Prisma Certified Cloud Security Engineer practice questions

1. Question 1 of 25

   Which data security default policy is able to scan for vulnerabilities?

   • AObjects containing Vulnerabilities
   • BObjects containing Threats
   • CObjects containing Malware
   • DObjects containing Exploits

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Should be A: Prisma Cloud ships with a simple default vulnerability policy for containers, hosts, and serverless functions. These policies have a rule named Default - alert all components, which sets the alert threshold to low. With this rule, all vulnerabilities in images, hosts, and functions are reported.

   Adapted from community discussion by Redrum702 · 2024-07-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. T

      tipzzz

      2024-07-20

      Selected C3 upvotes

      This policy scans for objects containing Malware using Wildfire as a Service.

   2. R

      Redrum702

      2024-07-18

      2 upvotes

      Should be A: Prisma Cloud ships with a simple default vulnerability policy for containers, hosts, and serverless functions. These policies have a rule named Default - alert all components, which sets the alert threshold to low. With this rule, all vulnerabilities in images, hosts, and functions are reported.

   3. S

      Spippolo

      2024-12-07

      Selected C1 upvote

      C --> Tested inside console. Policy name: Objects containing Malware Description: This policy scans for objects containing Malware using Wildfire as a Service.

   4. P

      poiuytr

      2024-07-18

      Selected C1 upvote

      C Only: "Objects containing Malware" is default data policy. Class: Vulnerabilities.

2. Question 2 of 25

   Select 2

   Which of the following are correct statements regarding the use of access keys? (Choose two.)

   • AAccess keys must have an expiration date
   • BUp to two access keys can be active at any time
   • CSystem Admin can create access key for all users
   • DAccess keys are used for API calls

   Show answer

   Correct answer: B, D

   How others answered

   • BD100%

   Explanation

   I would say: CD https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with-prisma-cloud/access-the-prisma-cloud-api "Prisma Cloud requires an API access key to enable programmatic access to the REST API" -D "By default, only the System Admin has API access and can enable API access for other administrators." - C "If you have API access, you can create up to two access keys per role for most roles" - PER ROLE, so more than two can be active at any time. Thats why I think B is incorrect. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys

   Adapted from community discussion by poiuytr · 2023-07-18 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. T

      tipzzz

      2023-07-20

      Selected B, D5 upvotes

      A sys admin can't create Access Key for others, he can give the right to do it

   2. P

      poiuytr

      2023-07-18

      3 upvotes

      I would say: CD https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with-prisma-cloud/access-the-prisma-cloud-api "Prisma Cloud requires an API access key to enable programmatic access to the REST API" -D "By default, only the System Admin has API access and can enable API access for other administrators." - C "If you have API access, you can create up to two access keys per role for most roles" - PER ROLE, so more than two can be active at any time. Thats why I think B is incorrect. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys

   3. S

      Spippolo

      2023-12-07

      Selected B, D3 upvotes

      When we create an Access Key, we cannot create it for other user. We ara limited up to 2. B. Up to two access keys can be active at any time D. Access keys are used for API calls

   4. R

      Redrum702

      2023-07-18

      2 upvotes

      CD looks to be the better answer: If you have API access, you can create up to two access keys per role for most roles; some roles such the Build and Deploy Security role can generate one access key only.

3. Question 3 of 25

   Select 2

   A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured. Which two reasons explain this change in alert status? (Choose two.)

   • Auser manually changed the alert status.
   • Bpolicy was changed.
   • Cresource was deleted.
   • Dalert was sent to an external integration.

   Show answer

   Correct answer: B, C

   How others answered

   • BC100%

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/prisma-cloud-alert-resolution-reasons.html

   Adapted from community discussion by Mig_MAM · 2024-06-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. M

      Mig_MAM

      2024-06-18

      2 upvotes

      The two reasons that could explain the change in alert status are: A. User manually changed the alert status. Even without auto-remediation configured, a user with the appropriate permissions can manually change the status of an alert. C. Resource was deleted. If the resource related to the alert was deleted, the alert would be resolved because the issue no longer exists.

   2. S

      Spippolo

      2023-06-06

      Selected B, C1 upvote

      Tricky Question. I think B and C. RESOURCE_DELETED Resource was deleted. USER_DISMISSED Alert was dismissed or snoozed by the Prisma Cloud administrator with role of System admin, Account Group Admin, or Account and Cloud Provisioning Admin. POLICY_UPDATED Policy was updated. This status indicates a change in the policy RQL that results in a resource not being in scope for the policy evaluation.

   3. R

      Ravi221

      2022-09-28

      2 upvotes

      Correct Answer is B and C, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OQ2CAM

   4. S

      SakeBomb

      2022-01-23

      2 upvotes

      users cannot manually set an alert as remediated, they can only dismiss or snooze it.

4. Question 4 of 25

   A customer has a requirement to scan serverless functions for vulnerabilities. What is the correct option to configure scanning?

   • AConfigure serverless radar from the Defend > Compliance > Cloud Platforms page.
   • BEmbed serverless Defender into the function.
   • CConfigure a function scan policy from the Defend > Vulnerabilities > Functions page.
   • DUse Lambda layers to deploy a Defender into the function.

   Show answer

   Correct answer: C

   How others answered

   • C88%

   Explanation

   Should be C. Configure Prisma Cloud to periodically scan your serverless functions. Unlike image scanning, all function scanning is handled by Console. ..... Go to Defend > Vulnerabilities > Functions > Functions. https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/vulnerability_management/serverless_functions

   Adapted from community discussion by Spippolo · 2024-12-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. S

      Spippolo

      2024-12-08

      Selected C2 upvotes

      Should be C. Configure Prisma Cloud to periodically scan your serverless functions. Unlike image scanning, all function scanning is handled by Console. ..... Go to Defend > Vulnerabilities > Functions > Functions. https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/vulnerability_management/serverless_functions

   2. P

      poiuytr

      2024-07-18

      2 upvotes

      C Scanning serverless functions for vurnelabilities is done by Console.

   3. R

      Redrum702

      2024-07-10

      1 upvote

      B https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/serverless_functions

   4. C

      Chichi23

      2024-11-01

      1 upvote

      D. Use Lambda layers to deploy a Defender into the function.

5. Question 5 of 25

   An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration. In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS. Which port will twistcli need to use to access the Prisma Compute APIs?

   • A8084
   • B443
   • C8083
   • D8081

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_kubernetes.html

   Adapted from community discussion by Chichi23 · 2023-10-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. [

      [Removed]

      2022-03-11

      6 upvotes

      C is correct. https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console

   2. S

      SakeBomb

      2022-07-23

      4 upvotes

      C port 8084 is reserved for communication between console and defender. 8083 is for HTTPS

   3. C

      Chichi23

      2023-10-08

      2 upvotes

      Port 8083, as per docs "Open a browser window, and navigate to Console. By default, Console is served on HTTPS on port 8083. For example, go to https://yourconsole.example.com:8083." https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_kubernetes

   4. S

      Spippolo

      2023-12-06

      Selected C1 upvote

      C --> By default Prisma Cloud listens on: 8083 HTTPS management port for access to Console. 8084 WSS port for Defender to Console communication.

6. Question 6 of 25

   Select 2

   Which two roles have access to view the Prisma Cloud policies? (Choose two.)

   • ABuild AND Deploy Security
   • BAuditor
   • CDev SecOps
   • DDefender Manager

   Show answer

   Correct answer: B, C

   How others answered

   • BC100%

   Explanation

   B --> Auditor --> Auditors get read-only access to all Prisma Cloud data, settings, and logs. C --> DevSecOps User --> Read-only access to all results under Radar and Monitor, but no access to change policy or settings. https://github.com/PaloAltoNetworks/prisma-cloud-docs/blob/master/compute/admin_guide/authentication/user_roles.adoc

   Adapted from community discussion by Spippolo · 2024-12-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. R

      Redrum702

      2024-07-10

      7 upvotes

      BC https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/prisma-cloud-admin-permissions

   2. S

      Spippolo

      2024-12-08

      Selected B, C2 upvotes

      B --> Auditor --> Auditors get read-only access to all Prisma Cloud data, settings, and logs. C --> DevSecOps User --> Read-only access to all results under Radar and Monitor, but no access to change policy or settings. https://github.com/PaloAltoNetworks/prisma-cloud-docs/blob/master/compute/admin_guide/authentication/user_roles.adoc

   3. J

      Jihe

      2024-09-09

      3 upvotes

      BChttps://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/prisma-cloud-administrator-roles#id437b5c4a-3dfa-4c70-8fc7-b6d074f5dffc

   4. 4

      4nim4tronic

      2025-01-04

      Selected B, C1 upvote

      The Defender Manager role: ✅ Can manage Defenders and their configurations. ❌ Does not have full access to all security policies. ❌ Cannot manage or view policies related to vulnerabilities, compliance, etc. Therefore, it is not one of the core roles with permissions to view general Prisma Cloud policies.

7. Question 7 of 25

   The Compute Console has recently been upgraded, and the administrator plans to delay upgrading the Defenders and the Twistcli tool until some of the team’s resources have been rescaled. The Console is currently one major release ahead. What will happen as a result of the Console upgrade?

   • ADefenders will disconnect, and Twistcli will stop working.
   • BDefenders will disconnect, and Twistcli will remain working.
   • CBoth Defenders and Twistcli will remain working.
   • DDefenders will remain connected, and Twistcli will stop working.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   C https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/upgrade/upgrade_process_self_hosted Prisma Cloud console is backward compatible up to two major releases back (including all minor versions) with the following: All types of Defenders. Twistcli/Jenkins plugin.

   Adapted from community discussion by Spippolo · 2024-06-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. P

      poiuytr

      2024-01-20

      5 upvotes

      C answer according to this link. "Prisma Cloud console is backward compatible up to two major releases back (including all minor versions) with the following: - All types of Defenders. - Twistcli/Jenkins plugin."

   2. S

      Spippolo

      2024-06-08

      Selected C2 upvotes

      C https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/upgrade/upgrade_process_self_hosted Prisma Cloud console is backward compatible up to two major releases back (including all minor versions) with the following: All types of Defenders. Twistcli/Jenkins plugin.

   3. J

      Jihe

      2024-06-09

      2 upvotes

      C -older versions of Defenders, Jenkins plugins, and twistcli can interoperate with newer versions of Console. ( https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/upgrade/support_lifecycle )

   4. R

      Redrum702

      2024-01-11

      2 upvotes

      D https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/upgrade/upgrade_process_self_hosted

8. Question 8 of 25

   What will happen when a Prisma Cloud Administrator has configured agentless scanning in an environment that also has Host and Container Defenders deployed?

   • AAgentless scan will automatically be disabled, so Defender scans are the only scans occurring.
   • BAgentless scans do not conflict with Defender scans, so both will run.
   • CDefender scans will automatically be disabled, so agentless scans are the only scans occurring.
   • DBoth agentless and Defender scans will be disabled and an error message will be received.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   B The agentless scanning architecture lets you inspect a host and the container images in that host without having to install an agent or affecting its execution. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/agentless-scanning/onboard-accounts

   Adapted from community discussion by Spippolo · 2024-06-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion2

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. P

      poiuytr

      2024-01-20

      Selected B4 upvotes

      https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/agentless_scanning

   2. S

      Spippolo

      2024-06-11

      Selected B2 upvotes

      B The agentless scanning architecture lets you inspect a host and the container images in that host without having to install an agent or affecting its execution. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/agentless-scanning/onboard-accounts

9. Question 9 of 25

   Select 2

   Which two services require external notifications to be enabled for policy violations in the Prisma Cloud environment? (Choose two.)

   • ASplunk
   • BQROC
   • CSQS
   • DEmail

   Show answer

   Correct answer: A, C

   How others answered

   • AC100%

   Explanation

   Tested on Prisma. A --> To configure Splunk notifications, at least one Splunk Integration is needed. C --> To configure Amazon SQS notifications, at least one Amazon SQS integration is needed. Please create an Amazon SQS Integration (in Settings > Integrations > Amazon SQS). B --> There isn't any integrations like this QROC. D --> Email no need any integrations.

   Adapted from community discussion by Spippolo · 2024-06-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

   1. S

      Spippolo

      2024-06-11

      Selected A, C3 upvotes

      Tested on Prisma. A --> To configure Splunk notifications, at least one Splunk Integration is needed. C --> To configure Amazon SQS notifications, at least one Amazon SQS integration is needed. Please create an Amazon SQS Integration (in Settings > Integrations > Amazon SQS). B --> There isn't any integrations like this QROC. D --> Email no need any integrations.

   2. H

      HARRY

      2024-02-04

      Selected A, C3 upvotes

      https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud#id24911ff9-c9ec-4503-bb3a-6cfce792a70d

   3. P

      poiuytr

      2024-01-20

      3 upvotes

      A C B - not couse there is no such integration like QROC D - not couse: "For all channels except email, to enable notification of policy violations in your cloud environments in your existing operational workflows, you must Configure External Integrations on Prisma Cloud."

   4. R

      Redrum702

      2024-01-13

      1 upvote

      CD https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/send-prisma-cloud-alert-notifications-to-third-party-tools

10. Question 10 of 25

    Which Defender type performs registry scanning?

