Question #1
Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default.
Where should the customer navigate in Console?
- A . Monitor > Compliance
- B . Defend > Compliance
- C . Manage > Compliance
- D . Custom > Compliance
Correct Answer: B
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/manage_compliance.html
In the context of Prisma Cloud by Palo Alto Networks, the correct navigation to identify alerted compliance checks set by default is under the "Defend" section, specifically at "Defend > Compliance." This section is designed to allow users to configure and manage compliance policies and rules, monitor compliance statuses, and review alerts related to compliance violations. The "Defend" section is tailored for setting up defenses, including compliance standards, against potential security risks within the cloud environment, making it the logical location for managing and reviewing compliance-related alerts and settings.
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/manage_compliance.html
In the context of Prisma Cloud by Palo Alto Networks, the correct navigation to identify alerted compliance checks set by default is under the "Defend" section, specifically at "Defend > Compliance." This section is designed to allow users to configure and manage compliance policies and rules, monitor compliance statuses, and review alerts related to compliance violations. The "Defend" section is tailored for setting up defenses, including compliance standards, against potential security risks within the cloud environment, making it the logical location for managing and reviewing compliance-related alerts and settings.
Question #2
Which container scan is constructed correctly?
- A . twistcli images scan -u api -p api –address https://us-west1.cloud.twistlock.com/us-3-123456789 – – container myimage/latest
- B . twistcli images scan –docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest
- C . twistcli images scan -u api -p api –address https://us-west1.cloud.twistlock.com/us-3-123456789 – -details myimage/latest
- D . twistcli images scan -u api -p api –docker-address https://us-west1.cloud.twistlock.com/us-3-
123456789 myimage/latest
Correct Answer: C
C
Explanation:
The correct construction for a container scan using the TwistCLI tool provided by Prisma Cloud (formerly Twistlock) is shown in option
C. This command uses the TwistCLI tool to scan a container image, specifying the necessary authentication credentials (username and password with ‘-u’ and ‘-p’ flags), the address of the Prisma Cloud instance (with the ‘–address’ flag), and the image to be scanned (in this case, ‘myimage/latest’). The inclusion of the ‘–details’ flag is a common practice to obtain detailed scan results, which is crucial for in-depth analysis and remediation efforts. This command structure aligns with the standard usage of TwistCLI for image scanning purposes, as documented in Prisma Cloud’s official resources and guides.
C
Explanation:
The correct construction for a container scan using the TwistCLI tool provided by Prisma Cloud (formerly Twistlock) is shown in option
C. This command uses the TwistCLI tool to scan a container image, specifying the necessary authentication credentials (username and password with ‘-u’ and ‘-p’ flags), the address of the Prisma Cloud instance (with the ‘–address’ flag), and the image to be scanned (in this case, ‘myimage/latest’). The inclusion of the ‘–details’ flag is a common practice to obtain detailed scan results, which is crucial for in-depth analysis and remediation efforts. This command structure aligns with the standard usage of TwistCLI for image scanning purposes, as documented in Prisma Cloud’s official resources and guides.
Question #3
The development team wants to fail CI jobs where a specific CVE is contained within the image.
How should the development team configure the pipeline or policy to produce this outcome?
- A . Set the specific CVE exception as an option in Jenkins or twistcli.
- B . Set the specific CVE exception as an option in Defender running the scan.
- C . Set the specific CVE exception as an option using the magic string in the Console.
- D . Set the specific CVE exception in Console’s CI policy.
Correct Answer: D
D
Explanation:
Reference tech docs: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/set_policy_ci_plugins.html
Vulnerability rules that target the build tool can allow specific vulnerabilities by creating an exception and setting the effect to ‘ignore’. Block them by creating an exception and setting hte effect to ‘fail’. For example, you could create a vulnerability rule that explicitly allows CVE-2018-1234 to suppress warnings in the scan results.
To fail CI jobs based on a specific CVE contained within an image, the development team should configure the policy within Prisma Cloud’s Console, specifically within the Continuous Integration (CI) policy settings. By setting a specific CVE exception in the CI policy, the team can define criteria that will cause the CI process to fail if the specified CVE is detected in the scanned image. This approach allows for granular control over the build process, ensuring that images with known vulnerabilities are not promoted through the CI/CD pipeline, thereby maintaining the security posture of the deployed applications. This method is in line with best practices for integrating security into the CI/CD process, allowing for automated enforcement of security standards directly within the development pipeline.
D
Explanation:
Reference tech docs: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/set_policy_ci_plugins.html
Vulnerability rules that target the build tool can allow specific vulnerabilities by creating an exception and setting the effect to ‘ignore’. Block them by creating an exception and setting hte effect to ‘fail’. For example, you could create a vulnerability rule that explicitly allows CVE-2018-1234 to suppress warnings in the scan results.
To fail CI jobs based on a specific CVE contained within an image, the development team should configure the policy within Prisma Cloud’s Console, specifically within the Continuous Integration (CI) policy settings. By setting a specific CVE exception in the CI policy, the team can define criteria that will cause the CI process to fail if the specified CVE is detected in the scanned image. This approach allows for granular control over the build process, ensuring that images with known vulnerabilities are not promoted through the CI/CD pipeline, thereby maintaining the security posture of the deployed applications. This method is in line with best practices for integrating security into the CI/CD process, allowing for automated enforcement of security standards directly within the development pipeline.
Question #4
Which three types of classifications are available in the Data Security module? (Choose three.)
- A . Personally identifiable information
- B . Malicious IP
- C . Compliance standard
- D . Financial information
- E . Malware
Correct Answer: ACD
ACD
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security.html
In the Data Security module of Prisma Cloud, the classifications available focus on the types of sensitive data that need protection. These classifications include Personally Identifiable Information (PII), which involves data that can be used on its own or with other information to identify, contact, or locate a single person. Compliance standards pertain to data that must be protected to meet specific regulatory requirements, such as GDPR, HIPAA, or PCI-DSS. Financial information classification is concerned with data related to financial transactions, accounts, and credit card numbers, which are critical to secure due to their sensitive nature. These classifications are integral to data security strategies, ensuring that sensitive information is adequately protected according to its nature and the regulatory requirements governing it.
