PCCSE Dumps Help You Study Objectives

Category:

Comments:

0 Comments

Post Date:

March 30, 2024

By practicing with PCCSE exam-like questions, you can identify areas where you may need to focus your studies. Palo Alto Networks PCCSE dumps can help you create a more targeted study plan and avoid wasting time studying topics you already know well. Taking PCCSE dumps can help you get used to the format and structure of the real exam. PCCSE dumps can help you feel more comfortable and confident on exam day, which can improve your chances of success. Practice Palo Alto Networks PCCSE exam free dumps below.

Page 1 of 8

1. What is the most reliable and extensive source for documentation on Prisma Cloud APIs?

prisma.pan.dev

docs.paloaltonetworks.com

Prisma Cloud Administrator’s Guide

Live Community

2. Which option identifies the Prisma Cloud Compute Edition?

Package installed with APT

Downloadable, self-hosted software

Software-as-a-Service (SaaS)

Plugin to Prisma Cloud

3. A user from an organization is unable to log in to Prisma Cloud Console after having logged in the previous day.

Which area on the Console will provide input on this issue?

SSO

Audit Logs

Users & Groups

Access Control

4. Which three types of classifications are available in the Data Security module? (Choose three.)

Personally identifiable information

Malicious IP

Compliance standard

Financial information

Malware

5. DRAG DROP

Put the steps of integrating Okta with Prisma Cloud in the right order in relation to CIEM or SSO okra integration.

6. A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.

What will be the effect if the security team chooses to Relearn on this image?

The model is deleted, and Defender will relearn for 24 hours.

The anomalies detected will automatically be added to the model.

The model is deleted and returns to the initial learning state.

The model is retained, and any new behavior observed during the new learning period will be added to the existing model.

7. A Prisma Cloud Administrator needs to enable a Registry Scanning for a registry that stores Windows images.

Which of the following statement is correct regarding this process?

They can deploy any type of container defender to scan this registry.

There are Windows host defenders deployed in your environment already.

There are Windows host defenders deployed in your environment already. Therefore, they do not need to deploy any additional defenders.

A defender is not required to configure this type of registry scan.

8. A customer has a requirement to scan serverless functions for vulnerabilities.

Which three settings are required to configure serverless scanning? (Choose three.)

Defender Name

Region

Credential

Console Address

Provider

9. Which two bot categories belong to unknown bots under Web-Application and API Security (WAAS) bot protection? (Choose two.)

News bots

Search engine crawlers

Web scrapers

HTTP libraries

10. An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds.

What does the administrator need to configure?

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

Page 2 of 8

11. What are the two ways to scope a CI policy for image scanning? (Choose two.)

container name

image name

hostname

image labels

12. Retrieve the Prisma Cloud Console images using ‘docker pull’.

13. Given the following JSON query:

$.resource[*].aws_s3_bucket exists

Which tab is the correct place to add the JSON query when creating a Config policy?

Details

Compliance Standards

Remediation

Build Your Rule (Run tab)

Build Your Rule (Build tab)

14. Which IAM Azure RQL query would correctly generate an output to view users who have sufficient permissions to create security groups within Azure AD and create applications?

config where api.name = ‘azure-active-directory-authorization-policy’ AND son.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true

config from cloud.resource where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions exists

config from network where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is false and defaultUserRolePermissions.allowedToCreateApps is true

config from cloud.resource where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true

15. An administrator sees that a runtime audit has been generated for a container.

The audit message is: “/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr”

Which protection in the runtime rule would cause this audit?

Networking

File systems

Processes

Container

16. The development team is building pods to host a web front end, and they want to protect these pods with an application firewall.

Which type of policy should be created to protect this pod from Layer7 attacks?

The development team should create a WAAS rule for the host where these pods will be running.

The development team should create a WAAS rule targeted at all resources on the host.

The development team should create a runtime policy with networking protections.

The development team should create a WAAS rule targeted at the image name of the pods.

17. What must be created in order to receive notifications about alerts generated when the operator is away from the Prisma Cloud Console?

Alarm rule

Notification rule

Alert rule

Offline alert

18. When would a policy apply if the policy is set under Defend > Vulnerability > Images > Deployed?

when a serverless repository is scanned

when a Container is started form an Image

when the Image is built and when a Container is started form an Image

when the Image is built

19. Given the following information, which twistcli command should be run if an administrator were to exec into a running container and scan it from within using an access token for authentication?

