PCCSE Prisma Certified Cloud Security Engineer Questions

dumps2024-05-14T10:06:37+08:00

Prisma Certified Cloud Security Engineer PCCSE questions are the best materil for you to pass the test. There are 75-85 questions in real Palo Alto Networks PCCSE exam, and you have 90 minutes to finish the test. The exam format is Multiple Choice, scenarios with graphics and Matching. The available language is English. Free Palo Alto Networks PCCSE exam questions are available below.

Page 1 of 6

1. Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default.

Where should the customer navigate in Console?

Monitor > Compliance

Defend > Compliance

Manage > Compliance

Custom > Compliance

2. Which container scan is constructed correctly?

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 - - container myimage/latest

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 - -details myimage/latest

twistcli images scan -u api -p api --docker-address https://us-west1.cloud.twistlock.com/us-3- 123456789 myimage/latest

3. The development team wants to fail CI jobs where a specific CVE is contained within the image.

How should the development team configure the pipeline or policy to produce this outcome?

Set the specific CVE exception as an option in Jenkins or twistcli.

Set the specific CVE exception as an option in Defender running the scan.

Set the specific CVE exception as an option using the magic string in the Console.

Set the specific CVE exception in Console’s CI policy.

4. Which three types of classifications are available in the Data Security module? (Choose three.)

Personally identifiable information

Malicious IP

Compliance standard

Financial information

Malware

5. A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

set the Container model to manual relearn and set the default runtime rule to block for process protection.

set the Container model to relearn and set the default runtime rule to prevent for process protection.

add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.

choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.

6. Retrieve the Prisma Cloud Console images using ‘docker pull’.

7. Which two statements are true about the differences between build and run config policies? (Choose two.)

Run and Network policies belong to the configuration policy set.

Build and Audit Events policies belong to the configuration policy set.

Run policies monitor resources, and check for potential issues after these cloud resources are deployed.

Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.

Run policies monitor network activities in your environment, and check for potential issues during runtime.

8. A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.

What will be the effect if the security team chooses to Relearn on this image?

The model is deleted, and Defender will relearn for 24 hours.

The anomalies detected will automatically be added to the model.

The model is deleted and returns to the initial learning state.

The model is retained, and any new behavior observed during the new learning period will be added to the existing model.

9. A customer does not want alerts to be generated from network traffic that originates from trusted internal networks.

Which setting should you use to meet this customer’s request?

Trusted Login IP Addresses

Anomaly Trusted List

Trusted Alert IP Addresses

Enterprise Alert Disposition

10. A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps.

Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?

The SecOps lead should investigate the attack using Vulnerability Explorer and Runtime Radar.

The SecOps lead should use Incident Explorer and Compliance Explorer.

The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits.

The SecOps lead should review the vulnerability scans in the CI/CD process to determine blame.

Page 2 of 6

11. A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.

Which two reasons explain this change in alert status? (Choose two.)

user manually changed the alert status.

policy was changed.

resource was deleted.

alert was sent to an external integration.

12. Which three steps are involved in onboarding an account for Data Security? (Choose three.)

Create a read-only role with in-line policies

Create a Cloudtrail with SNS Topic

Enable Flow Logs

Enter the RoleARN and SNSARN

Create a S3 bucket

13. An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.

In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

Which port will twistcli need to use to access the Prisma Compute APIs?

8084

443

8083

8081

14. A customer is reviewing Container audits, and an audit has identified a cryptominer attack.

Which three options could have generated this audit? (Choose three.)

The value of the mined currency exceeds $100.

High CPU usage over time for the container is detected.

Common cryptominer process name was found.

The mined currency is associated with a user token.

Common cryptominer port usage was found.

15. Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

copy the Console address and set the config map for the default namespace.

create a new namespace in Kubernetes called admission-controller.

enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.

copy the admission controller configuration from the Console and apply it to Kubernetes.

16. A Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud.

Which two steps can be performed by the Terraform script? (Choose two.)

enable flow logs for Prisma Cloud.

create the Prisma Cloud role.

enable the required APIs for Prisma Cloud.

publish the flow log to a storage bucket.

17. Which statement about build and run policies is true?

A. Build policies enable you to check for security misconfigurations in the IaC templates.

B. Every type of policy has auto-remediation enabled by default.

C. The four main types of policies are: Audit Events, Build, Network, and Run.

D. Run policies monitor network activities in the environment and check for potential issues during runtime.

18. An administrator sees that a runtime audit has been generated for a host. The audit message is: “Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix- script.stop. Low severity audit, event is automatically added to the runtime model”

Which runtime host policy rule is the root cause for this runtime audit?