    • AServerless
    • BContainer
    • CHost
    • DRASP

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B Any Container Defender running on a host with the Docker Engine container runtime or container runtime interface (CRI) can scan a registry, and any number of them can simultaneously operate as registry scanners. This flexibility gives you a lot of options when trying to determine how to cover disparate environments. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/registry_scanning/configure_registry_scanning

    Adapted from community discussion by Spippolo · 2024-06-11 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-06-11

       Selected B3 upvotes

       B Any Container Defender running on a host with the Docker Engine container runtime or container runtime interface (CRI) can scan a registry, and any number of them can simultaneously operate as registry scanners. This flexibility gives you a lot of options when trying to determine how to cover disparate environments. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/registry_scanning/configure_registry_scanning

    2. R

       Redrum702

       2024-01-13

       5 upvotes

       B https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/registry_scanning

11. Question 11 of 25

    Select 2

    Which two attributes are required for a custom config RQL? (Choose two.)

    • Ajson.rule
    • Bcloud.account
    • Capi.name
    • Dtag

    Show answer

    Correct answer: B, C

    How others answered

    • BC67%
    • AC33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    BC config from cloud.resource where cloud.account config from cloud.resource where api.name https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-attributes or AC Config queries require some mandatory attributes. It should begin with config where cloud.resource where and at a minimum have api.name in conjunction with json.rule or it can have an attribute from completion suggestions, or it can have two api.name attributes with a filter attribute. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy

    Adapted from community discussion by Spippolo · 2023-12-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. P

       poiuytr

       2023-07-21

       7 upvotes

       AC https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy

    2. S

       Spippolo

       2023-12-09

       Selected B, C2 upvotes

       BC config from cloud.resource where cloud.account config from cloud.resource where api.name https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-attributes or AC Config queries require some mandatory attributes. It should begin with config where cloud.resource where and at a minimum have api.name in conjunction with json.rule or it can have an attribute from completion suggestions, or it can have two api.name attributes with a filter attribute. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy

    3. R

       Redrum702

       2023-07-13

       2 upvotes

       BC https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-attributes

12. Question 12 of 25

    Given the following information, which twistcli command should be run if an administrator were to exec into a running container and scan it from within using an access token for authentication? • Console is located at https://prisma-console.mydomain.local • Token is: TOKEN_VALUE • Report ID is: REPORT_ID • Container image running is: myimage:latest

    • Atwistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details myimage:latest
    • Btwistcli images scan --console-address https://prisma-console.mydomain.local --auth-token TOKEN_VALUE --containerized --vulnerability-details REPORT_ID
    • Ctwistcli images scan --address https://prisma-console.mydomain.local --token TOKEN_VALUE --containerized --details REPORT_ID
    • Dtwistcli images scan --console-address https://prisma-console.mydomain.local --auth-token MY_TOKEN --local-scan --details myimage:latest

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C $ docker run \ -v /PATH/TO/TWISTCLI_DIR:/tools \ -e TW_TOKEN= \ -e TW_CONSOLE= \ --entrypoint="" \ \ /tools/twistcli images scan \ --containerized \ --details \ --address $TW_CONSOLE \ --token $TW_TOKEN \ https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

    Adapted from community discussion by Spippolo · 2024-06-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-06-09

       Selected C2 upvotes

       C $ docker run \ -v /PATH/TO/TWISTCLI_DIR:/tools \ -e TW_TOKEN= \ -e TW_CONSOLE= \ --entrypoint="" \ \ /tools/twistcli images scan \ --containerized \ --details \ --address $TW_CONSOLE \ --token $TW_TOKEN \ https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

    2. N

       nedeb514

       2024-08-28

       Selected C1 upvote

       The response from Jihe would be correct if this wasn't be run from within the container. In the question, we are running from inside the container, and therefor there is no need to specify an image/tarball. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_image Further down in the documentation linked by Jihe, there is a section that shows the proper syntax when running twistcli from within a container. The example there is almost a perfect copy of this question. Spippolo has the correct response.

    3. J

       Jihe

       2024-06-16

       2 upvotes

       A Syntax When using 'twistcli images scan', the IMAGE or TARBALL to scan MUST be the LAST PARAMETER. If you specify options after the image or tarball, they are ignored. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

13. Question 13 of 25

    The security team wants to protect a web application container from an SQLi attack. Which type of policy should the administrator create to protect the container?

    • ACNAF
    • BRuntime
    • CCompliance
    • DCNNF

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/firewalls/waas

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. G

       gekvprasad

       2023-11-29

       4 upvotes

       WAAS (Web-Applicaon and API Security, formerly known as CNAF

    2. S

       Spippolo

       2024-12-06

       Selected A2 upvotes

       A --> WAAS (Web-Application and API Security, formerly known as CNAF, Cloud Native Application Firewall). https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/waas_app_firewall

    3. K

       kumar_57

       2024-09-26

       2 upvotes

       The correct option is A. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas

14. Question 14 of 25

    A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment. Which action needs to be set for `do not use privileged containers`?

