Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 41:

  Which resources can be added in scope while creating a vulnerability policy for continuous integration?

  A. Images and cluster
  B. Images and labels
  C. Images and containers
  D. Labels and AccountID
  B. Images and labels

  ---

  Explanation

• Question 42:

  Under which tactic is "Exploit Public-Facing Application" categorized in the ATTandCK framework?

  A. Defense Evasion
  B. Initial Access
  C. Execution
  D. Privilege Escalation
  B. Initial Access

  ---

  Explanation

  In the MITRE ATTandCK framework, the tactic "Exploit Public-Facing Application" is categorized under Initial Access. This tactic involves leveraging vulnerabilities in public-facing applications to gain unauthorized access to an organization's external services or applications. Initial Access tactics are concerned with the methods adversaries use to gain an initial foothold within a network, and exploiting public-facing applications is a common approach used by attackers to breach external defenses and establish a presence within a target network.

• Question 43:

  Which three types of classifications are available in the Data Security module? (Choose three.)

  A. Personally identifiable information
  B. Malicious IP
  C. Compliance standard
  D. Financial information
  E. Malware
  A. Personally identifiable information
  D. Financial information
  E. Malware

  ---

  Explanation

• Question 44:

  Which alerts are fixed by enablement of automated remediation?

  A. All applicable open alerts regardless of when they were generated, with alert status updated to "resolved"
  B. Only the open alerts that were generated before the enablement of remediation, with alert status updated to "resolved"
  C. All applicable open alerts regardless of when they were generated, with alert status updated to "dismissed"
  D. Only the open alerts that were generated after the enablement of remediation, with alert status updated to "resolved"
  A. All applicable open alerts regardless of when they were generated, with alert status updated to "resolved"

  ---

  Explanation

  When automated remediation is enabled in Prisma Cloud, it is designed to address all applicable open alerts, regardless of when they were generated. The system automatically applies remediation actions to resolve the identified security issues or compliance violations that triggered the alerts. Once the remediation actions are successfully completed, the system updates the status of the affected alerts to "resolved," indicating that the security issues have been addressed. This feature helps streamline the remediation process, reducing the manual effort required by security teams and ensuring that security issues are promptly resolved to maintain the integrity and security of the cloud environment. https:// docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/configure-prisma-cloud-to-automatically-remediate-alerts

• Question 45:

  What improves product operationalization by adding visibility into feature utilization and missed opportunities?

  A. Alert Center
  B. Alarm Center
  C. Alarm Advisor
  D. Adoption Advisor
  D. Adoption Advisor

  ---

  Explanation

  The Adoption Advisor is a feature within Prisma Cloud that aims to improve product operationalization. It provides visibility into how features are utilized, identifies unused capabilities, and suggests ways to leverage the full potential of the platform. Therefore, Option A: Adoption Advisor is the correct answer. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/adoption-advisor

• Question 46:

  Which statement is true about obtaining Console images for Prisma Cloud Compute Edition?

  A. To retrieve Prisma Cloud Console images using basic auth: 1.Access registry.paloaltonetworks.com, and authenticate using `docker login'. 2.Retrieve the Prisma Cloud Console images using `docker pull'.
  B. To retrieve Prisma Cloud Console images using basic auth: 1.Access registry.twistlock.com, and authenticate using `docker login'. 2.Retrieve the Prisma Cloud Console images using `docker pull'.
  C. To retrieve Prisma Cloud Console images using URL auth: 1.Access registry-url-auth.twistlock.com, and authenticate using the user certificate. 2.Retrieve the Prisma Cloud Console images using `docker pull'.
  D. To retrieve Prisma Cloud Console images using URL auth: 1.Access registry-auth.twistlock.com, and authenticate using the user certificate. 2.Retrieve the Prisma Cloud Console images using `docker pull'.
  A. To retrieve Prisma Cloud Console images using basic auth: 1.Access registry.paloaltonetworks.com, and authenticate using `docker login'. 2.Retrieve the Prisma Cloud Console images using `docker pull'.

  ---

  Explanation

  Prisma Cloud Compute Edition Console images are retrieved from registry.paloaltonetworks.com using basic authentication with docker login, followed by pulling the images with docker pull.

• Question 47:

  A customer's Security Operations Center (SOC) team wants to receive alerts from Prisma Cloud via email once a day about all policies that have a violation, rather than receiving an alert every time a new violation occurs.

  Which alert rule configuration meets this requirement?

  A. Configure an alert rule with all the defaults except selecting email within the "Alert Notifications" tab and specifying recipient.
  B. Configure an alert rule. Under the "Policies" tab, select "High Risk Severity Policies." In the "Set Alert Notifications" tab, select "Email > Recurring," set to repeat every 1 day, and enable "Email."
  C. Set up email integrations under the "Integrations" tab in "Settings" and create a notification template.
  D. Configure an alert rule. Under the "Policies" tab, select "All Policies." In the "Set Alert Notifications" tab, select "Email > Recurring," set to repeat every 1 day, and then enable "Email."
  D. Configure an alert rule. Under the "Policies" tab, select "All Policies." In the "Set Alert Notifications" tab, select "Email > Recurring," set to repeat every 1 day, and then enable "Email."

  ---

  Explanation

• Question 48:

  Which three AWS policy types and identities are used to calculate the net effective permissions? (Choose three.)

  A. AWS IAM group
  B. AWS IAM role
  C. AWS service control policies (SCPs)
  D. AWS IAM tag policy
  E. AWS IAM User
  A. AWS IAM group
  B. AWS IAM role
  C. AWS service control policies (SCPs)

  ---

  Explanation

  In AWS, the net effective permissions are calculated based on various policy types and identities. The correct choices are:

  AWS service control policies (SCPs): SCPs are used in AWS Organizations to manage permissions for all accounts within the organization, affecting the net effective permissions.

  AWS IAM group: IAM groups define a set of permissions for a collection of users, influencing their effective permissions.

  AWS IAM role: IAM roles provide temporary security credentials to assume a set of permissions, impacting the net effective permissions. AWS IAM User and E AWS IAM tag policy also play roles in defining permissions, but A, B, and C are

  the primary types used in calculating net effective permissions, making them the correct choices.

  https://docs.prismacloud.io/en/classic/cspm-admin-guide/prisma-cloud-iam-security/context-used-to-calculate-effective-permissions

• Question 49:

  The development team wants to block Cross Site Scripting attacks from pods in its environment. How should the team construct the CNAF policy to protect against this attack?

  A. create a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to prevent .
  B. create a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.
  C. create a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.
  D. create a Container CNAF policy, targeted at a specific resource, and they should set Explicitly allowed inbound IP sources to the IP address of the pod.
  C. create a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.

  ---

  Explanation

  To protect pods in an environment from Cross-Site Scripting (XSS) attacks, the development team should create a Container Cloud Native Application Firewall (CNAF) policy. This policy should be targeted at the specific resource (e.g., a particular pod or set of pods), with the option for XSS protection checked, and the action set to "prevent." This configuration ensures that any XSS attacks directed at the targeted containers are effectively blocked.

• Question 50:

  DRAG DROP

  Put the steps involved to configure and scan using the IntelliJ plugin in the correct order.

  Select and Place: