient incident response. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/alerts/slack.html

• Question 38:

  The administrator wants to review the Console audit logs from within the Console. Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

  A. Navigate to Monitor > Events > Host Log Inspection
  B. The audit logs can be viewed only externally to the Console
  C. Navigate to Manage > Defenders > View Logs
  D. Navigate to Manage > View Logs > History
  D. Navigate to Manage > View Logs > History

  ---

  Explanation

  https://docs.twistlock.com/docs/compute_edition/howto/review_debug_logs.html

• Question 39:

  An administrator has access to a Prisma Cloud Enterprise.

  What are the steps to deploy a single container Defender on an ec2 node?

  A. Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.
  B. Execute the curl | bash script on the ec2 node.
  C. Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.
  D. Generate DaemonSet file and apply DaemonSet to the twistlock namespace.
  B. Execute the curl | bash script on the ec2 node.

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_defender/install_single_container_defender

• Question 40:

  In WAAS Access control file upload controls, which three file types are supported out of the box? (Choose three.)

  A. Text
  B. Images
  C. Audio
  D. Documents
  E. Journal
  B. Images
  C. Audio
  D. Documents

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/waas_access_control