    • APrevent
    • BAlert
    • CBlock
    • DFail

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Correct anser is Block. Block — Defender stops the entire container if a process that violates your policy attempts to run. https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect

    Adapted from community discussion by [Removed] · 2022-03-11 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. [

       [Removed]

       2022-03-11

       7 upvotes

       Correct anser is Block. Block — Defender stops the entire container if a process that violates your policy attempts to run. https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect

    2. S

       Spippolo

       2023-12-06

       Selected C2 upvotes

       C Prevent — Defender stops the process (and just the process) that violates your policy from executing. This is known as discrete blocking. Block — Defender stops the entire container if a process that violates your policy attempts to run.

    3. J

       JohnOrtiz

       2024-11-21

       Selected C1 upvote

       ID: 5054 Type: container Severity: critical Action: Ignore, Alert or Bolock Description: Do not use privileged containers

    4. K

       kumar_57

       2023-09-26

       1 upvote

       Option c IS CORRECT. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/manage_compliance#:~:text=The%20flow%20for%20blocking%20such%20a%20container%20is%3A,deploy%20a%20container%20to%20the%20environment.%20More%20items

15. Question 15 of 25

    Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

    • AThe console cannot natively run in an ECS cluster. A onebox deployment should be used.
    • BDownload and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition
    • CDownload and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition
    • DDownload and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_amazon_ecs.html

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2023-12-06

       Selected D1 upvote

       The correct answer is: D. Download and extract the release tarball, create an EFS (Elastic File System) file system and mount it to each node in the cluster, create the Console task definition, and deploy the task definition.

    2. R

       Redrum702

       2023-08-06

       2 upvotes

       D https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-08/prisma-cloud-compute-edition-admin/install/install_amazon_ecs

    3. J

       JohnOrtiz

       2024-11-21

       Selected D1 upvote

       https://docs.prismacloud.io/en/compute-edition/30/admin-guide/install/deploy-console/console-on-amazon-ecs

    4. K

       kumar_57

       2023-09-26

       1 upvote

       Yes, option is correct. https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-08/prisma-cloud-compute-edition-admin/install/install_amazon_ecs

16. Question 16 of 25

    Which options show the steps required to upgrade Console when using projects?

    • AUpgrade all Supervisor Consoles Upgrade Central Console
    • BUpgrade Central Console Upgrade Central Console Defenders
    • CUpgrade Defender Upgrade Central Console Upgrade Supervisor Consoles
    • DUpgrade Central Console Upgrade all Supervisor Consoles

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-12-06

       Selected A2 upvotes

       When you have one or more tenant or scale Projects, upgrade all Supervisors before upgrading the Central Console. https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process

    2. G

       gekvprasad

       2023-11-30

       2 upvotes

       When you have one or more tenant or scale Projects, upgrade all Supervisors before upgrading the Central Console

    3. K

       kumar_57

       2024-09-26

       1 upvote

       The correct is A. https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process

    4. R

       Redrum702

       2024-08-06

       1 upvote

       A https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-08/prisma-cloud-compute-edition-admin/upgrade/upgrade_process_self_hosted

17. Question 17 of 25

    The development team wants to block Cross Site Scripting attacks from pods in its environment. How should the team construct the CNAF policy to protect against this attack?

    • Acreate a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to ג€preventג€.
    • Bcreate a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.
    • Ccreate a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.
    • Dcreate a Container CNAF policy, targeted at a specific resource, and they should set ג€Explicitly allowed inbound IP sourcesג€ to the IP address of the pod.

    Show answer

    Correct answer: C

    How others answered

    • C83%
    • A17%

    Explanation

    C. Prevent - The request is denied from reaching the protected application, an audit is generated and WAAS responds with an HTML page indicating the request was blocked. Supported only in WAAS Inline proxy setup.

    Adapted from community discussion by Spippolo · 2024-12-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-12-06

       Selected C2 upvotes

       C. Prevent - The request is denied from reaching the protected application, an audit is generated and WAAS responds with an HTML page indicating the request was blocked. Supported only in WAAS Inline proxy setup.

    2. S

       SakeBomb

       2023-07-23

       1 upvote

       Unlike other systems you may have used in the past, Kubernetes doesn't run containers directly; instead it wraps one or more containers into a higher-level structure called a pod. Any containers in the same pod will share the same resources and local network. Pods are used as the unit of replication in Kubernetes.