• Console is located at https://prisma-console.mydomain.local

• Token is: TOKEN_VALUE

• Report ID is: REPORTJD

• Container image running is: myimage:latest

twistcli images scan --address https://prisma-console.mydomain.local ―token TOKENVALUE ― containerized ―details myimage:latest

twistcli images scan ―console-address https://prisma-console.mydomain.local ―auth-token MY_TOKEN ―local-scan ―details myimage:latest

twistcli images scan ―address https://prisma-console.mydomain.local ―token TOKEN_VALUE ― containerized --details REPORT_ID

twistcli images scan --console-address https://prisma-console.mydomain.local --auth-token TOKEN_VALUE ―containerized ―vulnerability-details REPORT_ID

20. A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.

Which two reasons explain this change in alert status? (Choose two.)

user manually changed the alert status.

policy was changed.

resource was deleted.

alert was sent to an external integration.

Page 3 of 8

21. What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

policy

incident

audit

anomaly

22. Which role must be assigned to DevOps users who need access to deploy Container and Host

Defenders in Compute?

Cloud Provisioning Admin

Build and Deploy Security

System Admin

Developer

23. The exclamation mark on the resource explorer page would represent?

resource has been deleted

the resource was modified recently

resource has alerts

resource has compliance violation

24. Which three types of runtime rules can be created? (Choose three.)

Processes

Network-outgoing

Filesystem

Kubernetes-audit

Waas-request

25. Which two attributes of policies can be fetched using API? (Choose two.)

policy label

policy signature

policy mode

policy violation

26. What are the three states of the Container Runtime Model? (Choose three.)

Initiating

Learning

Active

Running

Archived

27. What is the default namespace created by Defender DaemonSet during deployment?

Redlock

Defender

Twistlock

Default

28. DRAG DROP

What is the order of steps in a Jenkins pipeline scan? (Drag the steps into the correct order of occurrence, from the first step to the last.)

29. Which two filters are available in the SecOps dashboard? (Choose two.)

Time range

Account Groups

Service Name

Cloud Region

30. Which three fields are mandatory when authenticating the Prisma Cloud plugin in the IntelliJ application? (Choose three.)

Secret Key

Prisma Cloud API URL

Tags

Access Key

Asset Name

Page 4 of 8

31. DRAG DROP

You wish to create a custom policy with build and run subtypes.

Match the query types for each example. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)

32. What is required for Prisma Cloud to successfully execute auto-remediation commands?

Read access to the cloud platform

Write access to the cloud platform

Access to the cloud platform only for Azure

Prisma Cloud requires no access to the cloud platform

33. Which serverless cloud provider is covered by the "overly permissive service access" compliance check?

Alibaba

Azure

Amazon Web Services (AWS)

Google Cloud Platform (GCP)

34. Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

Visibility, Compliance, Governance, and Threat Detection and Response

Network, Anomaly, and Audit Event

Visibility, Security, and Compliance

Foundations, Advanced, and Optimize

35. What should be used to associate Prisma Cloud policies with compliance frameworks?

Compliance

Custom compliance

Alert rules

Policies

36. A customer wants to monitor its Amazon Web Services (AWS) accounts via Prisma Cloud, but only needs the resource configuration to be monitored at present.

Which two pieces of information are needed to onboard this account? (Choose two.)

External ID

CloudTrail

Active Directory ID

RoleARN

37. Which two required request headers interface with Prisma Cloud API? (Choose two.)

Content-type:application/json

x-redlock-auth

>x-redlock-request-id

Content-type:application/xml

38. How is the scope of each rule determined in the Prisma Cloud Compute host runtime policy?

By the collection assigned to that rule

By the target workload

By the order in which it is created

By the type of network traffic it controls

39. A customer has a development environment with 50 connected Defenders. A maintenance window is set for Monday to upgrade 30 stand-alone Defenders in the development environment, but there is no maintenance window available until Sunday to upgrade the remaining 20 stand-alone Defenders.

Which recommended action manages this situation?

Go to Manage > Defender > Manage, then click Defenders, and use the Scheduler to choose which Defenders will be automatically upgraded during the maintenance window.