ACD
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-data-security.html
In the Data Security module of Prisma Cloud, the classifications available focus on the types of sensitive data that need protection. These classifications include Personally Identifiable Information (PII), which involves data that can be used on its own or with other information to identify, contact, or locate a single person. Compliance standards pertain to data that must be protected to meet specific regulatory requirements, such as GDPR, HIPAA, or PCI-DSS. Financial information classification is concerned with data related to financial transactions, accounts, and credit card numbers, which are critical to secure due to their sensitive nature. These classifications are integral to data security strategies, ensuring that sensitive information is adequately protected according to its nature and the regulatory requirements governing it.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #5
A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . set the Container model to manual relearn and set the default runtime rule to block for process protection.
- B . set the Container model to relearn and set the default runtime rule to prevent for process protection.
- C . add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to “prevent”.
- D . choose “copy into rule” for the Container, add a ransomWare process into the denied process list, and set the action to “block”.
Correct Answer: C
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
C
Explanation:
To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively
monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.
Question #14
Retrieve the Prisma Cloud Console images using ‘docker pull’.
Correct Answer: A
Explanation:
Retrieving Prisma Cloud Console images involves accessing a specific registry provided by Palo Alto Networks and authenticating using basic authentication with ‘docker login’. Once authenticated, the user can pull the Prisma Cloud Console images using the ‘docker pull’ command. This process is part of the initial setup for deploying Prisma Cloud Console in an environment, allowing users to obtain the necessary images to run the Console, which serves as the central management interface for Prisma Cloud. The detailed steps, including the specific registry URL and authentication method, are typically provided in the Prisma Cloud documentation, ensuring that users have the information needed to successfully retrieve and deploy Console images.
Explanation:
Retrieving Prisma Cloud Console images involves accessing a specific registry provided by Palo Alto Networks and authenticating using basic authentication with ‘docker login’. Once authenticated, the user can pull the Prisma Cloud Console images using the ‘docker pull’ command. This process is part of the initial setup for deploying Prisma Cloud Console in an environment, allowing users to obtain the necessary images to run the Console, which serves as the central management interface for Prisma Cloud. The detailed steps, including the specific registry URL and authentication method, are typically provided in the Prisma Cloud documentation, ensuring that users have the information needed to successfully retrieve and deploy Console images.
Question #15
Which two statements are true about the differences between build and run config policies? (Choose two.)
- A . Run and Network policies belong to the configuration policy set.
- B . Build and Audit Events policies belong to the configuration policy set.
- C . Run policies monitor resources, and check for potential issues after these cloud resources are deployed.
- D . Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.
- E . Run policies monitor network activities in your environment, and check for potential issues during
runtime.
Correct Answer: CD
CD
Explanation:
In the context of Prisma Cloud, Build and Run policies serve distinct purposes in securing cloud environments. Build policies are designed to evaluate Infrastructure as Code (IaC) templates before deployment. These policies help identify and remediate security misconfigurations in the development phase, ensuring that vulnerabilities are addressed before the infrastructure is provisioned. This proactive approach enhances security by preventing misconfigurations from reaching production environments.
On the other hand, Run policies are applied to resources that are already deployed in the cloud. These policies continuously monitor the cloud environment, detecting and alerting on potential security issues that arise in the runtime. Run policies help maintain the security posture of cloud resources by identifying deviations from established security baselines and enabling quick remediation of identified issues.
Both Build and Run policies are integral to a comprehensive cloud security strategy, addressing security concerns at different stages of the cloud resource lifecycle―from development and deployment to ongoing operation.
CD
Explanation:
In the context of Prisma Cloud, Build and Run policies serve distinct purposes in securing cloud environments. Build policies are designed to evaluate Infrastructure as Code (IaC) templates before deployment. These policies help identify and remediate security misconfigurations in the development phase, ensuring that vulnerabilities are addressed before the infrastructure is provisioned. This proactive approach enhances security by preventing misconfigurations from reaching production environments.
On the other hand, Run policies are applied to resources that are already deployed in the cloud. These policies continuously monitor the cloud environment, detecting and alerting on potential security issues that arise in the runtime. Run policies help maintain the security posture of cloud resources by identifying deviations from established security baselines and enabling quick remediation of identified issues.
Both Build and Run policies are integral to a comprehensive cloud security strategy, addressing security concerns at different stages of the cloud resource lifecycle―from development and deployment to ongoing operation.
Question #16
A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.
What will be the effect if the security team chooses to Relearn on this image?
- A . The model is deleted, and Defender will relearn for 24 hours.
- B . The anomalies detected will automatically be added to the model.
- C . The model is deleted and returns to the initial learning state.
- D . The model is retained, and any new behavior observed during the new learning period will be added to the existing model.
Correct Answer: D
D
Explanation:
In Prisma Cloud, when anomalies are detected and the security team chooses to Relearn on a specific image, the existing behavioral model for that image is not deleted. Instead, the system retains the model and enters a new learning period, during which it observes the behavior of the container based on the image. If new behaviors are observed during this period, they are added to the existing model, thereby refining and updating the model to reflect the current operational profile of the container. This approach allows for dynamic adaptation to changes in container behavior while preserving the valuable insights and patterns already established in the model. The Relearn function is part of Prisma Cloud’s adaptive capabilities, enabling it to maintain accurate and up-to-date behavioral models that reflect the evolving nature of containerized applications.
D
Explanation:
In Prisma Cloud, when anomalies are detected and the security team chooses to Relearn on a specific image, the existing behavioral model for that image is not deleted. Instead, the system retains the model and enters a new learning period, during which it observes the behavior of the container based on the image. If new behaviors are observed during this period, they are added to the existing model, thereby refining and updating the model to reflect the current operational profile of the container. This approach allows for dynamic adaptation to changes in container behavior while preserving the valuable insights and patterns already established in the model. The Relearn function is part of Prisma Cloud’s adaptive capabilities, enabling it to maintain accurate and up-to-date behavioral models that reflect the evolving nature of containerized applications.
Question #17
A customer does not want alerts to be generated from network traffic that originates from trusted internal networks.