Custom rule with specific configuration for file integrity

Custom rule with specific configuration for networking

Default rule that alerts on capabilities

Default rule that alerts on suspicious runtime behavior

19. Which option identifies the Prisma Cloud Compute Edition?

Package installed with APT

Downloadable, self-hosted software

Software-as-a-Service (SaaS)

Plugin to Prisma Cloud

20. Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

Host

Container

Functions

Image

Page 3 of 6

21. The security team wants to protect a web application container from an SQLi attack.

Which type of policy should the administrator create to protect the container?

CNAF

Runtime

Compliance

CNNF

22. An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy “AWS

S3 buckets are accessible to public”.

The policy definition follows:

config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[? (@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist"

Why did this alert get generated?

an event within the cloud account

network traffic to the S3 bucket

configuration of the S3 bucket

anomalous behaviors

23. DRAG DROP

Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)

24. A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment.

Which action needs to be set for “do not use privileged containers”?

Prevent

Alert

Block

Fail

25. Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

The console cannot natively run in an ECS cluster. A onebox deployment should be used.

Download and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition

Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition

Download and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

26. Which options show the steps required to upgrade Console when using projects?

Upgrade all Supervisor Consoles Upgrade Central Console

Upgrade Central Console Upgrade Central Console Defenders

Upgrade Defender Upgrade Central Console Upgrade Supervisor Consoles

Upgrade Central Console Upgrade all Supervisor Consoles

27. A customer has Prisma Cloud Enterprise and host Defenders deployed.

What are two options that allow an administrator to upgrade Defenders? (Choose two.)

with auto-upgrade, the host Defender will auto-upgrade.

auto deploy the Lambda Defender.

click the update button in the web-interface.

generate a new DaemonSet file.

28. Which intensity setting for anomaly alerts is used for the measurement of 100 events over 30 days?

High

Medium

Low

Very High

29. Given this information:

The Console is located at https://prisma-console.mydomain.local The username is: cluster

The password is: password123

The image to scan is: myimage:latest

Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?

twistcli images scan --console-address https://prisma-console.mydomain.local -u cluster -p password123 -- details myimage:latest

twistcli images scan --console-address prisma-console.mydomain.local -u cluster -p password123 - - vulnerability-details myimage:latest

twistcli images scan --address prisma-console.mydomain.local -u cluster -p password123 -- vulnerability- details myimage:latest

twistcli images scan --address https://prisma-console.mydomain.local -u cluster -p password123 -- details myimage:latest

30. The development team wants to block Cross Site Scripting attacks from pods in its environment.

How should the team construct the CNAF policy to protect against this attack?

create a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to “prevent”.

create a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.

create a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.

create a Container CNAF policy, targeted at a specific resource, and they should set “Explicitly allowed inbound IP sources” to the IP address of the pod.

Page 4 of 6

31. The Prisma Cloud administrator has configured a new policy.

Which steps should be used to assign this policy to a compliance standard?

Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

Create the Compliance Standard from Compliance tab, and then select Add to Policy.

Open the Compliance Standards section of the policy, and then save.

Custom policies cannot be added to existing standards.

32. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.

Console Address: $CONSOLE_ADDRESS Websocket Address: $WEBSOCKET_ADDRESS User:

$ADMIN_USER

Which command generates the YAML file for Defender install?

<PLATFORM>/twistcli defender --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $WEBSOCKET_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender YAML kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

<PLATFORM>/twistcli defender export kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

33. Which options show the steps required after upgrade of Console?

Uninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender

Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders

Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable

Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console

34. Create an Alert rule

35. A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company’s AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is currently not using AWS Organizations and will require each account to be onboarded individually.

The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts.

Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

https://api.prismacloud.io/cloud/

https://api.prismacloud.io/account/aws

https://api.prismacloud.io/cloud/aws

https://api.prismacloud.io/accountgroup/aws

36. A security team has a requirement to ensure the environment is scanned for vulnerabilities.

What are three options for configuring vulnerability policies? (Choose three.)

individual actions based on package type

output verbosity for blocked requests

apply policy only when vendor fix is available

individual grace periods for each severity level

customize message on blocked requests

37. The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?

Disable the policy

Set the Alert Disposition to Conservative

Change the Training Threshold to Low

Set Alert Disposition to Aggressive

38. What is the behavior of Defenders when the Console is unreachable during upgrades?

Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.

Defenders will fail closed until the web-socket can be re-established.

Defenders will fail open until the web-socket can be re-established.

Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

39. How are the following categorized?

Backdoor account access Hijacked processes Lateral movement

Port scanning

audits

incidents

admission controllers

models

40. DRAG DROP

An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

In which order should the API calls be used to accomplish this task? (Drag the steps into the correct order from the first step to the last.)

Page 5 of 6

41. Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

single sign-on

SAML

basic authentication

access key

42. Which option shows the steps to install the Console in a Kubernetes Cluster?

Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

43. A customer has a requirement to automatically protect all Lambda functions with runtime protection.

What is the process to automatically protect all the Lambda functions?

Configure a function scan policy from the Defend/Vulnerabilities/Functions page.

Configure serverless radar from the Defend/Compliance/Cloud Platforms page.

Configure a manually embedded Lambda Defender.

Configure a serverless auto-protect rule for the functions.

44. Which statement accurately characterizes SSO Integration on Prisma Cloud?

Prisma Cloud supports IdP initiated SSO, and its SAML endpoint supports the POST and GET methods.

Okta, Azure Active Directory, PingID, and others are supported via SAM

An administrator can configure different Identity Providers (IdP) for all the cloud accounts that Prisma Cloud monitors.

An administrator who needs to access the Prisma Cloud API can use SSO after configuration.

45. DRAG DROP

Match the service on the right that evaluates each exposure type on the left. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)

46. What are two ways to scan container images in Jenkins pipelines? (Choose two.)

twistcli

Jenkins Docker plugin

Compute Jenkins plugin

Compute Azure DevOps plugin

Prisma Cloud Visual Studio Code plugin with Jenkins integration

47. A customer wants to harden its environment from misconfiguration.

Prisma Cloud Compute Compliance enforcement for hosts covers which three options? (Choose three.)

Docker daemon configuration files

Docker daemon configuration

Host cloud provider tags

Host configuration

Hosts without Defender agents

48. A Prisma Cloud administrator is tasked with pulling a report via API. The Prisma Cloud tenant is located on app2.prismacloud.io.

What is the correct API endpoint?

https://api.prismacloud.io

https://api2.eu.prismacloud.io

httsp://api.prismacloud.cn

https://api2.prismacloud.io

49. A customer has Defenders connected to Prisma Cloud Enterprise. The Defenders are deployed as a DaemonSet in OpenShift.

How should the administrator get a report of vulnerabilities on hosts?

Navigate to Monitor > Vulnerabilities > CVE Viewer

Navigate to Defend > Vulnerabilities > VM Images

Navigate to Defend > Vulnerabilities > Hosts

Navigate to Monitor > Vulnerabilities > Hosts

50. DRAG DROP

Order the steps involved in onboarding an AWS Account for use with Data Security feature.

Page 6 of 6

51. A customer has a requirement to scan serverless functions for vulnerabilities.

Which three settings are required to configure serverless scanning? (Choose three.)

Defender Name

Region

Credential

Console Address

Provider

52. You are tasked with configuring a Prisma Cloud build policy for Terraform.

What type of query is necessary to complete this policy?

YAML

JSON

CloudFormation

Terraform

53. You have onboarded a public cloud account into Prisma Cloud Enterprise. Configuration Resource

ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account.

Config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully.

Why are no alerts being generated?

The public cloud account is not associated with an alert notification.

The public cloud account does not have audit trail ingestion enabled.

The public cloud account does not access to configuration resources.

The public cloud account is not associated with an alert rule.

54. The security team wants to target a CNAF policy for specific running Containers.

How should the administrator scope the policy to target the Containers?

scope the policy to Image names.

scope the policy to namespaces.

scope the policy to Defender names.

scope the policy to Host names.

55. The InfoSec team wants to be notified via email each time a Security Group is misconfigured.

Which Prisma Cloud tab should you choose to complete this request?

Notifications

Policies

Alert Rules

Events

56. An administrator has access to a Prisma Cloud Enterprise.

What are the steps to deploy a single container Defender on an ec2 node?

Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.

Execute the curl | bash script on the ec2 node.

Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.

Generate DaemonSet file and apply DaemonSet to the twistlock namespace.

57. A customer wants to turn on Auto Remediation.

Which policy type has the built-in CLI command for remediation?

Anomaly

Audit Event

Network

Config

58. A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying.

How should the customer automate vulnerability scanning for images deployed to Fargate?

Set up a vulnerability scanner on the registry

Embed a Fargate Defender to automatically scan for vulnerabilities

Designate a Fargate Defender to serve a dedicated image scanner

Use Cloud Compliance to identify misconfigured AWS accounts

59. Which container image scan is constructed correctly?

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 --container myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 --container myimage/latest --details

PCCSE Prisma Certified Cloud Security Engineer Questions

PCCSE Prisma Certified Cloud Security Engineer Questions

Share this post

Leave a Reply Cancel reply

Related Posts