Palo Alto Networks Palo Alto Networks Certifications PCCSE Questions & Answers

• Question 71:

  Which action would be applicable after enabling anomalous compute provisioning?

  A. It detects the activity caused by the spambot.

  B. It detects unusual server port activity or unusual protocol activity from a client within or outside the cloud environment.

  C. It detects potential creation of an unauthorized network of compute instances with AutoFocus.

  D. It detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking.

  Correct Answer: D

• Question 72:

  Which IAM Azure RQL query would correctly generate an output to view users who have suffcient permissions to create security groups within Azure AD and create applications?

  A. config where api.name = `azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true

  B. config from cloud.resource where api.name = `azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions exists

  C. config from network where api.name = `azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is false and defaultUserRolePermissions.allowedToCreateApps is true

  D. config from cloud.resource where api.name = `azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true

  Correct Answer: D

• Question 73:

  What is the function of the external ID when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud?

  A. It is a unique identifier needed only when Monitor and Protect mode is selected.

  B. It is the resource name for the Prisma Cloud Role.

  C. It is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.

  D. It is the default name of the PrismaCloudApp stack.

  Correct Answer: C

• Question 74:

  In which two ways can Prisma Cloud images be retrieved in Prisma Cloud Compute Self-Hosted Edition? (Choose two.)

  A. Pull the images from the Prisma Cloud registry without any authentication.

  B. Authenticate with Prisma Cloud registry, and then pull the images from the Prisma Cloud registry.

  C. Retrieve Prisma Cloud images using URL auth by embedding an access token.

  D. Download Prisma Cloud images from github.paloaltonetworks.com.

  Correct Answer: BC

• Question 75:

  An administrator has added a Cloud account on Prisma Cloud and then deleted it.

  What will happen if the deleted account is added back on Prisma Cloud within a 24-hour period?

  A. No alerts will be displayed.

  B. Existing alerts will be displayed again.

  C. New alerts will be generated.

  D. Existing alerts will be marked as resolved.

  Correct Answer: B

• Question 76:

  Which three elements are part of SSH Events in Host Observations? (Choose three.)

  A. Startup process

  B. User

  C. System calls

  D. Process path

  E. Command

  Correct Answer: BDE

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/runtime_defense/runtime_defense_hosts

• Question 77:

  Which two variables must be modified to achieve automatic remediation for identity and access management (IAM) alerts in Azure cloud? (Choose two.)

  A. API_ENDPOINT

  B. SQS_QUEUE_NAME

  C. SB_QUEUE_KEY

  D. YOUR_ACCOUNT_NUMBER

  Correct Answer: AC

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-iam-security/remediate-alerts-for-iam-security

• Question 78:

  Which two roles have access to view the Prisma Cloud policies? (Choose two.)

  A. Build AND Deploy Security

  B. Auditor

  C. Dev SecOps

  D. Defender Manager

  Correct Answer: BC

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/prisma-cloud-admin-permissions

• Question 79:

  Which three actions are required in order to use the automated method within Azure Cloud to streamline the process of using remediation in the identity and access management (IAM) module? (Choose three.)

  A. Install boto3 and requests library.

  B. Configure IAM Azure remediation script.

  C. Integrate with Azure Service Bus.

  D. Configure IAM AWS remediation script.

  E. Install azure.servicebus and requests library.

  Correct Answer: BCE

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-iam-security/remediate-alerts-for-iam-security

• Question 80:

  How often do Defenders share logs with Console?

  A. Every 10 minutes

  B. Every 30 minutes

  C. Every 1 hour

  D. Real time

  Correct Answer: B

  https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/audit/log_rotation