Which setting should you use to meet this customer’s request?
- A . Trusted Login IP Addresses
- B . Anomaly Trusted List
- C . Trusted Alert IP Addresses
- D . Enterprise Alert Disposition
Correct Answer: C
C
Explanation:
B –> Anomaly Trusted List―Exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default.
C –> Trusted Alert IP Addresses―If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted … Prisma Cloud default network policies that look for internet exposed instances also do not generate alerts when the source IP address is included in the trusted IP address list and the account hijacking anomaly policy filters out activities from known IP addresses. Also, when you use RQL to query network traffic, you can filter out traffic from known networks that are included in the trusted IP address list.
For a customer who does not want alerts to be generated from network traffic originating from trusted internal networks, the appropriate setting is C. Trusted Alert IP Addresses. This setting allows for specifying certain IP addresses as trusted, meaning alerts will not be triggered by activities from these IPs, ensuring that internal network traffic is not flagged as potentially malicious.
C
Explanation:
B –> Anomaly Trusted List―Exclude trusted IP addresses when conducting tests for PCI compliance or penetration testing on your network. Any addresses included in this list do not generate alerts against the Prisma Cloud Anomaly Policies that detect unusual network activity such as the policies that detect internal port scan and port sweep activity, which are enabled by default.
C –> Trusted Alert IP Addresses―If you have internal networks that connect to your public cloud infrastructure, you can add these IP address ranges (or CIDR blocks) as trusted … Prisma Cloud default network policies that look for internet exposed instances also do not generate alerts when the source IP address is included in the trusted IP address list and the account hijacking anomaly policy filters out activities from known IP addresses. Also, when you use RQL to query network traffic, you can filter out traffic from known networks that are included in the trusted IP address list.
For a customer who does not want alerts to be generated from network traffic originating from trusted internal networks, the appropriate setting is C. Trusted Alert IP Addresses. This setting allows for specifying certain IP addresses as trusted, meaning alerts will not be triggered by activities from these IPs, ensuring that internal network traffic is not flagged as potentially malicious.
Question #18
A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps.
Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?
- A . The SecOps lead should investigate the attack using Vulnerability Explorer and Runtime Radar.
- B . The SecOps lead should use Incident Explorer and Compliance Explorer.
- C . The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits.
- D . The SecOps lead should review the vulnerability scans in the CI/CD process to determine blame.
Correct Answer: C
C
Explanation:
To investigate the runtime aspects of a potential data exfiltration attempt, the SecOps lead in Prisma Cloud Compute should focus on areas that provide insights into runtime activity and potential threats.
C. The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits. These sections provide detailed information on security incidents and container-level activities, enabling a thorough investigation into the runtime behavior that might indicate a security issue.
C
Explanation:
To investigate the runtime aspects of a potential data exfiltration attempt, the SecOps lead in Prisma Cloud Compute should focus on areas that provide insights into runtime activity and potential threats.
C. The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits. These sections provide detailed information on security incidents and container-level activities, enabling a thorough investigation into the runtime behavior that might indicate a security issue.
Question #19
A customer finds that an open alert from the previous day has been resolved. No auto-remediation was configured.
Which two reasons explain this change in alert status? (Choose two.)
- A . user manually changed the alert status.
- B . policy was changed.
- C . resource was deleted.
- D . alert was sent to an external integration.
Correct Answer: AC
AC
Explanation:
When an open alert from the previous day has been resolved without any configured auto-remediation, the change in alert status could be due to A. a user manually changing the alert status, indicating a manual intervention where someone reviewed and updated the alert status, and C. resource was deleted, implying that the resolution of the alert could be due to the removal of the resource associated with the alert, hence nullifying the alert condition.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/prisma-cloud-alert-resolution-reasons.html
AC
Explanation:
When an open alert from the previous day has been resolved without any configured auto-remediation, the change in alert status could be due to A. a user manually changing the alert status, indicating a manual intervention where someone reviewed and updated the alert status, and C. resource was deleted, implying that the resolution of the alert could be due to the removal of the resource associated with the alert, hence nullifying the alert condition.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/prisma-cloud-alert-resolution-reasons.html
Question #20
Which three steps are involved in onboarding an account for Data Security? (Choose three.)
- A . Create a read-only role with in-line policies
- B . Create a Cloudtrail with SNS Topic
- C . Enable Flow Logs
- D . Enter the RoleARN and SNSARN
- E . Create a S3 bucket
Correct Answer: BDE
BDE
Explanation:
Onboarding an account for Data Security involves several critical steps to ensure comprehensive coverage and effective monitoring.
The steps involved include B. Create a Cloudtrail with SNS Topic to track and manage API calls and relevant notifications, D. Enter the RoleARN and SNSARN to provide necessary access and integration points for data security functions, and E. Create a S3 bucket
which serves as a storage solution for logging and data capture essential for security analysis.
BDE
Explanation:
Onboarding an account for Data Security involves several critical steps to ensure comprehensive coverage and effective monitoring.
The steps involved include B. Create a Cloudtrail with SNS Topic to track and manage API calls and relevant notifications, D. Enter the RoleARN and SNSARN to provide necessary access and integration points for data security functions, and E. Create a S3 bucket
which serves as a storage solution for logging and data capture essential for security analysis.
Question #21
An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.
In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS.
Which port will twistcli need to use to access the Prisma Compute APIs?
- A . 8084
- B . 443
- C . 8083
- D . 8081
Correct Answer: A
A
Explanation:
When the administrator wants twistcli to communicate with the Console over HTTPS in a Kubernetes cluster, and considering the load balancer is configured in TCP passthrough mode, A. 8084 is typically the port used for secure HTTPS communication with the Prisma Compute Console. This port will allow twistcli to access the Prisma Compute APIs securely.
https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console
A
Explanation:
When the administrator wants twistcli to communicate with the Console over HTTPS in a Kubernetes cluster, and considering the load balancer is configured in TCP passthrough mode, A. 8084 is typically the port used for secure HTTPS communication with the Prisma Compute Console. This port will allow twistcli to access the Prisma Compute APIs securely.
https://docs.prismacloudcompute.com/docs/compute_edition_21_04/tools/twistcli.html#connectivity-to-console
Question #22
A customer is reviewing Container audits, and an audit has identified a cryptominer attack.
