PCCSE practice questions 171–180

1. Question 171 · 242 in bank

   The Prisma Cloud administrator has configured a new policy. Which steps should be used to assign this policy to a compliance standard?

   • AEdit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.
   • BCreate the Compliance Standard from Compliance tab, and then select Add to Policy.
   • COpen the Compliance Standards section of the policy, and then save.
   • DCustom policies cannot be added to existing standards.

   Show answer

   Answer: A

   Explanation

   The point is user created a new policy, you can't modify existing policies that were created by Prisma (default) but you can modify your own custom policies. Answer A is correct. Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.

   Source: Adapted from community discussion — kemalgoklen

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 172 · 242 in bank

   An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML. ✑ Console Address: $CONSOLE_ADDRESS ✑ Websocket Address: $WEBSOCKET_ADDRESS ✑ User: $ADMIN_USER Which command generates the YAML file for Defender install?

   • A<PLATFORM>/twistcli defender \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS
   • B<PLATFORM>/twistcli defender export kubernetes \ --address $WEBSOCKET_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS
   • C<PLATFORM>/twistcli defender YAML kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS
   • D<PLATFORM>/twistcli defender export kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

3. Question 173 · 242 in bank

   Which options show the steps required after upgrade of Console?

   • AUninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender
   • BUpdate the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders
   • CUpgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable
   • DUpdate the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console

   Show answer

   Answer: C

   Explanation

   After the Console has been upgraded, check and upgrade any of the Defenders that have reached the end of their support lifecycle (Defenders are backward compatible for N-2 releases). The Defender release image is built from the UBI8-minimal base image and on upgrade it is a full container image upgrade, which means that the old Defender container is replaced with a new container. Then, upgrade all other Prisma Cloud components, such as the Jenkins plugin. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/upgrade/upgrade_process_saas

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 174 · 242 in bank

   An organization wants to be notified immediately to any `High Severity` alerts for the account group `Clinical Trials` via Slack. Which option shows the steps the organization can use to achieve this goal?

   • A1. Configure Slack Integration 2. Create an alert rule and select ג€Clinical Trialsג€ as the account group 3. Under the ג€Select Policiesג€ tab, filter on severity and select ג€Highג€ 4. Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to ג€As it Happensג€
   • B1. Create an alert rule and select ג€Clinical Trialsג€ as the account group 2. Under the ג€Select Policiesג€ tab, filter on severity and select ג€Highג€ 3. Under the Set Alert Notification tab, choose Slack and populate the channel 4. Set Frequency to ג€As it Happensג€ 5. Set up the Slack Integration to complete the configuration
   • C1. Configure Slack Integration 2. Create an alert rule 3. Under the ג€Select Policiesג€ tab, filter on severity and select ג€Highג€ 4. Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to ג€As it Happensג€
   • D1. Under the ג€Select Policiesג€ tab, filter on severity and select ג€Highג€ 2. Under the Set Alert Notification tab, choose Slack and populate the channel 3. Set Frequency to ג€As it Happensג€ 4. Configure Slack Integration 5. Create an Alert rule

   Show answer

   Answer: A

   Explanation

   A. Configure Slack Integration. Create an alert rule and select "Clinical Trials" as the account group. Under the "Select Policies" tab, filter on severity and select "High". Under the "Set Alert Notification" tab, choose Slack and populate the channel. Set the frequency to "As it Happens".

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

5. Question 175 · 242 in bank

   A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company's AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is currently not using AWS Organizations and will require each account to be onboarded individually. The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts. Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?

   • Ahttps://api.prismacloud.io/cloud/
   • Bhttps://api.prismacloud.io/account/aws
   • Chttps://api.prismacloud.io/cloud/aws
   • Dhttps://api.prismacloud.io/accountgroup/aws

   Show answer

   Answer: C

   Next question

6. Question 176 · 242 in bank

   Select 3

   A security team has a requirement to ensure the environment is scanned for vulnerabilities. What are three options for configuring vulnerability policies? (Choose three.)

   • Aindividual actions based on package type
   • Boutput verbosity for blocked requests
   • Capply policy only when vendor fix is available
   • Dindividual grace periods for each severity level
   • Ecustomize message on blocked requests

   Show answer

   Answer: BCD

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition-admin/vulnerability_management/ vuln_management_rules.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

7. Question 177 · 242 in bank

   The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely. Which strategy should the administrator use to achieve this goal?

   • ADisable the policy
   • BSet the Alert Disposition to Conservative
   • CChange the Training Threshold to Low
   • DSet Alert Disposition to Aggressive

   Show answer

   Answer: B

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies.html

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 178 · 242 in bank

   What is the behavior of Defenders when the Console is unreachable during upgrades?

   • ADefenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.
   • BDefenders will fail closed until the web-socket can be re-established.
   • CDefenders will fail open until the web-socket can be re-established.
   • DDefenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

   Show answer

   Answer: D

   Explanation

   Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process.html

   References

   • docs.paloaltonetworks.com documentation
   • docs.paloaltonetworks.com documentation

   Next question

9. Question 179 · 242 in bank

   How are the following categorized? ✑ Backdoor account access ✑ Hijacked processes ✑ Lateral movement ✑ Port scanning

   • Aaudits
   • Bincidents
   • Cadmission controllers
   • Dmodels

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 180 · 242 in bank

    Select 3

    Which three types of classifications are available in the Data Security module? (Choose three.)

    • APersonally identifiable information
    • BMalicious IP
    • CCompliance standard
    • DFinancial information
    • EMalware

    Show answer

    Answer: ADE

    Explanation

    Palo Alto Networks’ Enterprise DLP service and provides data classification that includes built-in data profiles with data patterns that match sensitive information such as PII, health care, financial information and Intellectual Property. In addition to protecting your confidential and sensitive data, your data is also protected against threats—known and unknown (zero-day) malware—using the Palo Alto Networks’ WildFire service.

    Source: Adapted from community discussion — Spippolo

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCCSE practice, question 171. 242 questions available.