PCCSE practice questions 151–160

1. Question 151 · 242 in bank

   Which type of RQL query should be run to determine if AWS Elastic Compute Cloud (EC2) instances without encryption was enabled?

   • ANETWORK
   • BCONFIG
   • CEVENT
   • DSECURITY

   Show answer

   Answer: B

   Next question

2. Question 152 · 242 in bank

   Which RQL query is used to detect certain high-risk activities executed by a root user in AWS?

   • Aevent from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'
   • Bevent from cloud.security_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'
   • Cconfig from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey', 'DeleteAlarms' ) AND user = 'root'
   • Devent from cloud.audit_logs where Risk.Level = 'high' AND user = 'root'

   Show answer

   Answer: A

   Next question

3. Question 153 · 242 in bank

   What is required for Prisma Cloud to successfully execute auto-remediation commands?

   • AAccess to the cloud platform only for Azure
   • BWrite access to the cloud platform
   • CRead access to the cloud platform
   • DPrisma Cloud requires no access to the cloud platform

   Show answer

   Answer: B

   Next question

4. Question 154 · 242 in bank

   A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment. Which action needs to be set for `do not use privileged containers`?

   • APrevent
   • BAlert
   • CBlock
   • DFail

   Show answer

   Answer: C

   Explanation

   Correct anser is Block. Block — Defender stops the entire container if a process that violates your policy attempts to run. https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect

   Source: Adapted from community discussion — [Removed]

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 155 · 242 in bank

   In Azure, what permissions need to be added to Management Groups to allow Prisma Cloud to calculate net effective permissions?

   • APaloAltoNetworks.PrismaCloud/managementGroups/*
   • BMicrosoft.Management/managementGroups/descendants/read
   • CPaloAltoNetworks.PrismaCloud/managementGroups/descendants/read
   • DMicrosoft.Management/managementGroups/descendants/calculate

   Show answer

   Answer: B

   Next question

6. Question 156 · 242 in bank

   Which command should be used in the Prisma Cloud twistcli tool to scan the nginx:latest image for vulnerabilities and compliance issues?

   • A$ twistcli images scan --console-address --user --password --output-file scan-results.json nginx:latest
   • B$ twistcli images scan --address --user --password --details nginx:latest
   • C$ twistcli images build --console-address --user --password --details nginx:latest
   • D$ twistcli images scan --address --username --password --details nginx:latest

   Show answer

   Answer: B

   Next question

7. Question 157 · 242 in bank

   A Prisma Cloud Administrator onboarded an AWS cloud account with agentless scanning enabled successfully to Prisma Cloud. Which item requires deploying defenders to be able to inspect the risk on the onboarded AWS account?

   • AHost vulnerability risks
   • BContainer vulnerability risks
   • CContainer runtime risks
   • DHost compliances risks

   Show answer

   Answer: C

   Next question

8. Question 158 · 242 in bank

   Select 2

   Which two information types cannot be seen in the data security dashboard? (Choose two.)

   • ATop Publicly Exposed Objects By Data Profile
   • BBucket owner
   • CObject content
   • DTotal objects
   • EObject Data Profile by Region

   Show answer

   Answer: BC

   Next question

9. Question 159 · 242 in bank

   How is the scope of each rule determined in the Prisma Cloud Compute host runtime policy?

   • ABy the order in which it is created
   • BBy the collection assigned to that rule
   • CBy the type of network traffic it controls
   • DBy the target workload

   Show answer

   Answer: B

   Next question

10. Question 160 · 242 in bank

    Which RQL query will help create a custom identity and access management (IAM) policy to alert on Lambda functions that have permission to terminate EC2 instances?

    • Aiam from cloud.resource where dest.cloud.type = ’AWS’ AND source.cloud.service.name = ’lambda’ AND source.cloud.resource.type = ’function’ AND dest.cloud.service.name = ’ec2’ AND action.name = ’ec2:TerminateInstances’
    • Bconfig from iam where dest.cloud.type = ’AWS’ AND source.cloud.service.name = ’ec2’ AND source.cloud.resource.type = ’instance’ AND dest.cloud.service.name = ’lambda’ AND action.name = ’ec2:TerminateInstances’
    • Ciam from cloud.resource where cloud.type equals ’AWS’ AND cloud.resource.type equals ’lambda function’ AND cloud.service.name = ’ec2’ AND action.name equals ’ec2:TerminateInstances’
    • Dconfig from iam where dest.cloud.type = ’AWS’ AND source.cloud.service.name = ’lambda’ AND source.cloud.resource.type = ’function’ AND dest.cloud.service.name = ’ec2’ AND action.name = ’ec2:TerminateInstances’

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCCSE practice, question 151. 242 questions available.