Which three options could have generated this audit? (Choose three.)
- A . The value of the mined currency exceeds $100.
- B . High CPU usage over time for the container is detected.
- C . Common cryptominer process name was found.
- D . The mined currency is associated with a user token.
- E . Common cryptominer port usage was found.
Correct Answer: BCE
BCE
Explanation:
In the case of identifying a cryptominer attack through container audits, the options that could have generated this audit include B. High CPU usage over time for the container is detected, which is a common indicator of cryptomining activity as it consumes significant computational resources, C. Common cryptominer process name was found, which directly indicates the presence of cryptomining based on known malicious processes, and E. Common cryptominer port usage was found, suggesting cryptomining activity based on network behavior typical of such attacks.
BCE
Explanation:
In the case of identifying a cryptominer attack through container audits, the options that could have generated this audit include B. High CPU usage over time for the container is detected, which is a common indicator of cryptomining activity as it consumes significant computational resources, C. Common cryptominer process name was found, which directly indicates the presence of cryptomining based on known malicious processes, and E. Common cryptominer port usage was found, suggesting cryptomining activity based on network behavior typical of such attacks.
Question #23
Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?
- A . copy the Console address and set the config map for the default namespace.
- B . create a new namespace in Kubernetes called admission-controller.
- C . enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console.
- D . copy the admission controller configuration from the Console and apply it to Kubernetes.
Correct Answer: D
D
Explanation:
When configuring Kubernetes to use Prisma Cloud Compute as an admission controller, a crucial step Involves D. copy the admission controller configuration from the Console and apply it to Kubernetes.
This step is essential for integrating Prisma Cloud Compute’s security controls directly into the Kubernetes admission process, enabling real-time security assessments and policy enforcement for new or modified resources within the cluster.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-04/prisma-cloud-compute-edition- admin/access_control/open_policy_agent.html step 2
D
Explanation:
When configuring Kubernetes to use Prisma Cloud Compute as an admission controller, a crucial step Involves D. copy the admission controller configuration from the Console and apply it to Kubernetes.
This step is essential for integrating Prisma Cloud Compute’s security controls directly into the Kubernetes admission process, enabling real-time security assessments and policy enforcement for new or modified resources within the cluster.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-04/prisma-cloud-compute-edition- admin/access_control/open_policy_agent.html step 2
Question #24
A Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud.
Which two steps can be performed by the Terraform script? (Choose two.)
- A . enable flow logs for Prisma Cloud.
- B . create the Prisma Cloud role.
- C . enable the required APIs for Prisma Cloud.
- D . publish the flow log to a storage bucket.
Correct Answer: BC
BC
Explanation:
When a Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud, the Terraform script can perform several steps to facilitate this integration. The steps include B. create the Prisma Cloud role, which is essential for defining the permissions and capabilities that Prisma Cloud will have within the GCP environment, and C. enable the required APIs for Prisma Cloud, ensuring that Prisma Cloud can access the necessary GCP services and features for comprehensive cloud security management.
BC
Explanation:
When a Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud, the Terraform script can perform several steps to facilitate this integration. The steps include B. create the Prisma Cloud role, which is essential for defining the permissions and capabilities that Prisma Cloud will have within the GCP environment, and C. enable the required APIs for Prisma Cloud, ensuring that Prisma Cloud can access the necessary GCP services and features for comprehensive cloud security management.
Question #25
Which statement about build and run policies is true?
- A . Build policies enable you to check for security misconfigurations in the IaC templates.
- B . Every type of policy has auto-remediation enabled by default.
- C . The four main types of policies are: Audit Events, Build, Network, and Run.
- D . Run policies monitor network activities in the environment and check for potential issues during runtime.
Correct Answer: A
A
Explanation:
A true statement about build and run policies is
A
Explanation:
A true statement about build and run policies is
Question #26
An administrator sees that a runtime audit has been generated for a host. The audit message is: “Service postfix attempted to obtain capability SHELL by executing /bin/sh /usr/libexec/postfix/postfix- script.stop. Low severity audit, event is automatically added to the runtime model”
Which runtime host policy rule is the root cause for this runtime audit?
- A . Custom rule with specific configuration for file integrity
- B . Custom rule with specific configuration for networking
- C . Default rule that alerts on capabilities
- D . Default rule that alerts on suspicious runtime behavior
Correct Answer: D
D
Explanation:
For a runtime audit generated for a host with a message indicating a service attempting to obtain capability by executing a script, the root cause for this runtime audit is most likely related to D. Default rule that alerts on suspicious runtime behavior. This default rule is designed to flag unusual or potentially harmful activities that could indicate a security risk, prompting further investigation.
D
Explanation:
For a runtime audit generated for a host with a message indicating a service attempting to obtain capability by executing a script, the root cause for this runtime audit is most likely related to D. Default rule that alerts on suspicious runtime behavior. This default rule is designed to flag unusual or potentially harmful activities that could indicate a security risk, prompting further investigation.
Question #27
Which option identifies the Prisma Cloud Compute Edition?
- A . Package installed with APT
- B . Downloadable, self-hosted software
- C . Software-as-a-Service (SaaS)
- D . Plugin to Prisma Cloud
Correct Answer: B
B
Explanation:
The Prisma Cloud Compute Edition is identified as B. Downloadable, self-hosted software. This option indicates that Prisma Cloud Compute Edition is a solution that organizations can deploy within their own infrastructure, providing them with control over the installation, configuration, and management of the security platform.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/welcome/pcee_vs_pcce.html
B
Explanation:
The Prisma Cloud Compute Edition is identified as B. Downloadable, self-hosted software. This option indicates that Prisma Cloud Compute Edition is a solution that organizations can deploy within their own infrastructure, providing them with control over the installation, configuration, and management of the security platform.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/welcome/pcee_vs_pcce.html
Question #28
Which type of compliance check is available for rules under Defend > Compliance > Containers and Images > CI?
