Palo Alto Networks PCCSE Online Practice Questions and Exam Preparation

Palo Alto Networks PCCSE Online Questions & Answers

• Question 61:

  Prisma Cloud supports sending audit event records to which three targets? (Choose three.)

  A. SNMP Traps
  B. Syslog
  C. Stdout
  D. Prometheus
  E. Netflow
  B. Syslog
  C. Stdout
  D. Prometheus

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/audit/logging

• Question 62:

  An organization wants to restrict outbound internet access from containers. Which feature can help achieve this?

  A. Network segmentation policies
  B. Configuration policies
  C. Compliance policies
  D. Auto-remediation rules
  A. Network segmentation policies

  ---

  Explanation

  Network segmentation policies help restrict outbound access and prevent data exfiltration.

• Question 63:

  How can an administrator configure Prisma Cloud to automatically block the execution of a specific process in a container?

  A. Create a runtime policy that denies the process
  B. Add the process to the trusted allowlist
  C. Enable automatic learning mode
  D. Configure a compliance policy
  A. Create a runtime policy that denies the process

  ---

  Explanation

  A runtime policy can be used to deny the execution of specific processes inside a container.

• Question 64:

  An administrator wants to retrieve the compliance policies for images scanned in a continuous integration (CI) pipeline.

  Which endpoint will successfully execute to enable access to the images via API?

  A. GET /api/v22.01/policies/compliance
  B. GET /api/v22.01/policies/compliance/ci
  C. GET /api/v22.01/policies/compliance/ci/images
  D. GET /api/v22.01/policies/compliance/ci/serverless
  C. GET /api/v22.01/policies/compliance/ci/images

  ---

  Explanation

• Question 65:

  A security team has a requirement to ensure the environment is scanned for vulnerabilities. What are three options for configuring vulnerability policies? (Choose three.)

  A. individual actions based on package type
  B. output verbosity for blocked requests
  C. apply policy only when vendor fix is available
  D. individual grace periods for each severity level
  E. customize message on blocked requests
  B. output verbosity for blocked requests
  C. apply policy only when vendor fix is available
  D. individual grace periods for each severity level

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/vulnerability_management/ vuln_management_rules.html

• Question 66:

  Which RQL query will help create a custom identity and access management (IAM) policy to alert on Lambda functions that have permission to terminate EC2 instances?

  A. iam from cloud.resource where dest.cloud.type = 'AWS' AND source.cloud.service.name = 'lambda' AND source.cloud.resource.type = 'function' AND dest.cloud.service.name = 'ec2' AND action.name = 'ec2:TerminateInstances'
  B. config from iam where dest.cloud.type = 'AWS' AND source.cloud.service.name = 'ec2' AND source.cloud.resource.type = 'instance' AND dest.cloud.service.name = 'lambda' AND action.name = 'ec2:TerminateInstances'
  C. iam from cloud.resource where cloud.type equals 'AWS' AND cloud.resource.type equals 'lambda function' AND cloud.service.name = 'ec2' AND action.name equals 'ec2:TerminateInstances'
  D. config from iam where dest.cloud.type = 'AWS' AND source.cloud.service.name = 'lambda' AND source.cloud.resource.type = 'function' AND dest.cloud.service.name = 'ec2' AND action.name = 'ec2:TerminateInstances'
  D. config from iam where dest.cloud.type = 'AWS' AND source.cloud.service.name = 'lambda' AND source.cloud.resource.type = 'function' AND dest.cloud.service.name = 'ec2' AND action.name = 'ec2:TerminateInstances'

  ---

  Explanation

  To create a custom Identity and Access Management (IAM) policy that alerts on Lambda functions with permissions to terminate EC2 instances, the correct RQL query structure involves specifying the source service (Lambda), the destination service (EC2), and the specific action of interest ('ec2:TerminateInstances'). The query should identify configurations where a Lambda function ('source.cloud.service.name = 'lambda' and 'source.cloud.resource.type = 'function') has been granted permissions that allow it to perform the 'ec2:TerminateInstances' action on EC2 instances ('dest.cloud.service.name = 'ec2'). This query helps in identifying and mitigating potential risks associated with overly permissive functions that could inadvertently or maliciously impact the availability of EC2 resources.

• Question 67:

  The attempted bytes count displays?

  A. traffic that is either denied by the security group or firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.
  B. traffic that is either denied by the security group or firewall rules.
  C. traffic that is either denied by the firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.
  D. traffic denied by the security group or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.
  A. traffic that is either denied by the security group or firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.

  ---

  Explanation

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/investigate-incidents-on-prisma-cloud/investigate-network-incidents-on-prisma-cloud

• Question 68:

  Which RQL query type is invalid?

  A. Event
  B. IAM
  C. Incident
  D. config
  C. Incident

  ---

  Explanation

  Within Prisma Cloud's Resource Query Language (RQL), the "Incident" query type is invalid because RQL is designed to query configuration and posture information of cloud resources, not incident data. The valid RQL query types include "Config" for querying resource configurations, "Network" for querying network-related information, "IAM" for querying identity and access management configurations, and "Event" for querying audit events. The focus on resource configurations and audit events aligns with Prisma Cloud's capabilities in cloud security posture management (CSPM) and cloud workload protection platform (CWPP), providing insights into resource configurations, compliance, and network traffic. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql

• Question 69:

  A customer has Defenders connected to Prisma Cloud Enterprise. The Defenders are deployed as a DaemonSet in OpenShift.

  How should the administrator get a report of vulnerabilities on hosts?

  A. Navigate to Monitor > Vulnerabilities > CVE Viewer
  B. Navigate to Defend > Vulnerabilities > VM Images
  C. Navigate to Defend > Vulnerabilities > Hosts
  D. Navigate to Monitor > Vulnerabilities > Hosts
  D. Navigate to Monitor > Vulnerabilities > Hosts

  ---

  Explanation

  To view the vulnerabilities identified on a host, navigating to the "Monitor > Vulnerabilities > Hosts" section within the Prisma Cloud Console is the correct approach. This section is specifically designed to provide a comprehensive overview of all detected vulnerabilities within the host environment, offering detailed insights into each vulnerability's nature, severity, and potential impact. This pathway allows users to efficiently assess the security posture of their hosts, prioritize vulnerabilities based on their severity, and take appropriate remediation actions. The "Hosts" section under "Vulnerabilities" is tailored to display vulnerabilities related to host configurations, installed software, and other host-level security concerns, making it the ideal location within the Prisma Cloud Console for this purpose.

• Question 70:

  The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely. Which strategy should the administrator use to achieve this goal?

  A. Disable the policy
  B. Set the Alert Disposition to Conservative
  C. Change the Training Threshold to Low
  D. Set Alert Disposition to Aggressive
  B. Set the Alert Disposition to Conservative

  ---

  Explanation

  To reduce the number of alerts generated by the "Unusual protocol activity (Internal)" network anomaly without entirely disabling the policy, setting the Alert Disposition to Conservative (option B) is the most effective strategy. This configuration adjusts the sensitivity of the anomaly detection, reducing the likelihood of false positives and minimizing alert fatigue without compromising the ability to detect genuine security threats. By adopting a more conservative approach to anomaly detection, the administrator can ensure that only the most significant and potentially harmful activities trigger alerts, thus maintaining a balance between security vigilance and operational efficiency. https:// docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise-settings