Question 1

In Prisma Cloud for Azure Net Effective Permissions Calculation, the following Azure permission levels are supported by which three permissions? (Choose three).

Accepted Answer

Explanation: https://docs.prismacloud.io/en/classic/cspm-admin-guide/prisma-cloud-iam-security/context-usedto-calculate-effective-permissions

Question 2

Which container image scan is constructed correctly?

Accepted Answer

B

Explanation: The correct construction for scanning a container image using the TwistCLI tool in Prisma Cloud is option B. This command specifies the address of the Prisma Cloud Console and the image to be scanned, including its tag. The TwistCLI tool is part of Prisma Cloud's capabilities to integrate security into the CI/CD pipeline, allowing for the scanning of images for vulnerabilities as part of the build process, thus ensuring that only secure images are deployed​​.

Question 3

Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default. Where should the customer navigate in Console?

Accepted Answer

B

Explanation: Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/compliance/ manage_compliance.html In the context of Prisma Cloud by Palo Alto Networks, the correct navigation to identify alerted compliance checks set by default is under the "Defend" section, specifically at "Defend > Compliance." This section is designed to allow users to configure and manage compliance policies and rules, monitor compliance statuses, and review alerts related to compliance violations. The "Defend" section is tailored for setting up defenses, including compliance standards, against potential security risks within the cloud environment, making it the logical location for managing and reviewing compliance-related alerts and settings.

Question 4

A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

Accepted Answer

Explanation: In the case of identifying a cryptominer attack through container audits, the options that could have generated this audit include B. High CPU usage over time for the container is detected, which is a common indicator of cryptomining activity as it consumes significant computational resources, C. Common cryptominer process name was found, which directly indicates the presence of cryptomining based on known malicious processes, and E. Common cryptominer port usage was found, suggesting cryptomining activity based on network behavior typical of such attacks.

Question 5

Which statement about build and run policies is true?

Accepted Answer

A

Explanation: A true statement about build and run policies is A. Build policies enable you to check for security misconfigurations in the IaC templates. This capability is crucial for identifying potential security issues early in the development process, allowing for proactive mitigation before deployment, thereby enhancing the overall security posture of the applications and infrastructure being developed.

Question 6

The development team wants to fail CI jobs where a specific CVE is contained within the image. How should the development team configure the pipeline or policy to produce this outcome?

Accepted Answer

D

Explanation: Reference tech docs: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/continuous_integration/set_policy_ci_plugins.html Vulnerability rules that target the build tool can allow specific vulnerabilities by creating an exception and setting the effect to 'ignore'. Block them by creating an exception and setting hte effect to 'fail'. For example, you could create a vulnerability rule that explicitly allows CVE-2018-1234 to suppress warnings in the scan results. To fail CI jobs based on a specific CVE contained within an image, the development team should configure the policy within Prisma Cloud's Console, specifically within the Continuous Integration (CI) policy settings. By setting a specific CVE exception in the CI policy, the team can define criteria that will cause the CI process to fail if the specified CVE is detected in the scanned image. This approach allows for granular control over the build process, ensuring that images with known vulnerabilities are not promoted through the CI/CD pipeline, thereby maintaining the security posture of the deployed applications. This method is in line with best practices for integrating security into the CI/CD process, allowing for automated enforcement of security standards directly within the development pipeline. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMkpCAE&lang=e n_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDe tail

Question 7

Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

Accepted Answer

D

Explanation: Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-computeedition- admin/install/install_amazon_ecs.html To install the Console in an Amazon ECS Cluster, the steps involve downloading and extracting the release tarball, which contains the necessary files for the Console. Then, an Amazon Elastic File System (EFS) should be created and mounted to each node in the ECS cluster to provide shared storage for Console data. Following this, a Console task definition needs to be created in ECS, which defines how the Console container should run. Finally, this task definition is deployed to the ECS cluster to start the Console.

Question 8

A customer wants to scan a serverless function as part of a build process. Which twistcli command can be used to scan serverless functions?

Accepted Answer

D

Explanation: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/vulnerability_management/serverless_functions You can also use the twistcli command line utility to scan your serverless functions. First download your serverless function as a ZIP file, then run: $ twistcli serverless scan

Question 9

Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

Accepted Answer

D

Explanation: To authenticate to Prisma Cloud Enterprise programmatically, the use of an access key is the most suitable method among the given options. Access keys, typically consisting of an Access Key ID and Secret Access Key, are used for programmatic calls to the Prisma Cloud API. This method enables secure, authenticated API requests to Prisma Cloud services without requiring manual user intervention, which is essential for automation and integration with CI/CD pipelines. Reference to the use of access keys for programmatic access can often be found in the API documentation of cloud security platforms like Prisma Cloud. While specific documentation from Prisma Cloud is not directly quoted here, the general practice across cloud services (AWS, Azure, GCP) supports the use of access keys for API authentication, making it a verified approach for Prisma Cloud as well. Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/getstarted-with- prisma-cloud/access-the-prisma-cloud-api.html

