PCCSE Prisma Certified Cloud Security Engineer Questions

dumps2022-01-22T03:29:12+08:00

Prisma Certified Cloud Security Engineer PCCSE questions are the best materil for you to pass the test. There are 75-85 questions in real Palo Alto Networks PCCSE exam, and you have 90 minutes to finish the test. The exam format is Multiple Choice, scenarios with graphics and Matching. The available language is English. Free Palo Alto Networks PCCSE exam questions are available below.

Page 1 of 3

1. Which two statements are true about the differences between build and run config policies? (Choose two.)

Build and Audit Events policies belong to the configuration policy set

Run policies monitor resources, and check for potential issues after these cloud resources are deployed

Run policies monitor network activities in your environment, and check for potential issues during runtime.

Build policies enable you to check for security misconfigurations in the laC templates and ensure that these issues do not get into production.

Run and Network policies belong to the configuration policy set

2. Which component(s), if any will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?

Defenders

twistcli

Console

Jenkins

3. Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

Container

Image

Host

Functions

4. A customer wants to scan a serverless function as part of a build process.

Which twistcli command can be used to scan serverless functions?

twistcli serverless AWS <SERVERLESS_FUNCTION ZIP>

twistcli serverless scan <SERVERLESS_FUNCTIO

ZIP>

twistcli scan serverless <SERVERLESS_FUNCTION Z1P>

twistcli function scan <SERVERLESS_FUNCT10N ZIP>

5. DRAG DROP

Which order of steps map a policy to a custom compliance standard?

(Drag the steps into the correct order of occurrence, from the first step to the last.)

6. Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

Download and extract the release tarball Ensure that each node has it own storage for Console data Create the Console task definition Deploy the task definition

Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition

The console cannot natively run in an ECS cluster. A onebox deployment should be used.

Download and extract the release tarball Create an EPS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

7. Which options show the steps required after upgrade of Console?

Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders

Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console

Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable

Uninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender

8. The compliance team needs to associate Prisma Cloud policies with compliance frameworks .

Which option should the team select to perform this task?

Compliance

Policies

Alert Rules

Custom Compliance

9. The administrator wants to review the Console audit logs from within the Console.

Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

The audit logs can be viewed only externally to the Console

Navigate to Monitor > Events > Host Log Inspection

Navigate to Manage > View Logs > History

Navigate to Manage > Defenders > View Logs

10. The security team wants to target a CMAF policy for specific running Containers How should the administrator scope the policy to target the Containers?

scope the policy to Image names

scope the policy to namespaces

scope the policy to Defender names.

scope the policy to Host names

Page 2 of 3

11. DRAG DROP

What is the order of steps to create a custom network policy?

(Drag the steps into the correct order of occurrence, from the first step to the last.)

12. A customer wants to turn on Auto Remediation.

Which policy type has the built-in CLI command for remediation?

Network

Anomaly

Config

Audit Event

13. Which authentication mechanism is supported by Prisma Cloud?

Certificate-based authentication for the Console Ul and the API

Certificate-based authentication only for the API

Certificate-based authentication only for the Console Ul

SAML-based authentication for the API

14. Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

SAML

access key

basic authentication

single sign-on

15. A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment .

Which action needs to be set for "do not use privileged containers?

Alert

Prevent

Fail

Block

16. Which "kind" of Kubernetes object that is configured to ensure that Defender is acting as the admission controller?

PodSecurityPolicies

DestinationRules

ValidatingWebhookConfiguration

MutatingWebhookConfiguration

17. Which option identifies the Prisma Cloud Compute Edition?

Plugin to Prisma Cloud

Downloadable, self-hosted software

Software-as-a-Service (SaaS)

Package installed with APT

18. A customer has a requirement to terminate any Container from image topSecret:latest

when a process named ransomWare is executed

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list and set the action to "prevent".

choose "copy into rule" for the Container add a ransomWare process into the denied process list and set the action to "block"

set the Container model to manual relearn and set the default runtime rule to block for process protection.

set the Container model to relearn and set the default runtime rule to prevent for process protection.

19. DRAG DROP

You wish to create a custom policy with build and run subtypes.

Match the query types for each example.

(Select your answer from the pull-down list. Answers may be used more than once or not at all.)

20. Retrieve the Prisma Cloud Console images using 'docker pull' To retrieve Prisma Cloud Console images using basic auth

D. 1 Access registry paloaltonetworks com. and authenticate using 'docker login'

2 Retrieve the Prisma Cloud Console images using 'docker pull'

Page 3 of 3

21. Which option shows the steps to install the Console in a Kubernetes Cluster?

Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

22. Which three types of bucket exposure are available in the Data Security module? (Choose three.)

Differential

Public

Conditional

Private

International

23. Given this information:

•. The Console is located at https//prisma-console mydomain local

•. The username is ciuser

•. The password is password123

•. The Image to scan is myimage latest

Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?

twistcli images scan ―console-address https //prisma-console mydomain local -u ciuser -p password123 -details myimage latest

twistcli images scan ―address prisma-console mydomain local -u ciuser -p password123 -vulnerability-details myimage latest

twistcli images scan -address https //prisma-console mydomain local -u ciuser -p password123 -details myimage latest

twistcli images scan ―console-address prisma-console mydomain local -u ciuser -p password!23 -vulnerability-details myimage.latest

24. DRAG DROP

Match the service on the right that evaluates each exposure type on the left.

(Select your answer from the pull-down list. Answers may be used more than once or not at all.)

25. DRAG DROP

An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise.

tenant-In which order will the APIs be executed for this service? (Drag the steps into the correct order of occurrence from the first step to the last)

26. A security team has a requirement to ensure the environment is scanned for vulnerabilities .

What are three options for configuring vulnerability policies? (Choose three.)

customize message on blocked requests

individual actions based on package type

output verbosity for blocked requests

apply policy only when vendor fix is available

individual grace periods for each severity level

27. Which three steps are involved in onboarding an account for Data Security? (Choose three.)

Enter the RoleARN and SNSARN

Enable Flow Logs

Create a S3 bucket

Create a Cloudtrail with SNS Topic

Create a read-only role with in-line policies

28. A customer is reviewing Container audits, and an audit has identified a cryptominer attack.

Which three options could have generated this audit? (Choose three.)

The mined currency is associated with a user token.

The value of the mined currency exceeds $100.

High CPU usage over time for the container is detected.

Common cryptominer port usage was found.

Common cryptominer process name was found

29. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML

Console Address SCONSOLE_ADDRESS

Websocket Address SWEBSOCKHT_ADDRESS

User: SADMIN USER

Which command generates the YAML file for Defender install?

A)

Option A

Option B

Option C

Option D

PCCSE Prisma Certified Cloud Security Engineer Questions

PCCSE Prisma Certified Cloud Security Engineer Questions

Share this post

Leave a Reply Cancel reply

Related Posts