Best Exam Practice Material for Palo Alto Networks PCCSE Exam Q&A

Jonnie Karnath2023-05-17T09:39:59+00:00

If you want to reduce your chances of failure and increase your chances of success, consider using Palo Alto Networks PCCSE exam Q&A to prepare for your Prisma Certified Cloud Security Engineer exam. Certspots Palo Alto Networks PCCSE exam Q&As are created by industry experts who have years of experience in the field of Palo Alto Networks. The questions are updated regularly to ensure that they reflect the most current trends and technologies in the industry, and to keep up with any changes to the exam format or content. These study materials can help candidates build a solid foundation of knowledge and can help you feel more confident and prepared on the day of the exam.

Page 1 of 7

1. Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

copy the Console address and set the config map for the default namespace.

create a new namespace in Kubernetes called admission-controller.

enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.

copy the admission controller configuration from the Console and apply it to Kubernetes.

2. Which of the following is displayed in the asset inventory?

EC2 instances

Asset tags

SSO users

Federated users

3. A customer wants to monitor the company’s AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now.

Which two pieces of information do you need to onboard this account? (Choose two.)

Cloudtrail

Subscription ID

Active Directory ID

External ID

Role ARN

4. DRAG DROP

Which order of steps map a policy to a custom compliance standard?(Drag the steps into the correct order of occurrence, from the first step to the last.)

5. The security team wants to protect a web application container from an SQLi attack.

Which type of policy should the administrator create to protect the container?

CNAF

Runtime

Compliance

CNNF

6. Console is running in a Kubernetes cluster, and you need to deploy Defenders on nodes within this cluster.

Which option shows the steps to deploy the Defenders in Kubernetes using the default Console service name?

From the deployment page in Console, choose pod name for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace.

From the deployment page configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes.

From the deployment page in Console, choose twistlock-console for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

From the deployment page in Console, choose twistlock-console for Console identifier, and run the curl | bash script on the master Kubernetes node.

7. A Prisma Cloud administrator is tasked with pulling a report via API. The Prisma Cloud tenant is located on app2.prismacloud.io.

What is the correct API endpoint?

https://api.prismacloud.io

https://api2.eu.prismacloud.io

httsp://api.prismacloud.cn

https://api2.prismacloud.io

8. A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible.

Which action should the SOC take to follow security best practices?

Enable “AWS S3 bucket is publicly accessible” policy and manually remediate each alert.

Enable “AWS RDS database instance is publicly accessible” policy and for each alert, check that it is a production instance, and then manually remediate.

Enable “AWS S3 bucket is publicly accessible” policy and add policy to an auto-remediation alert rule.

Enable “AWS RDS database instance is publicly accessible” policy and add policy to an auto-remediation alert rule.

9. What are two built-in RBAC permission groups for Prisma Cloud? (Choose two.)

Group Membership Admin

Group Admin

Account Group Admin

Account Group Read Only

10. In Prisma Cloud Software Release 22.06 (Kepler), which Registry type is added?

Azure Container Registry

Google Artifact Registry

IBM Cloud Container Registry

Sonatype Nexus

Page 2 of 7

11. Which option shows the steps to install the Console in a Kubernetes Cluster?

Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

12. A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

set the Container model to manual relearn and set the default runtime rule to block for process protection.

set the Container model to relearn and set the default runtime rule to prevent for process protection.

add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.

choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.

13. A customer wants to scan a serverless function as part of a build process.

Which twistcli command can be used to scan serverless functions?

twistcli function scan <SERVERLESS_FUNCTIO

ZIP>

twistcli scan serverless <SERVERLESS_FUNCTIO

ZIP>

twistcli serverless AWS <SERVERLESS_FUNCTIO

ZIP>

twiscli serverless scan <SERVERLESS_FUNCTIO

ZIP>

14. The security team wants to target a CNAF policy for specific running Containers.

How should the administrator scope the policy to target the Containers?

scope the policy to Image names.

scope the policy to namespaces.

scope the policy to Defender names.

scope the policy to Host names.

15. DRAG DROP

Put the steps involved to configure and scan using the IntelliJ plugin in the correct order.

16. Which two statements are true about the differences between build and run config policies? (Choose two.)

Run and Network policies belong to the configuration policy set.

Build and Audit Events policies belong to the configuration policy set.

Run policies monitor resources, and check for potential issues after these cloud resources are deployed.

Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.

Run policies monitor network activities in your environment, and check for potential issues during runtime.

17. A customer has a requirement to scan serverless functions for vulnerabilities.

Which three settings are required to configure serverless scanning? (Choose three.)

Defender Name

Region

Credential

Console Address

Provider

18. Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.

Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.

Remove Defenders, and then deploy the new DaemonSet so Defenders do not have toautomatically update on each deployment.

