Palo Alto Networks PSE-Prisma Cloud Professional PSE-PRISMACLOUD Questions & Answers

• Question 11:

  Amazon Web Services WAF can be enabled on which two resources?(Choose two.)

  A. AWS CDN

  B. AWS NAT Gateway

  C. AWS ALB

  D. AWS NLB

  Correct Answer: AB

• Question 12:

  Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

  A. Shield

  B. Inspector

  C. GuardDuty

  D. Amazon Web Services WAF

  Correct Answer: C

  http://www.paloguard.com/datasheets/prisma-cloud-on-aws.pdf

• Question 13:

  An administrator deploys a VM-Series firewall into Amazon Web Services. Which attribute must be disabled on the data-plane elastic network interface for the instance to handle traffic that is not destined to its own IP address?

  A. security group

  B. tags

  C. elastic ip address

  D. source/destination checking

  Correct Answer: D

  https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html

• Question 14:

  What are three examples of outbound traffic flow? (Choose three.)

  A. issue yum update command on an instance inside Amazon Web Services

  B. Microsoft Windows inside Azure requesting a security patch

  C. web server inside Amazon Web Services receiving web requests from internet

  D. issue apt-get install command on an instance inside Amazon Web Services

  E. outgoing Prisma Public Cloud API calls

  Correct Answer: BDE

• Question 15:

  A client has a sensitive internet-facing application server in Microsoft Azure and is concerned about resource exhaustion because of distributed denial-of-service attacks What can be configured on the VM-Series firewall to specifically protect this server against this type of attack?

  A. Custom threat signature

  B. Zone Protection Profile

  C. QoS Profile to limit incoming requests

  D. DoS Protection Profile with specific session counts

  Correct Answer: B

• Question 16:

  What is the scope of the Amazon Web Services IAM Service?

  A. global

  B. regional

  C. VPC

  D. zonal

  Correct Answer: A

• Question 17:

  Which change represents a VM-Series NGFW license transfer?

  A. VM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

  B. VM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

  C. VM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

  D. VM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services

  Correct Answer: C

• Question 18:

  What is a permanent public IP called on Amazon Web Services?

  A. Reserved IP

  B. PIP

  C. EIP

  D. Floating IP

  Correct Answer: C

• Question 19:

  Which RQL string returns a list of all Azure virtual machines that are not currently running?

  A. config where api.name = 'azure-vm-list' AND json.rule = powerState = "off'

  B. config where api.name = 'azure-vm-list' AND json.rule = powerState does not contain "running"

  C. config where api.name = 'azure-vm-list' AND json.rule = powerState = "running"

  D. config where api.name = 'azure-vm-list' AND json.rule = powerState contains "running"

  Correct Answer: D

• Question 20:

  What configuration on AWS is required in order for VM-Series to forward traffic between its network interfaces?

  A. Both Source and Destination Checks are disabled

  B. Both Source and Destination Checks are enabled

  C. Source Check is disabled and Destination Check is enabled

  D. Source Check is enabled and Destination Check is disabled

  Correct Answer: A

  https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/use-case-secure-the-ec2-instances-in-the-aws-cloud