Palo Alto Networks PSE-PRISMA-CLOUD Online Practice Questions and Exam Preparation

Palo Alto Networks PSE-PRISMA-CLOUD Online Questions & Answers

• Question 1:

  DRAG DROP

  A customer has deployed a VM-Series NGFW on Amazon Web Services using a PAYG license.

  What is the sequence required by the customer to switch to a BYOL license?

  Select and Place:

  

  

• Question 2:

  DRAG DROP

  Based on the diagram, prioritize the order in which the Virtual Gateway evaluates the best route based on the deterministic B6P Path selection process.

  

  Select and Place:

  

  

• Question 3:

  Which statement explains the correlation between the block and alert thresholds in a vulnerability management policy?

  A. The thresholds can be set to informational, low, medium, high, and critical.
  B. The alert threshold always has precedence over, and can be greater than, the block threshold.
  C. The block threshold must always be equal to or greater than the alert threshold.
  D. The block threshold always has precedence over, and can be less than, the alert threshold.
  C. The block threshold must always be equal to or greater than the alert threshold.

  ---

  explanation:

  Explanation

• Question 4:

  Which option is defined by the creation and change of public cloud services managed in a repeatable and predictable fashion?

  A. platform as a service
  B. infrastructure as a service
  C. software as code
  D. infrastructure as code
  B. infrastructure as a service

  ---

  explanation:

  Explanation

• Question 5:

  Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

  A. network where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))
  B. network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))
  C. network where dest.resource IN (resource where role = 'Database'}
  D. network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))
  D. network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

  ---

  explanation:

  Explanation

• Question 6:

  Which pattern syntax will add all images to a trusted images rule within a registry?

  D

  ---

  explanation:

  Explanation

• Question 7:

  When protecting against attempts to exploit client-side and server-side vulnerabilities, what is the Palo Alto Networks best practice when using NGFW Vulnerability Protection Profiles?

  A. Use the default Vulnerability Protection Profile to protect clients from all known critical, high, and medium-severity threats
  B. Clone the predefined Strict Profile, with packet capture settings disabled
  C. Use the default Vulnerability Protection Profile to protect servers from all known critical, high, and medium-severity threats
  D. Clone the predefined Strict Profile, with packet capture settings enabled
  D. Clone the predefined Strict Profile, with packet capture settings enabled

  ---

  explanation:

  Explanation

• Question 8:

  Which two resources provide operational insight within the Prisma Cloud Asset Inventory? (Choose two.)

  A. Cortex Data Lake
  B. Cloud Storage buckets
  C. Prisma Access Gateways
  D. Compute Engine instance
  A. Cortex Data Lake
  B. Cloud Storage buckets

  ---

  explanation:

  Explanation

• Question 9:

  What configuration on AWS is required in order for VM-Series to forward traffic between its network interfaces?

  A. Both Source and Destination Checks are disabled
  B. Both Source and Destination Checks are enabled
  C. Source Check is disabled and Destination Check is enabled
  D. Source Check is enabled and Destination Check is disabled
  A. Both Source and Destination Checks are disabled

  ---

  explanation:

  Explanation

  https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/use-case-secure-the-ec2-instances-in-the-aws-cloud

• Question 10:

  Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

  A. config where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification
  B. config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification
  C. config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists
  D. config where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1
  B. config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

  ---

  explanation:

  Explanation