Let Defenders automatically upgrade.

19. How many CLI remediation commands can be added in a custom policy sequence?

20. Which action would be applicable after enabling anomalous compute provisioning?

It detects the activity caused by the spambot.

It detects unusual server port activity or unusual protocol activity from a client within or outside the cloud environment.

It detects potential creation of an unauthorized network of compute instances with AutoFocus.

It detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking.

Page 3 of 7

21. A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment.

Which action needs to be set for “do not use privileged containers”?

Prevent

Alert

Block

Fail

22. A customer has a development environment with 50 connected Defenders. A maintenance window is set for Monday to upgrade 30 stand-alone Defenders in the development environment, but there is no maintenance window available until Sunday to upgrade the remaining 20 stand-alone Defenders.

Which recommended action manages this situation?

Go to Manage > Defender > Manage, then click Defenders, and use the Scheduler to choose which Defenders will be automatically upgraded during the maintenance window.

Find a maintenance window that is suitable to upgrade all stand-alone Defenders in the development environment.

Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window.

Open a support case with Palo Alto Networks to arrange an automatic upgrade.

23. A customer has Defenders connected to Prisma Cloud Enterprise. The Defenders are deployed as a DaemonSet in OpenShift.

How should the administrator get a report of vulnerabilities on hosts?

Navigate to Monitor > Vulnerabilities > CVE Viewer

Navigate to Defend > Vulnerabilities > VM Images

Navigate to Defend > Vulnerabilities > Hosts

Navigate to Monitor > Vulnerabilities > Hosts

24. An administrator sees that a runtime audit has been generated for a container.

The audit message is:

“/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr”

Which protection in the runtime rule would cause this audit?

Networking

File systems

Processes

Container

25. Which container scan is constructed correctly?

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 --details myimage/latest

twistcli images scan -u api -p api --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

26. Which three types of runtime rules can be created? (Choose three.)

Processes

Network-outgoing

Filesystem

Kubernetes-audit

Waas-request

27. What is the correct method for ensuring key-sensitive data related to SSNs and credit card numbers cannot be viewed in Dashboard > Data view during investigations?

Go to Settings > Data > Snippet Masking and select Full Mask.

Go to Settings > Data > Data Patterns, search for SSN Pattern, edit it, and modify the proximity keywords.

Go to Settings > Cloud Accounts > Edit Cloud Account > Assign Account Group and select a group with limited permissions.

Go to Policies > Data > Clone > Modify Objects containing Financial Information publicly exposed and change the file exposure to Private.

28. Which role does Prisma Cloud play when configuring SSO?

JIT

Service provider

SAML

Identity provider issuer

29. What is the frequency to create a compliance report? (Choose two.)

Weekly

One time

Monthly

Recurring

30. On which cloud service providers can you receive new API release information for Prisma Cloud?

AWS, Azure, GCP, Oracle, IBM

AWS, Azure, GCP, Oracle, Alibaba

AWS, Azure, GCP, IBM

AWS, Azure, GCP, IBM, Alibaba

Page 4 of 7

31. Which two statements apply to the Defender type Container Defender - Linux?

It is implemented as runtime protection in the userspace.

It is deployed as a service.

It is deployed as a container.

It is incapable of filesystem runtime defense.

32. Given the following JSON query:

$.resource[*].aws_s3_bucket exists

Which tab is the correct place to add the JSON query when creating a Config policy?

Details

Compliance Standards

Remediation

Build Your Rule (Run tab)

Build Your Rule (Build tab)

33. How often do Defenders share logs with Console?

Every 10 minutes

Every 30 minutes

Every 1 hour

Real time

34. A security team has been asked to create a custom policy.

Which two methods can the team use to accomplish this goal? (Choose two.)

add a new policy

clone an existing policy

disable an out-of-the-box policy

edit the query in the out-of-the-box policy

35. Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

Scope - Scans run on a particular host

Credential

Apply rule only when vendor fixes are available

Failure threshold

Grace Period

36. Retrieve the Prisma Cloud Console images using ‘docker pull’.

37. Which three actions are available for the container image scanning compliance rule? (Choose three.)

Allow

Snooze

Block

Ignore

Alert

38. The development team wants to fail CI jobs where a specific CVE is contained within the image.

How should the development team configure the pipeline or policy to produce this outcome?

Set the specific CVE exception as an option in Jenkins or twistcli.

Set the specific CVE exception as an option in Defender running the scan.

Set the specific CVE exception as an option using the magic string in the Console.

Set the specific CVE exception in Console’s CI policy.

39. A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company’s AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is currently not using AWS Organizations and will require each account to be onboarded individually.

The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts.

Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

https://api.prismacloud.io/cloud/

https://api.prismacloud.io/account/aws

https://api.prismacloud.io/cloud/aws

https://api.prismacloud.io/accountgroup/aws

40. A customer has Prisma Cloud Enterprise and host Defenders deployed.

What are two options that allow an administrator to upgrade Defenders? (Choose two.)

with auto-upgrade, the host Defender will auto-upgrade.

auto deploy the Lambda Defender.

click the update button in the web-interface.

generate a new DaemonSet file.

Page 5 of 7

41. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.

Console Address: $CONSOLE_ADDRESS Websocket Address:

$WEBSOCKET_ADDRESS User: $ADMIN_USER

Which command generates the YAML file for Defender install?

<PLATFORM>/twistcli defender --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $WEBSOCKET_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender YAML kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

42. What is the behavior of Defenders when the Console is unreachable during upgrades?

Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.

Defenders will fail closed until the web-socket can be re-established.

Defenders will fail open until the web-socket can be re-established.

Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

43. An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.

In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

Which port will twistcli need to use to access the Prisma Compute APIs?

8084

443

8083

8081

44. Which RQL query type is invalid?

Event

IAM

Incident

Config

45. Given the following RQL:

event from cloud.audit_logs where operation IN (‘CreateCryptoKey’, ‘DestroyCryptoKeyVersion’, ‘v1.compute.disks.createSnapshot’)

Which audit event snippet is identified?

A)

Option A

Option B

Option C

Option D

46. The administrator wants to review the Console audit logs from within the Console.

Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

Navigate to Monitor > Events > Host Log Inspection

The audit logs can be viewed only externally to the Console

Navigate to Manage > Defenders > View Logs

Navigate to Manage > View Logs > History

47. Which two required request headers interface with Prisma Cloud API? (Choose two.)

Content-type:application/json

x-redlock-auth

>x-redlock-request-id

Content-type:application/xml

48. Which two roles have access to view the Prisma Cloud policies? (Choose two.)

Build AND Deploy Security

Auditor

Dev SecOps

Defender Manager

49. What is the function of the external ID when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud?

It is a unique identifier needed only when Monitor & Protect mode is selected.

It is the resource name for the Prisma Cloud Role.

It is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.

It is the default name of the PrismaCloudApp stack.

50. A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.

Which two reasons explain this change in alert status? (Choose two.)

user manually changed the alert status.

policy was changed.

resource was deleted.

alert was sent to an external integration.

Page 6 of 7

51. When would a policy apply if the policy is set under Defend > Vulnerability > Images > Deployed?

when a serverless repository is scanned

when a Container is started form an Image

when the Image is built and when a Container is started form an Image

when the Image is built

52. While writing a custom RQL with array objects in the investigate page, which type of auto-suggestion a user can leverage?

Auto-sugestion for array objects that are useful for comparing between arrays

Auto-suggestion is not available for array objects

Auto-suggestion for array objects that are useful for categorization of resource parameters

Auto-suggestion for array objects that are useful for comparing between array elements

53. Which three OWASP protections are part of Prisma Cloud Web-Application and API Security (WAAS) rule? (Choose three.)

DoS Protection

Local file inclusion

SQL injection

Suspicious binary

Shellshock

54. What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

policy

incident

audit

anomaly

55. Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

single sign-on

SAML

basic authentication

access key

56. What is the maximum number of access keys a user can generate in Prisma Cloud with a System Admin role?

57. What must be created in order to receive notifications about alerts generated when the operator is away from the Prisma Cloud Console?

Alarm rule

Notification rule

Alert rule

Offline alert

58. During an initial deployment of Prisma Cloud Compute, the customer sees vulnerabilities in their environment.

Which statement correctly describes the default vulnerability policy?

It blocks all containers that contain a vulnerability.

It alerts on any container with more than three critical vulnerabilities.

It blocks containers after 30 days if they contain a critical vulnerability.

It alerts on all vulnerabilities, regardless of severity.

59. Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

Host

Container

Functions

Image

60. A customer wants to be notified about port scanning network activities in their environment.

Which policy type detects this behavior?

Network

Port Scan

Anomaly

Config

Page 7 of 7

61. Which three actions are required in order to use the automated method within Azure Cloud to streamline the process of using remediation in the identity and access management (IAM) module? (Choose three.)

Install boto3 & requests library.

Configure IAM Azure remediation script.

Integrate with Azure Service Bus.

Configure IAM AWS remediation script.

Install azure.servicebus & requests library.

62. The security auditors need to ensure that given compliance checks are being run on the host.

Which option is a valid host compliance policy?

Ensure functions are not overly permissive.

Ensure host devices are not directly exposed to containers.

Ensure images are created with a non-root user.

Ensure compliant Docker daemon configuration.

Facebook Twitter LinkedIn Google + Email