- A . Host
- B . Container
- C . Functions
- D . Image
Correct Answer: D
D
Explanation:
In the context of Defend > Compliance > Containers and Images > CI within Prisma Cloud by Palo Alto Networks, the compliance checks are focused on the security posture and compliance of container images. Therefore, the type of compliance check available under this section would be related to Images, ensuring they adhere to security best practices and compliance standards before being deployed.
D
Explanation:
In the context of Defend > Compliance > Containers and Images > CI within Prisma Cloud by Palo Alto Networks, the compliance checks are focused on the security posture and compliance of container images. Therefore, the type of compliance check available under this section would be related to Images, ensuring they adhere to security best practices and compliance standards before being deployed.
Question #29
The security team wants to protect a web application container from an SQLi attack.
Which type of policy should the administrator create to protect the container?
- A . CNAF
- B . Runtime
- C . Compliance
- D . CNNF
Correct Answer: A
A
Explanation:
To protect a web application container from an SQL Injection (SQLi) attack, the administrator should create a Cloud Native Application Firewall (CNAF) policy. CNAF policies are designed to protect applications running in containers from various types of attacks, including SQLi, by inspecting the traffic going to and from the containerized applications and blocking malicious requests.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition- admin/firewalls/waas
A
Explanation:
To protect a web application container from an SQL Injection (SQLi) attack, the administrator should create a Cloud Native Application Firewall (CNAF) policy. CNAF policies are designed to protect applications running in containers from various types of attacks, including SQLi, by inspecting the traffic going to and from the containerized applications and blocking malicious requests.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition- admin/firewalls/waas
Question #30
An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy “AWS
S3 buckets are accessible to public”.
The policy definition follows:
config where cloud.type = ‘aws’ AND api.name=’aws-s3api-get-bucket-acl’ AND json.rule="((((acl.grants[? (@.grantee==’AllUsers’)] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee==’AllUsers’)] size > 0) and publicAccessBlockConfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist"
Why did this alert get generated?
- A . an event within the cloud account
- B . network traffic to the S3 bucket
- C . configuration of the S3 bucket
- D . anomalous behaviors
Correct Answer: C
C
Explanation:
The alert "AWS S3 buckets are accessible to public" is generated due to the configuration of the S3 bucket, which has been set in a way that allows public access. The policy definition provided checks for various conditions that would make an S3 bucket publicly accessible, such as grants to ‘AllUsers’, the absence of a ‘publicAccessBlockConfiguration’, or specific configurations that do not restrict public access. Therefore, the alert is triggered by the configuration settings of the S3 bucket that violate the policy’s criteria for public accessibility.
C
Explanation:
The alert "AWS S3 buckets are accessible to public" is generated due to the configuration of the S3 bucket, which has been set in a way that allows public access. The policy definition provided checks for various conditions that would make an S3 bucket publicly accessible, such as grants to ‘AllUsers’, the absence of a ‘publicAccessBlockConfiguration’, or specific configurations that do not restrict public access. Therefore, the alert is triggered by the configuration settings of the S3 bucket that violate the policy’s criteria for public accessibility.
Question #31
DRAG DROP
Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #31
DRAG DROP
Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #31
DRAG DROP
Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #31
DRAG DROP
Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #31
DRAG DROP
Which order of steps map a policy to a custom compliance standard? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #36
A customer is interested in PCI requirements and needs to ensure that no privilege containers can start in the environment.
Which action needs to be set for “do not use privileged containers”?
- A . Prevent
- B . Alert
- C . Block
- D . Fail
Correct Answer: C
C
Explanation:
Block ― Defender stops the entire container if a process that violates your policy attempts to run.
https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect
C
Explanation:
Block ― Defender stops the entire container if a process that violates your policy attempts to run.
https://docs.prismacloudcompute.com/docs/enterprise_edition/runtime_defense/runtime_defense_containers.html#_effect
Question #37
Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?
- A . The console cannot natively run in an ECS cluster. A onebox deployment should be used.
- B . Download and extract the release tarball
Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition - C . Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition
- D . Download and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition
Correct Answer: D
D
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition- admin/install/install_amazon_ecs.html
To install the Console in an Amazon ECS Cluster, the steps involve downloading and extracting the release tarball, which contains the necessary files for the Console. Then, an Amazon Elastic File System (EFS) should be created and mounted to each node in the ECS cluster to provide shared storage for Console data. Following this, a Console task definition needs to be created in ECS, which defines how the Console container should run. Finally, this task definition is deployed to the ECS cluster to start the Console.
D
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-compute-edition- admin/install/install_amazon_ecs.html
To install the Console in an Amazon ECS Cluster, the steps involve downloading and extracting the release tarball, which contains the necessary files for the Console. Then, an Amazon Elastic File System (EFS) should be created and mounted to each node in the ECS cluster to provide shared storage for Console data. Following this, a Console task definition needs to be created in ECS, which defines how the Console container should run. Finally, this task definition is deployed to the ECS cluster to start the Console.
Question #38
Which options show the steps required to upgrade Console when using projects?
- A . Upgrade all Supervisor Consoles Upgrade Central Console
- B . Upgrade Central Console
Upgrade Central Console Defenders - C . Upgrade Defender Upgrade Central Console
Upgrade Supervisor Consoles - D . Upgrade Central Console Upgrade all Supervisor Consoles
Correct Answer: A
A
Explanation:
When you have one or more tenant or scale Projects, upgrade all Supervisors before upgrading the Central Console. https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process
A
Explanation:
When you have one or more tenant or scale Projects, upgrade all Supervisors before upgrading the Central Console. https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition-admin/upgrade/upgrade_process
Question #39
A customer has Prisma Cloud Enterprise and host Defenders deployed.
What are two options that allow an administrator to upgrade Defenders? (Choose two.)
- A . with auto-upgrade, the host Defender will auto-upgrade.
- B . auto deploy the Lambda Defender.
- C . click the update button in the web-interface.
- D . generate a new DaemonSet file.
Correct Answer: AD
AD
Explanation:
In Prisma Cloud, Defenders can be set to auto-upgrade, which is a feature that allows the host Defender to automatically upgrade to the latest version without manual intervention. This ensures that the Defenders are always up-to-date with the latest security features and fixes, enhancing the security posture of the environment they protect.
AD
Explanation:
In Prisma Cloud, Defenders can be set to auto-upgrade, which is a feature that allows the host Defender to automatically upgrade to the latest version without manual intervention. This ensures that the Defenders are always up-to-date with the latest security features and fixes, enhancing the security posture of the environment they protect.
Question #40
Which intensity setting for anomaly alerts is used for the measurement of 100 events over 30 days?
- A . High
- B . Medium
- C . Low
- D . Very High
Correct Answer: B
B
Explanation:
In the context of setting anomaly alert intensities in Prisma Cloud, an intensity setting of "Medium" could be used for the measurement of 100 events over 30 days. This setting indicates a moderate level of anomaly detection sensitivity, which is suitable for environments where there is a need to balance between detecting potential security issues and minimizing false positives.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise-settings.html
B
Explanation:
In the context of setting anomaly alert intensities in Prisma Cloud, an intensity setting of "Medium" could be used for the measurement of 100 events over 30 days. This setting indicates a moderate level of anomaly detection sensitivity, which is suitable for environments where there is a need to balance between detecting potential security issues and minimizing false positives.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/define-prisma-cloud-enterprise-settings.html
Question #41
Given this information:
The Console is located at https://prisma-console.mydomain.local The username is: cluster
The password is: password123
The image to scan is: myimage:latest
Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?
- A . twistcli images scan –console-address https://prisma-console.mydomain.local -u cluster -p password123 — details myimage:latest
- B . twistcli images scan –console-address prisma-console.mydomain.local -u cluster -p password123 – – vulnerability-details myimage:latest
- C . twistcli images scan –address prisma-console.mydomain.local -u cluster -p password123 — vulnerability- details myimage:latest
- D . twistcli images scan –address https://prisma-console.mydomain.local -u cluster -p password123 — details myimage:latest
Correct Answer: D
D
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images
D
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/tools/twistcli_scan_images
Question #42
The development team wants to block Cross Site Scripting attacks from pods in its environment.
How should the team construct the CNAF policy to protect against this attack?
- A . create a Host CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to “prevent”.
- B . create a Container CNAF policy, targeted at a specific resource, check the box for XSS attack protection, and set the action to alert.
- C . create a Container CNAF policy, targeted at a specific resource, check the box for XSS protection, and set the action to prevent.
- D . create a Container CNAF policy, targeted at a specific resource, and they should set “Explicitly allowed inbound IP sources” to the IP address of the pod.
Correct Answer: C
C
Explanation:
To protect pods in an environment from Cross-Site Scripting (XSS) attacks, the development team should create a Container Cloud Native Application Firewall (CNAF) policy. This policy should be targeted at the specific resource (e.g., a particular pod or set of pods), with the option for XSS protection checked, and the action set to "prevent." This configuration ensures that any XSS attacks directed at the targeted containers are effectively blocked.
C
Explanation:
To protect pods in an environment from Cross-Site Scripting (XSS) attacks, the development team should create a Container Cloud Native Application Firewall (CNAF) policy. This policy should be targeted at the specific resource (e.g., a particular pod or set of pods), with the option for XSS protection checked, and the action set to "prevent." This configuration ensures that any XSS attacks directed at the targeted containers are effectively blocked.
Question #43
The Prisma Cloud administrator has configured a new policy.
Which steps should be used to assign this policy to a compliance standard?
- A . Edit the policy, go to step 3 (Compliance Standards), click + at the bottom, select the compliance standard, fill in the other boxes, and then click Confirm.
- B . Create the Compliance Standard from Compliance tab, and then select Add to Policy.
- C . Open the Compliance Standards section of the policy, and then save.
- D . Custom policies cannot be added to existing standards.
Correct Answer: A
A
Explanation:
To assign a new policy to a compliance standard in Prisma Cloud, the administrator needs to edit the policy and navigate to the step where compliance standards are managed. By clicking the ‘+’ button, the administrator can add the policy to a specific compliance standard, provide necessary details, and confirm the assignment. This integrates the custom policy into the chosen compliance standard, ensuring that compliance checks include the newly defined policy criteria.
A
Explanation:
To assign a new policy to a compliance standard in Prisma Cloud, the administrator needs to edit the policy and navigate to the step where compliance standards are managed. By clicking the ‘+’ button, the administrator can add the policy to a specific compliance standard, provide necessary details, and confirm the assignment. This integrates the custom policy into the chosen compliance standard, ensuring that compliance checks include the newly defined policy criteria.
Question #44
An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.
Console Address: $CONSOLE_ADDRESS Websocket Address: $WEBSOCKET_ADDRESS User:
$ADMIN_USER
Which command generates the YAML file for Defender install?
- A . <PLATFORM>/twistcli defender
–address $CONSOLE_ADDRESS
–user $ADMIN_USER
–cluster-address $CONSOLE_ADDRESS - B . <PLATFORM>/twistcli defender export kubernetes
–address $WEBSOCKET_ADDRESS
–user $ADMIN_USER
–cluster-address $CONSOLE_ADDRESS - C . <PLATFORM>/twistcli defender YAML kubernetes
–address $CONSOLE_ADDRESS
–user $ADMIN_USER
–cluster-address $WEBSOCKET_ADDRESS - D . <PLATFORM>/twistcli defender export kubernetes
–address $CONSOLE_ADDRESS
–user $ADMIN_USER
–cluster-address $WEBSOCKET_ADDRESS
Correct Answer: D
D
Explanation:
The correct command to generate the YAML file for Defender install in a Kubernetes cluster, considering the console and websocket addresses, as well as the admin user, would typically involve specifying the addresses and user details. The option D seems most aligned with standard practices for such commands, where you export the Defender configuration for Kubernetes, specifying the console and websocket addresses along with the user details.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html
D
Explanation:
The correct command to generate the YAML file for Defender install in a Kubernetes cluster, considering the console and websocket addresses, as well as the admin user, would typically involve specifying the addresses and user details. The option D seems most aligned with standard practices for such commands, where you export the Defender configuration for Kubernetes, specifying the console and websocket addresses along with the user details.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/install/install_kubernetes.html
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #45
Which options show the steps required after upgrade of Console?
