2023 Updated Training Material for PCCSE Exam

dumps2023-02-28T01:26:51+08:00

Prisma Certified Cloud Security Engineer PCCSE exam training material has been updated, which is helpful in the preparation. The PCCSE exam updated training material is designed to assess the candidate’s knowledge of cloud security technologies and their ability to implement and manage security solutions in cloud environments. The PCCSE certification is recognized worldwide, and it is a valuable asset for professionals looking to advance their careers in cloud security. With our updated PCCSE exam training material, you can save much time in passing the PCCSE test. Free updated Palo Alto Networks PCCSE exam training material is below.

Page 1 of 5

1. Which three steps are involved in onboarding an account for Data Security? (Choose three.)

Create a read-only role with in-line policies

Create a Cloudtrail with SNS Topic

Enable Flow Logs

Enter the RoleARN and SNSARN

Create a S3 bucket

2. An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds.

What does the administrator need to configure?

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

3. The security team wants to enable the “block” option under compliance checks on the host.

What effect will this option have if it violates the compliance check?

The host will be taken offline.

Additional hosts will be prevented form starting.

Containers on a host will be stopped.

No containers will be allowed to start on that host.

4. Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

Host

Container

Functions

Image

5. A security team has a requirement to ensure the environment is scanned for vulnerabilities.

What are three options for configuring vulnerability policies? (Choose three.)

individual actions based on package type

output verbosity for blocked requests

apply policy only when vendor fix is available

individual grace periods for each severity level

customize message on blocked requests

6. The development team wants to fail CI jobs where a specific CVE is contained within the image.

How should the development team configure the pipeline or policy to produce this outcome?

Set the specific CVE exception as an option in Jenkins or twistcli.

Set the specific CVE exception as an option in Defender running the scan.

Set the specific CVE exception as an option using the magic string in the Console.

Set the specific CVE exception in Console’s CI policy.

7. A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company’s AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is currently not using AWS Organizations and will require each account to be onboarded individually.

The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts.

Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

https://api.prismacloud.io/cloud/

https://api.prismacloud.io/account/aws

https://api.prismacloud.io/cloud/aws

https://api.prismacloud.io/accountgroup/aws

8. A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80.

Which port should the team specify in the CNAF rule to protect the application?

443

8080

8888

9. The compliance team needs to associate Prisma Cloud policies with compliance frameworks.

Which option should the team select to perform this task?

Custom Compliance

Policies

Compliance

Alert Rules

10. An administrator for Prisma Cloud needs to obtain a graphical view to monitor all connections, including connections across hosts and connections to any configured network objects.

Which setting does the administrator enable or configure to accomplish this task?

ADEM

WAAS Analytics

Telemetry

Cloud Native Network Firewall

Host Insight

Page 2 of 5

11. Which two integrations enable ingesting host findings to generate alerts? (Choose two.)

Splunk

Tenable

JIRA

Qualys

12. On which cloud service providers can you receive new API release information for Prisma Cloud?

AWS, Azure, GCP, Oracle, IBM

AWS, Azure, GCP, Oracle, Alibaba

AWS, Azure, GCP, IBM

AWS, Azure, GCP, IBM, Alibaba

13. Which alert deposition severity must be chosen to generate low and high severity alerts in the Anomaly settings when user wants to report on an unknown browser and OS, impossible time travel, or both due to account hijacking attempts?

High

Aggressive

Moderate

Conservative

14. You are tasked with configuring a Prisma Cloud build policy for Terraform.

What type of query is necessary to complete this policy?

YAML

JSON

CloudFormation

Terraform

15. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.

Console Address: $CONSOLE_ADDRESS Websocket Address:

$WEBSOCKET_ADDRESS User: $ADMIN_USER

Which command generates the YAML file for Defender install?

<PLATFORM>/twistcli defender --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $WEBSOCKET_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender YAML kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

16. A customer has a requirement to restrict any container from resolving the name www.evil-url.com.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name in the Container policy and set the policy effect to alert.

Set www.evil-url.com as a blocklisted DNS name in the default Container runtime policy, and set the effect to block.

Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name, and set the effect to prevent.

Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.

17. What is the default namespace created by Defender DaemonSet during deployment?

Redlock

Defender

Twistlock

Default

18. The security team wants to protect a web application container from an SQLi attack.

Which type of policy should the administrator create to protect the container?

CNAF

Runtime

Compliance

CNNF

19. Which of the following is displayed in the asset inventory?

EC2 instances

Asset tags

SSO users

Federated users

20. Which RQL query type is invalid?

Event

IAM

Incident

Config

Page 3 of 5

21. Create an Alert rule

22. Which policy type in Prisma Cloud can protect against malware?

Data

Config

Network

Event

23. What is the behavior of Defenders when the Console is unreachable during upgrades?

Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.

Defenders will fail closed until the web-socket can be re-established.

Defenders will fail open until the web-socket can be re-established.

Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

24. Given the following JSON query:

$.resource[*].aws_s3_bucket exists

Which tab is the correct place to add the JSON query when creating a Config policy?

Details

Compliance Standards

Remediation

Build Your Rule (Run tab)

Build Your Rule (Build tab)

25. An administrator has a requirement to ingest all Console and Defender logs to Splunk.

Which option will satisfy this requirement in Prisma Cloud Compute?

Enable the API settings for logging.

Enable the CSV export in the Console.

Enable the syslog option in the Console

Enable the Splunk option in the Console.

26. What is an example of an outbound notification within Prisma Cloud?

AWS Inspector

Qualys

Tenable

PagerDuty

27. A customer wants to scan a serverless function as part of a build process.

Which twistcli command can be used to scan serverless functions?

twistcli function scan <SERVERLESS_FUNCTIO

ZIP>

twistcli scan serverless <SERVERLESS_FUNCTIO

ZIP>

twistcli serverless AWS <SERVERLESS_FUNCTIO

ZIP>

twiscli serverless scan <SERVERLESS_FUNCTIO

ZIP>

28. DRAG DROP

Move the steps to the correct order to set up and execute a serverless scan using AWS DevOps.

29. A customer has Prisma Cloud Enterprise and host Defenders deployed.

What are two options that allow an administrator to upgrade Defenders? (Choose two.)

with auto-upgrade, the host Defender will auto-upgrade.

auto deploy the Lambda Defender.

click the update button in the web-interface.

generate a new DaemonSet file.

30. Anomaly policy uses which two logs to identify unusual network and user activity? (Choose two.)

Network flow

Audit

Traffic

Users

Page 4 of 5

31. What is the function of the external ID when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud?

It is a unique identifier needed only when Monitor & Protect mode is selected.

It is the resource name for the Prisma Cloud Role.

It is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.

It is the default name of the PrismaCloudApp stack.

32. Which options show the steps required to upgrade Console when using projects?

Upgrade all Supervisor Consoles Upgrade Central Console

Upgrade Central Console Upgrade Central Console Defenders

Upgrade Defender Upgrade Central Console Upgrade Supervisor Consoles

Upgrade Central Console Upgrade all Supervisor Consoles

33. DRAG DROP

Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)

34. An administrator has access to a Prisma Cloud Enterprise.

What are the steps to deploy a single container Defender on an ec2 node?

Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.

Execute the curl | bash script on the ec2 node.

Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.

Generate DaemonSet file and apply DaemonSet to the twistlock namespace.

35. DRAG DROP

An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.

In which order will the APIs be executed for this service? (Drag the steps into the correct order of occurrence, from the first step to the last.)

36. When configuring SSO how many IdP providers can be enabled for all the cloud accounts monitored by Prisma Cloud?

37. Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.

Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.

Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment.

Let Defenders automatically upgrade.

38. Which container image scan is constructed correctly?

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest --details

39. The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?

Disable the policy

Set the Alert Disposition to Conservative

Change the Training Threshold to Low

Set Alert Disposition to Aggressive

40. Which two required request headers interface with Prisma Cloud API? (Choose two.)

Content-type:application/json

x-redlock-auth

>x-redlock-request-id

Content-type:application/xml

Page 5 of 5

41. Which three OWASP protections are part of Prisma Cloud Web-Application and API Security (WAAS) rule? (Choose three.)

DoS Protection

Local file inclusion

SQL injection

Suspicious binary

Shellshock

42. Web-Application and API Security (WAAS) provides protection for which two protocols? (Choose two.)

HTTP

SSH

Tomcat Web Connector via AJP

TLS

43. DRAG DROP

You wish to create a custom policy with build and run subtypes. Match the query types for each example.

(Select your answer from the pull-down list. Answers may be used more than once or not at all.)

44. The administrator wants to review the Console audit logs from within the Console.

Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

Navigate to Monitor > Events > Host Log Inspection

The audit logs can be viewed only externally to the Console

Navigate to Manage > Defenders > View Logs

Navigate to Manage > View Logs > History

45. Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

Visibility, Compliance, Governance, and Threat Detection and Response

Network, Anomaly, and Audit Event

Visibility, Security, and Compliance

Foundations, Advanced, and Optimize

46. Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

The console cannot natively run in an ECS cluster. A onebox deployment should be used.

Download and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition

Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition

Download and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

47. Which option shows the steps to install the Console in a Kubernetes Cluster?

Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

48. Which two actions are required in order to use the automated method within Amazon Web Services (AWS) Cloud to streamline the process of using remediation in the identity and access management (IAM) module? (Choose two.)

Install boto3 & requests library.

Configure IAM Azure remediation script.

Integrate with Azure Service Bus.

Configure IAM AWS remediation script.

2023 Updated Training Material for PCCSE Exam

2023 Updated Training Material for PCCSE Exam

Share this post

Leave a Reply Cancel reply

Related Posts