PCCSE practice questions 41–50

1. Question 41 · 242 in bank

   An administrator has added a Cloud account on Prisma Cloud and then deleted it. What will happen if the deleted account is added back on Prisma Cloud within a 24-hour period?

   • ANo alerts will be displayed.
   • BExisting alerts will be displayed again.
   • CNew alerts will be generated.
   • DExisting alerts will be marked as resolved.

   Show answer

   Answer: B

   References

   • docs.paloaltonetworks.com documentation

   Next question

2. Question 42 · 242 in bank

   Select 2

   In which two ways can Prisma Cloud images be retrieved in Prisma Cloud Compute Self-Hosted Edition? (Choose two.)

   • APull the images from the Prisma Cloud registry without any authentication.
   • BAuthenticate with Prisma Cloud registry, and then pull the images from the Prisma Cloud registry.
   • CRetrieve Prisma Cloud images using URL auth by embedding an access token.
   • DDownload Prisma Cloud images from github.paloaltonetworks.com.

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

3. Question 43 · 242 in bank

   Which action would be applicable after enabling anomalous compute provisioning?

   • AIt detects the activity caused by the spambot.
   • BIt detects unusual server port activity or unusual protocol activity from a client within or outside the cloud environment.
   • CIt detects potential creation of an unauthorized network of compute instances with AutoFocus.
   • DIt detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking.

   Show answer

   Answer: D

   Explanation

   D --> the Anomalous compute provisioning activity policy is not enabled by default. When enabled, this policy detects potential creation of an unauthorized network of compute instances either accidentally or for cryptojacking. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

4. Question 44 · 242 in bank

   Select 3

   A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

   • AThe value of the mined currency exceeds $100.
   • BHigh CPU usage over time for the container is detected.
   • CCommon cryptominer process name was found.
   • DThe mined currency is associated with a user token.
   • ECommon cryptominer port usage was found.

   Show answer

   Answer: BCE

   Explanation

   B. High CPU usage over time for the container is a common indicator of a cryptominer attack. Cryptominers utilize the computational resources of a system to mine cryptocurrencies, which often leads to increased CPU usage. C. Detection of a common cryptominer process name can trigger an audit. Cryptominers typically run specific processes or executables with recognizable names that indicate their presence. E. Discovery of common cryptominer port usage can also generate an audit. Cryptominers often communicate with mining pools or other components using specific ports associated with cryptocurrency mining.

   Source: Adapted from community discussion — Spippolo

   Next question

5. Question 45 · 242 in bank

   What is the function of the external ID when onboarding a new Amazon Web Services (AWS) account in Prisma Cloud?

   • AIt is a unique identifier needed only when Monitor & Protect mode is selected.
   • BIt is the resource name for the Prisma Cloud Role.
   • CIt is a UUID that establishes a trust relationship between the Prisma Cloud account and the AWS account in order to extract data.
   • DIt is the default name of the PrismaCloudApp stack.

   Show answer

   Answer: C

   Explanation

   C https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OD3CAM&lang=en_US%E2%80%A9 IAM > Roles > Select your role for PrismaCloud > Trust relationships Make sure AWS Master External ID is matching as entered in Prisma Cloud Make sure Prisma Cloud account found in Trusted entities

   Source: Adapted from community discussion — Spippolo

   References

   • docs.paloaltonetworks.com documentation

   Next question

6. Question 46 · 242 in bank

   Which IAM Azure RQL query would correctly generate an output to view users who have sufficient permissions to create security groups within Azure AD and create applications?

   • Aconfig where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true
   • Bconfig from cloud.resource where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions exists
   • Cconfig from network where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is false and defaultUserRolePermissions.allowedToCreateApps is true
   • Dconfig from cloud.resource where api.name = ‘azure-active-directory-authorization-policy’ AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true and defaultUserRolePermissions.allowedToCreateApps is true

   Show answer

   Answer: D

   Next question

7. Question 47 · 242 in bank

   Select 2

   Which two bot types are part of Web Application and API Security (WAAS) bot protection? (Choose two.)

   • AChat bots
   • BUser-defined bots
   • CUnknown bots
   • DCustomer bots

   Show answer

   Answer: BC

   References

   • docs.paloaltonetworks.com documentation

   Next question

8. Question 48 · 242 in bank

   Select 2

   Which two actions are required in order to use the automated method within Amazon Web Services (AWS) Cloud to streamline the process of using remediation in the identity and access management (IAM) module? (Choose two.)

   • AInstall boto3 & requests library.
   • BConfigure IAM Azure remediation script.
   • CIntegrate with Azure Service Bus.
   • DConfigure IAM AWS remediation script.

   Show answer

   Answer: AD

   References

   • docs.paloaltonetworks.com documentation

   Next question

9. Question 49 · 242 in bank

   Select 3

   Which three public cloud providers are supported for VM image scanning? (Choose three.)

   • AGCP
   • BAlibaba
   • COracle
   • DAWS
   • EAzure

   Show answer

   Answer: ADE

   References

   • docs.paloaltonetworks.com documentation

   Next question

10. Question 50 · 242 in bank

    Select 2

    Where can Defender debug logs be viewed? (Choose two.)

    • A/var/lib/twistlock/defender.log
    • BFrom the Console, Manage > Defenders > Manage > Defenders. Select the Defender from the deployed Defenders list, then click Actions > Logs
    • CFrom the Console, Manage > Defenders > Deploy > Defenders. Select the Defender from the deployed Defenders list, then click Actions > Logs
    • D/var/lib/twistlock/log/defender.log

    Show answer

    Answer: BD

    Explanation

    B --> To view Defender’s debug logs, go to Manage > Defenders > Manage > Defenders. Select the Defender from the table and then click Actions > Logs. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/howto/review_debug_logs D --> Defender Logs Path : /var/lib/twistlock/log/defender.log.

    Source: Adapted from community discussion — Spippolo

    References

    • docs.paloaltonetworks.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCCSE practice, question 41. 242 questions available.