    3. K

       kumar_57

       2024-09-26

       1 upvote

       A is correct answer since pods are specified WAAS policy must be created for hosts where these pods might be running in your k8s environment.

    4. J

       Jihe

       2024-11-28

       1 upvote

       C https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/waas/waas-intro

18. Question 18 of 25

    The Prisma Cloud administrator has configured a new policy. Which steps should be used to assign this policy to a compliance standard?

    • AEdit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.
    • BCreate the Compliance Standard from Compliance tab, and then select Add to Policy.
    • COpen the Compliance Standards section of the policy, and then save.
    • DCustom policies cannot be added to existing standards.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The point is user created a new policy, you can't modify existing policies that were created by Prisma (default) but you can modify your own custom policies. Answer A is correct. Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

    Adapted from community discussion by kemalgoklen · 2023-07-03 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. K

       kemalgoklen

       2023-07-03

       6 upvotes

       The point is user created a new policy, you can't modify existing policies that were created by Prisma (default) but you can modify your own custom policies. Answer A is correct. Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

    2. J

       Jihe

       2024-05-29

       2 upvotes

       A To Add policies to your custom compliance standard: Select the policy rule to edit, on 3 Compliance Standards click + and associate the policy with the custom compliance standard. (https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/create-a-custom-compliance-standard)

    3. K

       kumar_57

       2024-03-26

       1 upvote

       Compliance Standard can be associated to a policy, but reverse is not true hence option A is correct.

    4. G

       gekvprasad

       2023-05-30

       1 upvote

       You can not add policy from compliance section. Option 1 is correct

19. Question 19 of 25

    An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML. ✑ Console Address: $CONSOLE_ADDRESS ✑ Websocket Address: $WEBSOCKET_ADDRESS ✑ User: $ADMIN_USER Which command generates the YAML file for Defender install?

    • A<PLATFORM>/twistcli defender \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS
    • B<PLATFORM>/twistcli defender export kubernetes \ --address $WEBSOCKET_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS
    • C<PLATFORM>/twistcli defender YAML kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS
    • D<PLATFORM>/twistcli defender export kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. K

       kumar_57

       2024-09-26

       2 upvotes

       The correct answer is option D. https://medium.com/@sureshthivanka/cloud-native-security-devsecops-3e263df2a06c#:~:text=Use%20twistcli%20to%20generate%20a%20YAML%20configuration%20file,YAML%20file.%20%24%20%3CPLATFORM%3E%2Ftwistcli%20defender%20export%20kubernetes%20%5C

    2. S

       Spippolo

       2024-12-06

       Selected D1 upvote

       D. $ /twistcli defender export kubernetes \ --user \ --address \ --cluster-address --cri https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/install/install_kubernetes

    3. R

       Redrum702

       2024-08-13

       1 upvote

       A https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes

20. Question 20 of 25

    What is the behavior of Defenders when the Console is unreachable during upgrades?

    • ADefenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.
    • BDefenders will fail closed until the web-socket can be re-established.
    • CDefenders will fail open until the web-socket can be re-established.
    • DDefenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion3

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-12-06

       Selected D1 upvote

       D. Although older Defenders can interoperate with newer Consoles, their operation is restricted. Older Defenders fully protect your nodes using the policies and settings most recently cached before upgrading Console. They can emit audits to Console and local logs, including syslog. However, they cannot access any API endpoint other than the upgrade endpoint, and they cannot share any new data with Console. No new policies or settings can be pushed from Console to older Defenders. When Defender is in this state, its status is shown as 'Upgrade needed' in Manage > Defenders > Manage. To restore older Defenders to a fully operation state, upgrade them so that their versions match Console’s version.

    2. S

       Spippolo

       2024-12-06

       1 upvote

       In the event of a communications failure with Console, Defender continues running and enforcing the active policy that was last pushed by the management point. Events that would be pushed back to Console are cached locally until it is once again reachable. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/technology_overviews/defender_architecture

    3. J

       Jihe

       2024-11-29

       1 upvote

       D When version mismatches, Older Defenders fully protect your nodes using the policies and settings most recently cached before upgrading Console. (https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process )

21. Question 21 of 25

    Select 3

    Which three types of classifications are available in the Data Security module? (Choose three.)