- A . Uninstall Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable
Allow the Console to redeploy the Defender - B . Update the Console image in the Twistlock hosted registry Update the Defender image in the
Twistlock hosted registry Uninstall Defenders - C . Upgrade Defenders Upgrade Jenkins Plugin
Upgrade twistcli where applicable - D . Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console
Correct Answer: A
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
A
Explanation:
After upgrading the Prisma Cloud Console (formerly Twistlock Console), the steps outlined in option A are essential to ensure the entire Prisma Cloud ecosystem is updated and functioning correctly. Uninstalling Defenders, updating the Jenkins Plugin, and upgrading the TwistCLI tool are critical steps to align with the new Console version’s capabilities and security enhancements. This process ensures that Defenders (the agents deployed to protect various resources) are compatible with the upgraded Console, and that the development and CI/CD tools integrated with Prisma Cloud, such as Jenkins, continue to operate effectively with the updated platform. The final step, allowing the Console to redeploy the Defender, ensures that all components are synchronized and that the security posture is maintained across the environment. This approach is consistent with best practices for maintaining cloud security tools and ensuring that updates do not disrupt the protected environment’s security posture.
Question #62
Create an Alert rule
Correct Answer: A
Explanation:
To achieve immediate notification for "High Severity" alerts for a specific account group via Slack, the steps outlined in option A provide a comprehensive and effective approach. Firstly, configuring the Slack Integration establishes the necessary communication channel between Prisma Cloud and the Slack workspace. Creating an alert rule with the specified account group and severity filters ensures that only relevant alerts trigger notifications. Selecting Slack as the notification channel and setting the frequency to "As it Happens" ensures real-time alerting for critical issues. This method leverages Prisma Cloud’s alerting capabilities and Slack’s real-time messaging platform to promptly notify the security team, enabling swift action to mitigate risks. This approach is in line with Prisma Cloud’s flexible and configurable alerting system, designed to integrate with various external platforms for efficient incident response.
Explanation:
To achieve immediate notification for "High Severity" alerts for a specific account group via Slack, the steps outlined in option A provide a comprehensive and effective approach. Firstly, configuring the Slack Integration establishes the necessary communication channel between Prisma Cloud and the Slack workspace. Creating an alert rule with the specified account group and severity filters ensures that only relevant alerts trigger notifications. Selecting Slack as the notification channel and setting the frequency to "As it Happens" ensures real-time alerting for critical issues. This method leverages Prisma Cloud’s alerting capabilities and Slack’s real-time messaging platform to promptly notify the security team, enabling swift action to mitigate risks. This approach is in line with Prisma Cloud’s flexible and configurable alerting system, designed to integrate with various external platforms for efficient incident response.
Question #63
A business unit has acquired a company that has a very large AWS account footprint. The plan is to immediately start onboarding the new company’s AWS accounts into Prisma Cloud Enterprise tenant immediately. The current company is currently not using AWS Organizations and will require each account to be onboarded individually.
The business unit has decided to cover the scope of this action and determined that a script should be written to onboard each of these accounts with general settings to gain immediate posture visibility across the accounts.
Which API endpoint will specifically add these accounts into the Prisma Cloud Enterprise tenant?
- A . https://api.prismacloud.io/cloud/
- B . https://api.prismacloud.io/account/aws
- C . https://api.prismacloud.io/cloud/aws
- D . https://api.prismacloud.io/accountgroup/aws
Correct Answer: C
C
Explanation:
To add AWS accounts to the Prisma Cloud Enterprise tenant, the correct API endpoint is option C: https://api.prismacloud.io/cloud/aws. This endpoint is specifically designed for integrating cloud accounts with Prisma Cloud, enabling centralized visibility and security posture management across multiple cloud environments. By using this API endpoint, each AWS account can be individually onboarded to the Prisma Cloud platform, allowing for immediate posture visibility and consistent security policy enforcement across the newly acquired company’s extensive AWS footprint. This process aligns with Prisma Cloud’s capabilities for multi-cloud security and compliance management, ensuring that the onboarding of cloud accounts is both efficient and aligned with the platform’s best practices for cloud security.
C
Explanation:
To add AWS accounts to the Prisma Cloud Enterprise tenant, the correct API endpoint is option C: https://api.prismacloud.io/cloud/aws. This endpoint is specifically designed for integrating cloud accounts with Prisma Cloud, enabling centralized visibility and security posture management across multiple cloud environments. By using this API endpoint, each AWS account can be individually onboarded to the Prisma Cloud platform, allowing for immediate posture visibility and consistent security policy enforcement across the newly acquired company’s extensive AWS footprint. This process aligns with Prisma Cloud’s capabilities for multi-cloud security and compliance management, ensuring that the onboarding of cloud accounts is both efficient and aligned with the platform’s best practices for cloud security.
Question #64
A security team has a requirement to ensure the environment is scanned for vulnerabilities.
What are three options for configuring vulnerability policies? (Choose three.)
- A . individual actions based on package type
- B . output verbosity for blocked requests
- C . apply policy only when vendor fix is available
- D . individual grace periods for each severity level
- E . customize message on blocked requests
Correct Answer: ACD
ACD
Explanation:
Configuring vulnerability policies within Prisma Cloud involves several options that cater to different
aspects of vulnerability management and policy enforcement.
Options A, C, and D are valid configurations for vulnerability policies:
A) Individual actions based on package type allow for tailored responses to vulnerabilities found in specific types of software packages, enabling more granular control over the remediation process.
C) Applying policies only when a vendor fix is available helps prioritize the remediation of vulnerabilities for which a patch or update has been released by the software vendor, ensuring efficient use of resources in addressing the most actionable security issues.
D) Setting individual grace periods for each severity level allows organizations to define different time frames for addressing vulnerabilities based on their severity, enabling a prioritized and risk-based approach to vulnerability management.
These configurations support a comprehensive vulnerability management strategy by allowing customization and prioritization based on the nature of the vulnerability, the availability of fixes, and the risk level associated with each vulnerability.
