Updated Palo Alto Networks PCCSE Actual Questions

dumps2022-04-11T02:41:38+08:00

Palo Alto Networks PCCSE actual questions have been updated in April. From the feedback of other PCCSE candidates, PCCSE exam is much difficult to pass. Study the online updated Palo Alto Networks PCCSE exam questions can improve your passing rate. Free updated Palo Alto Networks PCCSE exam actual questions are below.

Page 1 of 3

1. An administrator needs to detect and alert on any activities performed by a root account.

Which policy type should be used?

config-run

config-build

network

audit event

2. The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?

Disable the policy

Set the Alert Disposition to Conservative

Change the Training Threshold to Low

Set Alert Disposition to Aggressive

3. A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.

What will be the effect if the security team chooses to Relearn on this image?

The model is deleted, and Defender will relearn for 24 hours.

The anomalies detected will automatically be added to the model.

The model is deleted and returns to the initial learning state.

The model is retained, and any new behavior observed during the new learning period will be added to the existing model.

4. A security team has been asked to create a custom policy.

Which two methods can the team use to accomplish this goal? (Choose two.)

add a new policy

clone an existing policy

disable an out-of-the-box policy

edit the query in the out-of-the-box policy

5. Which two IDE plugins are supported by Prisma Cloud as part of its DevOps Security? (Choose two.)

BitBucket

Visual Studio Code

CircleCI

IntelliJ

6. Which container image scan is constructed correctly?

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest

twistcli images scan --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest --details

7. DRAG DROP

What is the order of steps in a Jenkins pipeline scan?

(Drag the steps into the correct order of occurrence, from the first step to the last.)

8. The administrator wants to review the Console audit logs from within the Console.

Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

Navigate to Monitor > Events > Host Log Inspection

The audit logs can be viewed only externally to the Console

Navigate to Manage > Defenders > View Logs

Navigate to Manage > View Logs > History

9. A customer is reviewing Container audits, and an audit has identified a cryptominer attack .

Which three options could have generated this audit? (Choose three.)

The value of the mined currency exceeds $100.

High CPU usage over time for the container is detected.

Common cryptominer process name was found.

The mined currency is associated with a user token.

Common cryptominer port usage was found.

10. DRAG DROP

Match the service on the right that evaluates each exposure type on the left.

(Select your answer from the pull-down list. Answers may be used more than once or not at all.)

Page 2 of 3

11. A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time.

What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)

manual installation of the latest twistcli tool prior to the rolling upgrade

all Defenders set in read-only mode before execution of the rolling upgrade

a second location where you can install the Console

additional workload licenses are required to perform the rolling upgrade

an existing Console at version n-1

12. An administrator sees that a runtime audit has been generated for a Container. The audit message is “DNS resolution of suspicious name wikipedia.com. type A”.

Why would this message appear as an audit?

The DNS was not learned as part of the Container model or added to the DNS allow list.

This is a DNS known to be a source of malware.

The process calling out to this domain was not part of the Container model.

The Layer7 firewall detected this as anomalous behavior.

13. DRAG DROP

What is the order of steps to create a custom network policy? (Drag the steps into the correct order of occurrence, from the first step to the last.)

14. Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default.

Where should the customer navigate in Console?

Monitor > Compliance

Defend > Compliance

Manage > Compliance

Custom > Compliance

15. Which two CI/CD plugins are supported by Prisma Cloud as part of its DevOps Security? (Choose two.).

BitBucket

Visual Studio Code

CircleCI

IntelliJ

16. What are two ways to scan container images in Jenkins pipelines? (Choose two.)

twistcli

Jenkins Docker plugin

Compute Jenkins plugin

Compute Azure DevOps plugin

Prisma Cloud Visual Studio Code plugin with Jenkins integration

17. Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

copy the Console address and set the config map for the default namespace.

create a new namespace in Kubernetes called admission-controller.

enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.

copy the admission controller configuration from the Console and apply it to Kubernetes.

18. A customer wants to scan a serverless function as part of a build process .

Which twistcli command can be used to scan serverless functions?

twistcli function scan <SERVERLESS_FUNCTIO

ZIP>

twistcli scan serverless <SERVERLESS_FUNCTIO

ZIP>

twistcli serverless AWS <SERVERLESS_FUNCTIO

ZIP>

twiscli serverless scan <SERVERLESS_FUNCTIO

ZIP>

19. A customer has a development environment with 50 connected Defenders. A maintenance window is set for Monday to upgrade 30 stand-alone Defenders in the development environment, but there is no maintenance window available until Sunday to upgrade the remaining 20 stand-alone Defenders.

Which recommended action manages this situation?

Go to Manage > Defender > Manage, then click Defenders, and use the Scheduler to choose which Defenders will be automatically upgraded during the maintenance window.

Find a maintenance window that is suitable to upgrade all stand-alone Defenders in the development environment.

Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window.

Open a support case with Palo Alto Networks to arrange an automatic upgrade.

20. Which three types of buckets exposure are available in the Data Security module? (Choose three.)

Public

Private

International

Differential

Conditional

Page 3 of 3

21. Given the following audit event activity snippet:

Which RQL will be triggered by the audit event?

A)

Option A

Option B

Option C

Option D

22. You have onboarded a public cloud account into Prisma Cloud Enterprise. Configuration Resource ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account.

Config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully.

Why are no alerts being generated?

The public cloud account is not associated with an alert notification.

The public cloud account does not have audit trail ingestion enabled.

The public cloud account does not access to configuration resources.

The public cloud account is not associated with an alert rule.

Updated Palo Alto Networks PCCSE Actual Questions

Updated Palo Alto Networks PCCSE Actual Questions

Share this post

Leave a Reply Cancel reply

Related Posts