    • APersonally identifiable information
    • BMalicious IP
    • CCompliance standard
    • DFinancial information
    • EMalware

    Show answer

    Correct answer: A, D, E

    How others answered

    • ADE100%

    Explanation

    Palo Alto Networks’ Enterprise DLP service and provides data classification that includes built-in data profiles with data patterns that match sensitive information such as PII, health care, financial information and Intellectual Property. In addition to protecting your confidential and sensitive data, your data is also protected against threats—known and unknown (zero-day) malware—using the Palo Alto Networks’ WildFire service.

    Adapted from community discussion by Spippolo · 2023-12-06 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. W

       waewae

       2022-05-16

       9 upvotes

       Think it's A,D and E. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security.html

    2. S

       Spippolo

       2023-12-06

       Selected A, D, E4 upvotes

       Palo Alto Networks’ Enterprise DLP service and provides data classification that includes built-in data profiles with data patterns that match sensitive information such as PII, health care, financial information and Intellectual Property. In addition to protecting your confidential and sensitive data, your data is also protected against threats—known and unknown (zero-day) malware—using the Palo Alto Networks’ WildFire service.

    3. P

       peqwilber

       2022-08-12

       3 upvotes

       ADE, correct PII (A), health care, financial information (D) and Intellectual Property. In addition to protecting your confidential and sensitive data, your data is also protected against threats—known and unknown (zero-day) malware(E)—using the Palo Alto Networks’ WildFire service.

    4. J

       JohnFo17

       2024-08-27

       Selected A, D, E1 upvote

       https://docs.prismacloud.io/en/classic/cspm-admin-guide/prisma-cloud-data-security/monitor-data-security-scan-prisma-cloud/data-security-settings#data-security-settings Step 6

22. Question 22 of 25

    A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed. How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

    • Aset the Container model to manual relearn and set the default runtime rule to block for process protection.
    • Bset the Container model to relearn and set the default runtime rule to prevent for process protection.
    • Cadd a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to ג€preventג€.
    • Dchoose ג€copy into ruleג€ for the Container, add a ransomWare process into the denied process list, and set the action to ג€blockג€.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Option C is the correct answer. The administrator should add a new runtime policy targeted at a specific Container name, add the ransomWare process into the denied process list, and set the action to "prevent". This will prevent the ransomWare process from being executed in the Container image topSecret:latest.

    Adapted from community discussion by NodummyIQ · 2023-02-03 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. [

       [Removed]

       2021-09-11

       11 upvotes

       Correct answer is D. Block terminate container. Prevent only terminate process.

    2. N

       NodummyIQ

       2023-02-03

       2 upvotes

       Option C is the correct answer. The administrator should add a new runtime policy targeted at a specific Container name, add the ransomWare process into the denied process list, and set the action to "prevent". This will prevent the ransomWare process from being executed in the Container image topSecret:latest.

    3. E

       elzm

       2024-07-06

       1 upvote

       Prevent  — Defender stops the process (and just the process) that violates your policy from executing. Block  — Defender stops the entire container if a process that violates your policy attempts to run. D. https://docs.prismacloud.io/en/classic/compute-admin-guide/runtime-defense/runtime-defense-containers#effect

    4. S

       Shivam_ayir

       2023-03-21

       1 upvote

       D is the right option. Prevent only blocks containers from running processes, whereas the requirment is to terminate the container, which is only possible by Block. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/runtime_defense_containers

23. Question 23 of 25

    An administrator has access to a Prisma Cloud Enterprise. What are the steps to deploy a single container Defender on an ec2 node?

    • APull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.
    • BExecute the curl | bash script on the ec2 node.
    • CConfigure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.
    • DGenerate DaemonSet file and apply DaemonSet to the twistlock namespace.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    I would say option A: To deploy a single container Defender on an EC2 node, you can follow these steps: Log in to the Prisma Cloud Enterprise console and navigate to the "Defenders" tab. Click on the "Add Defender" button in the top right corner of the page. Select "Single Container" from the list of Defender types. Configure the Defender settings as follows: Enter a name for the Defender. Choose the appropriate OS type for the EC2 instance. Select the "Download Script" option to generate a script that will download and run the Defender container image. Choose the runtime environment for the container (Docker or Kubernetes). Copy the script that is generated. SSH into the EC2 instance where you want to deploy the Defender. Run the script to download and run the Defender container image. Verify that the Defender is running by going back to the "Defenders" tab in the Prisma Cloud Enterprise console and checking the status of the Defender you just deployed. That's it! The single container Defender should now be deployed and protecting your EC2 instance.