Question 10

A business unit has acquired a company that has a very large AWS account footprint. The plan is to
immediately start onboarding the new company’s AWS accounts into Prisma Cloud Enterprise tenant
immediately. The current company is currently not using AWS Organizations and will require each
account to be onboarded individually.
The business unit has decided to cover the scope of this action and determined that a script should
be written to onboard each of these accounts with general settings to gain immediate posture
visibility across the accounts.
Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

Accepted Answer

C

Explanation: To add AWS accounts to the Prisma Cloud Enterprise tenant, the correct API endpoint is option C: https://api.prismacloud.io/cloud/aws. This endpoint is specifically designed for integrating cloud accounts with Prisma Cloud, enabling centralized visibility and security posture management across multiple cloud environments. By using this API endpoint, each AWS account can be individually onboarded to the Prisma Cloud platform, allowing for immediate posture visibility and consistent security policy enforcement across the newly acquired company's extensive AWS footprint. This process aligns with Prisma Cloud's capabilities for multi-cloud security and compliance management, ensuring that the onboarding of cloud accounts is both efficient and aligned with the platform's best practices for cloud security.

Question 11

A user from an organization is unable to log in to Prisma Cloud Console after having logged in the previous day. Which area on the Console will provide input on this issue?

Accepted Answer

B

Explanation: In the event a user is unable to log in to the Prisma Cloud Console, Audit Logs serve as a critical area for investigating the issue. Audit Logs provide a detailed record of activities, including login attempts, within the Prisma Cloud environment. By examining the Audit Logs, administrators can identify failed login attempts, understand the reasons behind login failures (e.g., incorrect credentials, account lockouts, or access policy changes), and take appropriate actions to resolve the login issues, ensuring users can access the console as expected.

Question 12

Which data storage type is supported by Prisma Cloud Data Security?

Accepted Answer

B

Explanation: Prisma Cloud Data Security supports various data storage types, including AWS S3 buckets (B). AWS S3 (Simple Storage Service) is a widely used object storage service that offers scalability, data availability, security, and performance. Prisma Cloud's ability to secure S3 buckets is crucial for organizations leveraging AWS for storage needs, as it ensures that data stored within these buckets is protected against unauthorized access, data breaches, and other security threats. Prisma Cloud provides comprehensive visibility into the data stored in S3 buckets, enabling data classification, compliance monitoring, and threat detection to safeguard sensitive data effectively.

Question 13

Which of the below actions would indicate – “The timestamp on the compliance dashboard?

Accepted Answer

D

Explanation: The timestamp on the compliance dashboard in a cloud security context typically reflects the point in time when data from various sources is collected, processed, and then consolidated to present the compliance status or results. This aggregation process involves compiling data from multiple scans, logs, and other compliance-related information to provide a comprehensive overview of the current compliance posture. Therefore, the timestamp usually indicates when this aggregation was completed, ensuring that users are viewing the most up-to-date and relevant compliance information based on the latest data compilation.

Question 14

You are tasked with configuring a Prisma Cloud build policy for Terraform. What type of query is necessary to complete this policy?

Accepted Answer

B

Explanation: "you can also create configuration policies to scan your Infrastructure as Code (IaC) templates that are used to deploy cloud resources. The policies used for scanning IaC templates use a JSON query instead of RQL." https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloudpolicies/create-a-policy

Question 15

Which three public cloud providers are supported for VM image scanning? (Choose three.)

Accepted Answer

A, D, E

Explanation: VM image scanning is a critical component of cloud security, allowing organizations to identify vulnerabilities within virtual machine images before deployment. The three major public cloud providers supported for VM image scanning are Google Cloud Platform (GCP), Amazon Web Services (AWS), and Microsoft Azure. These platforms offer extensive infrastructure services and are commonly used in various industries, making them primary targets for VM image scanning integration. GCP, AWS, and Azure each provide capabilities to store, manage, and deploy VM images through their respective services such as Google Compute Engine, AWS EC2, and Azure Virtual Machines. By integrating VM image scanning with these services, organizations can ensure that their VM images are free from known vulnerabilities and comply with security best practices before being deployed in the cloud environment. This approach to VM image scanning is consistent with Prisma Cloud's comprehensive security strategy, which emphasizes the importance of securing cloud workloads across the entire development lifecycle. By supporting VM image scanning across GCP, AWS, and Azure, Prisma Cloud enables organizations to maintain a consistent security posture across multiple cloud environments, mitigating the risk of deploying vulnerable or misconfigured VM images that could lead to security breaches. Reference: Documentation from GCP, AWS, and Azure on VM management and security best practices provide foundational knowledge for understanding how VM image scanning integrates with each cloud provider's infrastructure services. Prisma Cloud's documentation and best practices guides offer insights into how VM image scanning is implemented within its security platform to protect cloud workloads across GCP, AWS, and Azure.

Free Palo Alto Networks PCCSE Actual Exam Questions