Real PCCSE Dumps - Prisma Certified Cloud Security Engineer PCCSE Dumps Questions and Answers

Real PCCSE Dumps – Prisma Certified Cloud Security Engineer PCCSE Dumps Questions and Answers

Eleanor2022-07-05T06:52:07+00:00

Do you know what is the Prisma Certified Cloud Security Engineer PCCSE exam? It is a hot Palo Alto Networks certification exam validating the knowledge, skills, and abilities required to onboard, deploy, and administer all aspects of Prisma Cloud. We have real PCCSE dumps online to help you prepare for the Prisma Certified Cloud Security Engineer PCCSE exam. The real PCCSE dumps questions and answers of ITPrepare are great to be your learning materials. ITPrepare offers the Prisma Certified Cloud Security Engineer PCCSE Exam dumps for the preparation of the PCCSE exam that will help you to pass the PCCSE exam with outstanding results on your first attempt.

Come Here To Read The Palo Alto Networks PCCSE Free Dumps

Page 1 of 4

1. A Prisma Cloud administrator is tasked with pulling a report via API. The Prisma Cloud tenant is located on app2.prismacloud.io.

What is the correct API endpoint?

https://api.prismacloud.io

https://api2.eu.prismacloud.io

httsp://api.prismacloud.cn

https://api2.prismacloud.io

2. If you are required to run in an air-gapped environment, which product should you install?

Prisma Cloud Jenkins Plugin

Prisma Cloud Compute Edition

Prisma Cloud with self-hosted plugin

Prisma Cloud Enterprise Edition

3. Which component(s), if any, will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?

Defenders

Console

Jenkins

twistcli

4. What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

policy

incident

audit

anomaly

5. Which three types of classifications are available in the Data Security module? (Choose three.)

Personally identifiable information

Malicious IP

Compliance standard

Financial information

Malware

6. A customer wants to monitor the company’s AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now.

Which two pieces of information do you need to onboard this account? (Choose two.)

Cloudtrail

Subscription ID

Active Directory ID

External ID

Role ARN

7. 1.The security team wants to target a CNAF policy for specific running Containers .

How should the administrator scope the policy to target the Containers?

scope the policy to Image names.

scope the policy to namespaces.

scope the policy to Defender names.

scope the policy to Host names.

8. Console is running in a Kubernetes cluster, and you need to deploy Defenders on nodes within this cluster.

Which option shows the steps to deploy the Defenders in Kubernetes using the default Console service name?

From the deployment page in Console, choose pod name for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace.

From the deployment page configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes.

From the deployment page in Console, choose twistlock-console for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

From the deployment page in Console, choose twistlock-console for Console identifier, and run the curl | bash script on the master Kubernetes node.

9. Which option identifies the Prisma Cloud Compute Edition?

Package installed with APT

Downloadable, self-hosted software

Software-as-a-Service (SaaS)

Plugin to Prisma Cloud

10. A customer has serverless functions that are deployed in multiple clouds.

Which serverless cloud provider is covered be “overly permissive service access” compliance check?

Alibaba

GCP

AWS

Azure

Page 2 of 4

11. Which container scan is constructed correctly?

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 -- container myimage/latest

twistcli images scan --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

twistcli images scan -u api -p api --address https://us-west1.cloud.twistlock.com/us-3-123456789 --details myimage/latest

twistcli images scan -u api -p api --docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest

12. Which options show the steps required to upgrade Console when using projects?

Upgrade all Supervisor Consoles Upgrade Central Console

Upgrade Central Console Upgrade Central Console Defenders

Upgrade Defender Upgrade Central Console Upgrade Supervisor Consoles

Upgrade Central Console Upgrade all Supervisor Consoles

13. How are the following categorized?

Backdoor account access Hijacked processes Lateral movement

Port scanning

audits

incidents

admission controllers

models

14. A customer does not want alerts to be generated from network traffic that originates from trusted internal networks.

Which setting should you use to meet this customer’s request?

Trusted Login IP Addresses

Anomaly Trusted List

Trusted Alert IP Addresses

Enterprise Alert Disposition

15. An administrator has been tasked with a requirement by your DevSecOps team to write a script to continuously query programmatically the existing users, and the user’s associated permission levels, in a Prisma Cloud Enterprise tenant.

Which public documentation location should be reviewed to help determine the required attributes to carry out this step?

Prisma Cloud Administrator’s Guide (Compute)

Prisma Cloud API Reference

Prisma Cloud Compute API Reference

Prisma Cloud Enterprise Administrator’s Guide

16. DRAG DROP

An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

In which order should the API calls be used to accomplish this task? (Drag the steps intothe correct order from the first step to the last.) Select and Place:

17. A customer has a requirement to automatically protect all Lambda functions with runtime protection .

What is the process to automatically protect all the Lambda functions?

Configure a function scan policy from the Defend/Vulnerabilities/Functions page.

Configure serverless radar from the Defend/Compliance/Cloud Platforms page.

Configure a manually embedded Lambda Defender.

Configure a serverless auto-protect rule for the functions.

18. Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?

Host

Container

Functions

Image

19. Which two required request headers interface with Prisma Cloud API? (Choose two.)

Content-type:application/json

x-redlock-auth

>x-redlock-request-id

Content-type:application/xml

20. A security team has a requirement to ensure the environment is scanned for vulnerabilities .

What are three options for configuring vulnerability policies? (Choose three.)

individual actions based on package type

output verbosity for blocked requests

apply policy only when vendor fix is available

individual grace periods for each severity level

customize message on blocked requests

Page 3 of 4

21. Which statement is true regarding CloudFormation templates?

Scan support does not currently exist for nested references, macros, or intrinsic functions.