    Adapted from community discussion by Chichi23 · 2023-11-01 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. C

       Chichi23

       2023-11-01

       4 upvotes

       I would say option A: To deploy a single container Defender on an EC2 node, you can follow these steps: Log in to the Prisma Cloud Enterprise console and navigate to the "Defenders" tab. Click on the "Add Defender" button in the top right corner of the page. Select "Single Container" from the list of Defender types. Configure the Defender settings as follows: Enter a name for the Defender. Choose the appropriate OS type for the EC2 instance. Select the "Download Script" option to generate a script that will download and run the Defender container image. Choose the runtime environment for the container (Docker or Kubernetes). Copy the script that is generated. SSH into the EC2 instance where you want to deploy the Defender. Run the script to download and run the Defender container image. Verify that the Defender is running by going back to the "Defenders" tab in the Prisma Cloud Enterprise console and checking the status of the Defender you just deployed. That's it! The single container Defender should now be deployed and protecting your EC2 instance.

    2. J

       Joe27

       2022-10-19

       Selected B3 upvotes

       https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_defender/install_single_container_defender

    3. F

       FS9

       2024-10-01

       Selected B2 upvotes

       Because this in Palo Docs: Run the script to download and run the Defender container image. This excludes A. The script downlods de image

    4. S

       Spippolo

       2023-12-07

       Selected B1 upvote

       B is correct. https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/install/install_defender/install_host_defender

24. Question 24 of 25

    A customer wants to scan a serverless function as part of a build process. Which twistcli command can be used to scan serverless functions?

    • Atwistcli function scan <SERVERLESS_FUNCTION.ZIP>
    • Btwistcli scan serverless <SERVERLESS_FUNCTION.ZIP>
    • Ctwistcli serverless AWS <SERVERLESS_FUNCTION.ZIP>
    • Dtwiscli serverless scan <SERVERLESS_FUNCTION.ZIP>

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/serverless_functions You can also use the twistcli command line utility to scan your serverless functions. First download your serverless function as a ZIP file, then run: $ twistcli serverless scan

    Adapted from community discussion by Spippolo · 2024-12-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. S

       Spippolo

       2024-12-07

       Selected D2 upvotes

       D. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/vulnerability_management/serverless_functions You can also use the twistcli command line utility to scan your serverless functions. First download your serverless function as a ZIP file, then run: $ twistcli serverless scan

    2. H

       HARRY

       2024-08-03

       Selected D1 upvote

       https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/tools/twistcli

    3. R

       Redrum702

       2024-08-06

       1 upvote

       D: Scanning functions at build time with twistcli You can also use the twistcli command line utility to scan your serverless functions. First download your serverless function as a ZIP file, then run: $ twistcli serverless scan

    4. C

       Chichi23

       2024-11-01

       1 upvote

       A is correct. twistcli function scan Option D has a typo in the "twistcli " it is missing a T "twisTcli " twiscli function scan

25. Question 25 of 25

    A customer does not want alerts to be generated from network traffic that originates from trusted internal networks. Which setting should you use to meet this customer's request?

    • ATrusted Login IP Addresses
    • BAnomaly Trusted List
    • CTrusted Alert IP Addresses
    • DEnterprise Alert Disposition

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Trusted Alert IP Addresses—If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted on Prisma Cloud. When you add IP addresses to this list, you can create a label to identify your internal networks that are not in the private IP address space to make alert analysis easier. Key words in the above is internal networks.

    Adapted from community discussion by ominator · 2023-09-23 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • docs.paloaltonetworks.com documentation
    • docs.paloaltonetworks.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCCSE or CertExamHQ.

    1. O

       ominator

       2023-09-23

       Selected C6 upvotes

       Trusted Alert IP Addresses—If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted on Prisma Cloud. When you add IP addresses to this list, you can create a label to identify your internal networks that are not in the private IP address space to make alert analysis easier. Key words in the above is internal networks.

    2. S

       Spippolo

       2024-12-06

       Selected C1 upvote

       B --> Anomaly Trusted List—Exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default. C --> Trusted Alert IP Addresses—If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted ... Prisma Cloud default network policies that look for internet exposed instances also do not generate alerts when the source IP address is included in the trusted IP address list and the account hijacking anomaly policy filters out activities from known IP addresses. Also, when you use RQL to query network traffic, you can filter out traffic from known networks that are included in the trusted IP address list.

    3. S

       SakeBomb

       2023-07-22

       4 upvotes

       Correct answer is Anomaly Trusted List. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/trusted-ip-addresses-on-prisma-cloud.html

    4. K

       kumar_57

       2024-09-25

       1 upvote

       C is the correct answer. Anomaly Trusted List is used for penetration testing which is within the system not at the customer-end. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/trusted-ip-addresses-on-prisma-cloud

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCCSE practice, question 1 of 25