Find a maintenance window that is suitable to upgrade all stand-alone Defenders in the development environment.

Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window.

Open a support case with Palo Alto Networks to arrange an automatic upgrade.

40. Prisma Cloud cannot integrate which of the following secrets managers?

IBM Secret Manager

AzureKey Vault

HashiCorp Vault

AWS Secret Manager

Page 5 of 8

41. Retrieve the Prisma Cloud Console images using "docker pull."

42. Which policy type provides information about connections from suspicious IPs in a customer database?

Anomaly

Threat detection

Network

AutoFocus

43. What is the maximum number of access keys a user can generate in Prisma Cloud with a System Admin role?

44. Which two offerings will scan container images in Jenkins pipelines? (Choose two.)

Compute Azure DevOps plugin

Prisma Cloud Visual Studio Code plugin with Jenkins integration

Jenkins Docker plugin

Twistcli

Compute Jenkins plugin

45. An administrator needs to detect and alert on any activities performed by a root account.

Which policy type should be used?

config-run

config-build

network

audit event

46. A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment.

Which action needs to be set for “do not use privileged containers”?

Prevent

Alert

Block

Fail

47. A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time.

What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)

manual installation of the latest twistcli tool prior to the rolling upgrade

all Defenders set in read-only mode before execution of the rolling upgrade

a second location where you can install the Console

additional workload licenses are required to perform the rolling upgrade

an existing Console at version n-1

48. Console is running in a Kubernetes cluster, and Defenders need to be deployed on nodes within this cluster.

How should the Defenders in Kubernetes be deployed using the default Console service name?

From the deployment page in Console, choose "twistlock-console" for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

From the deployment page, configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes.

From the deployment page in Console, choose "twistlock-console" for Console identifier and run the "curl | bash" script on the master Kubernetes node.

From the deployment page in Console, choose "pod name" for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace.

49. What improves product operationalization by adding visibility into feature utilization and missed opportunities?

Adoption Advisor

Alarm Advisor

Alert Center

Alarm Center

50. An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.

In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.

Which port will twistcli need to use to access the Prisma Compute APIs?

8084

443

8083

8081

Page 6 of 8

51. Which two fields are required to configure SSO in Prisma Cloud? (Choose two.)

Prisma Cloud Access SAML URL

Identity Provider Issuer

Certificate

Identity Provider Logout URL

52. Given the following RQL:

Which audit event snippet is identified by the RQL?

A)

Option A

Option B

Option C

Option D

53. A Prisma Cloud Administrator onboarded an AWS cloud account with agentless scanning enabled successfully to Prisma Cloud.

Which item requires deploying defenders to be able to inspect the risk on the onboarded AWS account?

Host compliances risks

Container runtime risks

Container vulnerability risks

Host vulnerability risks

54. Which two roles have access to view the Prisma Cloud policies? (Choose two.)

Build AND Deploy Security

Auditor

Dev SecOps

Defender Manager

55. The InfoSec team wants to be notified via email each time a Security Group is misconfigured.

Which Prisma Cloud tab should you choose to complete this request?

Notifications

Policies

Alert Rules

Events

56. In Prisma Cloud Software Release 22.06 (Kepler), which Registry type is added?

Azure Container Registry

Google Artifact Registry

IBM Cloud Container Registry

Sonatype Nexus

57. A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps.

Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?

The SecOps lead should investigate the attack using Vulnerability Explorer and Runtime Radar.

The SecOps lead should use Incident Explorer and Compliance Explorer.

The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits.

The SecOps lead should review the vulnerability scans in the CI/CD process to determine blame.

58. Which field is required during the creation of a custom config query?

resource status

api.name

finding.type

cloud.type

59. Which two integrations enable ingesting host findings to generate alerts? (Choose two.)

Splunk

Tenable

JIRA

Qualys

60. A customer has a requirement to automatically protect all Lambda functions with runtime protection.

What is the process to automatically protect all the Lambda functions?

Configure a function scan policy from the Defend/Vulnerabilities/Functions page.

Configure serverless radar from the Defend/Compliance/Cloud Platforms page.

Configure a manually embedded Lambda Defender.

Configure a serverless auto-protect rule for the functions.

