PCCSE practice questions 161–170

1. Question 161 · 242 in bank

   DRAG DROP - Put the steps of integrating Okta with Prisma Cloud in the right order in relation to CIEM or SSO okra integration.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct sequence login in to your OKta Administrator panel add an administrator role Generate an API token Configure Okta with Prisma Cloud Run the IAM queries for Okta.

   Source: Adapted from community discussion — cesare123

   

   Next question

2. Question 162 · 242 in bank

   Which command correctly outputs scan results to stdout in tabular format and writes scan results to a JSON file while still sending the results to Console?

   • A$ twistcli images scan --address --user --password --stdout-tabular --output-file scan-results.json nginx:latest
   • B$ twistcli images scan --address --username --password --details --json-output scan-results.json nginx:latest
   • C$ twistcli images scan --address --user --password --details --file-output scan-results.json nginx:latest
   • D$ twistcli images scan --address --u --p --details --output-file scan-results.json nginx:latest

   Show answer

   Answer: D

   Next question

3. Question 163 · 242 in bank

   Prisma Cloud cannot integrate which of the following secrets managers?

   • AIBM Secret Manager
   • BAzureKey Vault
   • CHashiCorp Vault
   • DAWS Secret Manager

   Show answer

   Answer: A

   Next question

4. Question 164 · 242 in bank

   Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

   • AThe console cannot natively run in an ECS cluster. A onebox deployment should be used.
   • BDownload and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition
   • CDownload and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition
   • DDownload and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/install/install_amazon_ecs.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 165 · 242 in bank

   Which options show the steps required to upgrade Console when using projects?

   • AUpgrade all Supervisor Consoles Upgrade Central Console
   • BUpgrade Central Console Upgrade Central Console Defenders
   • CUpgrade Defender Upgrade Central Console Upgrade Supervisor Consoles
   • DUpgrade Central Console Upgrade all Supervisor Consoles

   Show answer

   Answer: A

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

6. Question 166 · 242 in bank

   Select 2

   A customer has Prisma Cloud Enterprise and host Defenders deployed. What are two options that allow an administrator to upgrade Defenders? (Choose two.)

   • Awith auto-upgrade, the host Defender will auto-upgrade.
   • Bauto deploy the Lambda Defender.
   • Cclick the update button in the web-interface.
   • Dgenerate a new DaemonSet file.

   Show answer

   Answer: AC

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 167 · 242 in bank

   Which intensity setting for anomaly alerts is used for the measurement of 100 events over 30 days?

   • AHigh
   • BMedium
   • CLow
   • DVery High

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise- settings.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 168 · 242 in bank

   Given this information: ✑ The Console is located at https://prisma-console.mydomain.local ✑ The username is: cluster ✑ The password is: password123 ✑ The image to scan is: myimage:latest Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?

   • Atwistcli images scan --console-address https://prisma-console.mydomain.local -u cluster -p password123 --details myimage:latest
   • Btwistcli images scan --console-address prisma-console.mydomain.local -u cluster -p password123 --vulnerability-details myimage:latest
   • Ctwistcli images scan --address prisma-console.mydomain.local -u cluster -p password123 --vulnerability-details myimage:latest
   • Dtwistcli images scan --address https://prisma-console.mydomain.local -u cluster -p password123 --details myimage:latest

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 169 · 242 in bank

   The development team wants to fail CI jobs where a specific CVE is contained within the image. How should the development team configure the pipeline or policy to produce this outcome?

   • ASet the specific CVE exception as an option in Jenkins or twistcli.
   • BSet the specific CVE exception as an option in Defender running the scan.
   • CSet the specific CVE exception as an option using the magic string in the Console.
   • DSet the specific CVE exception in Console's CI policy.

   Show answer

   Answer: D

   Explanation

   D. By configuring the CI policy in Palo Alto Networks' Console, the development team can define rules and conditions for the CI (Continuous Integration) process.

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 170 · 242 in bank

    The development team wants to block Cross Site Scripting attacks from pods in its environment. How should the team construct the CNAF policy to protect against this attack?

    • Acreate a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to ג€preventג€.
    • Bcreate a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.
    • Ccreate a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.
    • Dcreate a Container CNAF policy, targeted at a specific resource, and they should set ג€Explicitly allowed inbound IP sourcesג€ to the IP address of the pod.

    Show answer

    Answer: C

    Explanation

    C. Prevent - The request is denied from reaching the protected application, an audit is generated and WAAS responds with an HTML page indicating the request was blocked. Supported only in WAAS Inline proxy setup.

    Source: Adapted from community discussion — Spippolo

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCCSE practice, question 161. 242 questions available.