A single template or a zip archive of template files cannot be scanned with a single API request.

Request-Header-Field ‘cloudformation-version’ is required to request a scan.

Scan support is provided for JSON, HTML and YAML formats.

22. Which API calls can scan an image named myimage: latest with twistcli and then retrieve the results from Console?

$ twistcli images scan --address <COMPUTE_CONSOLE> --user <COMPUTER_CONSOLE_USER> --password <COMPUTER_CONSOLE_PASSWD> --verbose myimage: latest

$ twistcli images scan --address <COMPUTE_CONSOLE> --user <COMPUTER_CONSOLE_USER> --password <COMPUTER_CONSOLE_PASSWD> --details myimage: latest

$ twistcli images scan --address <COMPUTE_CONSOLE> --user <COMPUTER_CONSOLE_USER> --password <COMPUTER_CONSOLE_PASSWD> myimage: latest

$ twistcli images scan --address <COMPUTE_CONSOLE> --user <COMPUTER_CONSOLE_USER> --password <COMPUTER_CONSOLE_PASSWD> --console myimage: latest

23. What is the maximum number of access keys a user can generate in Prisma Cloud with a System Admin role?

24. The security auditors need to ensure that given compliance checks are being run on the host .

Which option is a valid host compliance policy?

Ensure functions are not overly permissive.

Ensure host devices are not directly exposed to containers.

Ensure images are created with a non-root user.

Ensure compliant Docker daemon configuration.

25. A customer has a requirement to restrict any container from resolving the name www.evil-url.com.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name in the Container policy and set the policy effect to alert.

Set www.evil-url.com as a blocklisted DNS name in the default Container runtime policy, and set the effect to block.

Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name, and set the effect to prevent.

Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.

26. Which option shows the steps to install the Console in a Kubernetes Cluster?

Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl

Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl

Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl

Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl

27. Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?

single sign-on

SAML

basic authentication

access key

28. Which statement accurately characterizes SSO Integration on Prisma Cloud?

Prisma Cloud supports IdP initiated SSO, and its SAML endpoint supports the POST and GET methods.

Okta, Azure Active Directory, PingID, and others are supported via SAM

An administrator can configure different Identity Providers (IdP) for all the cloud accounts that Prisma Cloud monitors.

An administrator who needs to access the Prisma Cloud API can use SSO after configuration.

29. An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy “AWS S3 buckets are accessible to public”.

The policy definition follows:

config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[? (@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist"

Why did this alert get generated?

an event within the cloud account

network traffic to the S3 bucket

configuration of the S3 bucket

anomalous behaviors

30. A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.

Which two reasons explain this change in alert status? (Choose two.)

user manually changed the alert status.

policy was changed.

resource was deleted.

alert was sent to an external integration.

Page 4 of 4

31. When would a policy apply if the policy is set under Defend > Vulnerability > Images > Deployed?

when a serverless repository is scanned

when a Container is started form an Image

when the Image is built and when a Container is started form an Image

when the Image is built

32. Which three steps are involved in onboarding an account for Data Security? (Choose three.)

Create a read-only role with in-line policies

Create a Cloudtrail with SNS Topic

Enable Flow Logs

Enter the RoleARN and SNSARN

Create a S3 bucket

33. A customer has multiple violations in the environment including:

User namespace is enabled

An LDAP server is enabled

SSH root is enabled

Which section of Console should the administrator use to review these findings?

Manage

Vulnerabilities

Radar

Compliance

34. A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80.

Which port should the team specify in the CNAF rule to protect the application?

443

8080

8888

35. A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible.

Which action should the SOC take to follow security best practices?

Enable “AWS S3 bucket is publicly accessible” policy and manually remediate each alert.

Enable “AWS RDS database instance is publicly accessible” policy and for each alert, check that it is a production instance, and then manually remediate.

Enable “AWS S3 bucket is publicly accessible” policy and add policy to an auto-remediation alert rule.

Enable “AWS RDS database instance is publicly accessible” policy and add policy to an auto-remediation alert rule.

36. Given the following RQL:

event from cloud.audit_logs where operation IN (‘CreateCryptoKey’, ‘DestroyCryptoKeyVersion’, ‘v1.compute.disks.createSnapshot’)

Which audit event snippet is identified?

A)

Option A

Option B

Option C

Option D

37. Per security requirements, an administrator needs to provide a list of people who are receiving e-mails for Prisma Cloud alerts.

Where can the administrator locate this list of e-mail recipients?

Target section within an Alert Rule.

Notification Template section within Alerts.

Users section within Settings.

Set Alert Notification section within an Alert Rule.

38. Given the following RQL:

Which audit event snippet is identified by the RQL?

A)

Option A

Option B

Option C

Option D

39. The development team wants to fail CI jobs where a specific CVE is contained within the image .

How should the development team configure the pipeline or policy to produce this outcome?

Set the specific CVE exception as an option in Jenkins or twistcli.

Set the specific CVE exception as an option in Defender running the scan.

Set the specific CVE exception as an option using the magic string in the Console.

Set the specific CVE exception in Console’s CI policy.

40. DRAG DROP

An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.

In which order will the APIs be executed for this service?(Drag the steps into the correct order of occurrence, from the first step to the last.)

Real PCCSE Dumps – Prisma Certified Cloud Security Engineer PCCSE Dumps Questions and Answers