Page 7 of 8

61. DRAG DROP

Match the service on the right that evaluates each exposure type on the left. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)

62. A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

set the Container model to manual relearn and set the default runtime rule to block for process protection.

set the Container model to relearn and set the default runtime rule to prevent for process protection.

add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.

choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.

63. Taking which action will automatically enable all severity levels?

Navigate to Settings > Enterprise Settings and enable all severity levels in the alarm center.

Navigate to Policies > Settings and enable all severity levels in the alarm center.

Navigate to Settings > Enterprise Settings and ensure all severity levels are checked under "auto-enable default policies.

Navigate to Policies > Settings and ensure all severity levels are checked under "auto-enable default policies.

64. Which port should a security team use to pull data from Console’s API?

8084

8083

65. A customer has serverless functions that are deployed in multiple clouds.

Which serverless cloud provider is covered be “overly permissive service access” compliance check?

Alibaba

GCP

AWS

Azure

66. Which type of query is used for scanning Infrastructure as Code (laC) templates?

API

XML

JSON

RQL

67. What is the purpose of Incident Explorer in Prisma Cloud Compute under the "Monitor" section?

To sort through large amounts of audit data manually in order to identify developing attacks

To store large amounts of forensic data on the host where Console runs to enable a more rapid and effective response to incidents

To correlate individual events to identify potential attacks and provide a sequence of process, file system, and network events for a comprehensive view of an incident

To identify and suppress all audit events generated by the defender *

68. Which three AWS policy types and identities are used to calculate the net effective permissions? (Choose three).

AWS service control policies (SCPs)

AWS IAM group

AWS IAM role

AWS IAM User

AWS IAM tag policy

69. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.

Console Address: $CONSOLE_ADDRESS Websocket Address: $WEBSOCKET_ADDRESS User:

$ADMIN_USER

Which command generates the YAML file for Defender install?

/twistcli defender --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

/twistcli defender export kubernetes --address $WEBSOCKET_ADDRESS --user $ADMIN_USER --cluster-address $CONSOLE_ADDRESS

/twistcli defender YAML kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

/twistcli defender export kubernetes --address $CONSOLE_ADDRESS --user $ADMIN_USER --cluster-address $WEBSOCKET_ADDRESS

70. How does assigning an account group to an administrative user on Prisma Cloud help restrict access to resources?

It restricts access only to certain types of resources within the cloud account.

It restricts access to all resources and data within the cloud account.

It restricts access only to the resources and data that pertains to the cloud account(s) within an account group.

It does not restrict access to any resources within the cloud account.

Page 8 of 8

71. Prisma Cloud supports sending audit event records to which three targets? (Choose three.)

SNMP Traps

Stdout

Netflow

Prometheus

Syslog

72. The Prisma Cloud administrator has configured a new policy.

Which steps should be used to assign this policy to a compliance standard?

Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

Create the Compliance Standard from Compliance tab, and then select Add to Policy.

Open the Compliance Standards section of the policy, and then save.

Custom policies cannot be added to existing standards.

73. What are two alarm types that are registered after alarms are enabled? (Choose two.)

Onboarded Cloud Accounts status

Resource status

Compute resources

External integrations status

74. What is the frequency to create a compliance report? (Choose two.)

Weekly

One time

Monthly

Recurring

75. DRAG DROP

An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

In which order should the API calls be used to accomplish this task? (Drag the steps into the correct order from the first step to the last.)

76. DRAG DROP

Move the steps to the correct order to set up and execute a serverless scan using AWS DevOps.

TAGS:

PCCSE, PCCSE exam dumps

Notify of

Label

Name*

Email*

Website

Label

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

Posts

PCNSE Dumps Help You Study Objectives

By practicing with PCNSE exam-like questions, you can identify areas where you may need to focus your studies. Palo Alto...

Improve Your Knowledge with PCNSA Exam Dumps

Practicing with PCNSA questions can help you identify areas where you need to improve your knowledge. By answering PCNSA questions...

Get PCCSE Dumps Full Version

Q&As: 263
Versions: PDF and Software Download Now

About Dumpsinfo

Dumpsinfo is a good platform providing the latest exam information and dumps questions for all IT certification exams. You can study all the latest exam dumps questions online.

[email protected]

Mon - Sat 9:00am - 6:00pm