ACD
Explanation:
Configuring vulnerability policies within Prisma Cloud involves several options that cater to different
aspects of vulnerability management and policy enforcement.
Options A, C, and D are valid configurations for vulnerability policies:
A) Individual actions based on package type allow for tailored responses to vulnerabilities found in specific types of software packages, enabling more granular control over the remediation process.
C) Applying policies only when a vendor fix is available helps prioritize the remediation of vulnerabilities for which a patch or update has been released by the software vendor, ensuring efficient use of resources in addressing the most actionable security issues.
D) Setting individual grace periods for each severity level allows organizations to define different time frames for addressing vulnerabilities based on their severity, enabling a prioritized and risk-based approach to vulnerability management.
These configurations support a comprehensive vulnerability management strategy by allowing customization and prioritization based on the nature of the vulnerability, the availability of fixes, and the risk level associated with each vulnerability.
Question #65
The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.
Which strategy should the administrator use to achieve this goal?
- A . Disable the policy
- B . Set the Alert Disposition to Conservative
- C . Change the Training Threshold to Low
- D . Set Alert Disposition to Aggressive
Correct Answer: B
B
Explanation:
To reduce the number of alerts generated by the "Unusual protocol activity (Internal)" network anomaly without entirely disabling the policy, setting the Alert Disposition to Conservative (option B) is the most effective strategy. This configuration adjusts the sensitivity of the anomaly detection, reducing the likelihood of false positives and minimizing alert fatigue without compromising the ability to detect genuine security threats. By adopting a more conservative approach to anomaly detection, the administrator can ensure that only the most significant and potentially harmful activities trigger alerts, thus maintaining a balance between security vigilance and operational efficiency.
B
Explanation:
To reduce the number of alerts generated by the "Unusual protocol activity (Internal)" network anomaly without entirely disabling the policy, setting the Alert Disposition to Conservative (option B) is the most effective strategy. This configuration adjusts the sensitivity of the anomaly detection, reducing the likelihood of false positives and minimizing alert fatigue without compromising the ability to detect genuine security threats. By adopting a more conservative approach to anomaly detection, the administrator can ensure that only the most significant and potentially harmful activities trigger alerts, thus maintaining a balance between security vigilance and operational efficiency.
Question #66
What is the behavior of Defenders when the Console is unreachable during upgrades?
- A . Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.
- B . Defenders will fail closed until the web-socket can be re-established.
- C . Defenders will fail open until the web-socket can be re-established.
- D . Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.
Correct Answer: D
D
Explanation:
When the Console is unreachable during upgrades, Defenders continue to alert and enforce using the policies and settings most recently cached before the upgrade (option D). This behavior ensures that security enforcement remains active and consistent, even when the central management console is temporarily unavailable. The cached policies enable Defenders to maintain the security posture based on the last known configuration, ensuring continuous protection against threats and compliance with established security policies. This approach reflects Prisma Cloud’s design principle of ensuring uninterrupted security enforcement, thereby safeguarding the environment against potential vulnerabilities during maintenance periods.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition- admin/upgrade/upgrade_process.html
D
Explanation:
When the Console is unreachable during upgrades, Defenders continue to alert and enforce using the policies and settings most recently cached before the upgrade (option D). This behavior ensures that security enforcement remains active and consistent, even when the central management console is temporarily unavailable. The cached policies enable Defenders to maintain the security posture based on the last known configuration, ensuring continuous protection against threats and compliance with established security policies. This approach reflects Prisma Cloud’s design principle of ensuring uninterrupted security enforcement, thereby safeguarding the environment against potential vulnerabilities during maintenance periods.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute-edition- admin/upgrade/upgrade_process.html
Question #67
How are the following categorized?
Backdoor account access Hijacked processes Lateral movement
Port scanning
- A . audits
- B . incidents
- C . admission controllers
- D . models
Correct Answer: B
B
Explanation:
The activities listed (Backdoor account access, Hijacked processes, Lateral movement, Port scanning) are categorized as incidents (option B). Incidents represent security events or patterns of activity that indicate potential security breaches or malicious behavior within the environment. Prisma Cloud identifies and classifies such activities as incidents to highlight significant security concerns that require investigation and potential remediation. This categorization helps security teams prioritize their response efforts, focusing on activities that pose a real threat to the integrity and security of the cloud environment. By distinguishing incidents from other types of security findings, Prisma Cloud enables more effective incident response and threat management processes.
B
Explanation:
The activities listed (Backdoor account access, Hijacked processes, Lateral movement, Port scanning) are categorized as incidents (option B). Incidents represent security events or patterns of activity that indicate potential security breaches or malicious behavior within the environment. Prisma Cloud identifies and classifies such activities as incidents to highlight significant security concerns that require investigation and potential remediation. This categorization helps security teams prioritize their response efforts, focusing on activities that pose a real threat to the integrity and security of the cloud environment. By distinguishing incidents from other types of security findings, Prisma Cloud enables more effective incident response and threat management processes.
Question #68
DRAG DROP
An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.
In which order should the API calls be used to accomplish this task? (Drag the steps into the correct order from the first step to the last.)
Correct Answer:
Explanation:
POST https://api.prismacloud.io/login
GET https://api.prismacloud.io/access_keys
PATCH https://api.prismacloud.io/access_keys/<id>/status/<status>
To write a script that automatically deactivates access keys that have not been used for 30 days, an administrator would need to follow an ordered sequence of API calls to the Prisma Cloud platform. The first API call must authenticate the script with the Prisma Cloud API, which is typically done using a POST request to the login endpoint. This step is necessary to establish a session and retrieve an authentication token required for subsequent API calls.
Once the script is authenticated, the next call is a GET request to the access_keys endpoint. This retrieves a list of all access keys within the environment. The script can then parse through these keys to determine which ones have not been used within the specified timeframe of 30 days.
For each access key that meets the criteria (unused for 30 days), the script must send a PATCH request to the specific access key’s endpoint, which includes the access key ID and the desired status. This request will change the status of the access key to ‘inactive’ or a similar status that denotes deactivation.
Following this ordered sequence ensures that the script systematically authenticates, evaluates, and updates the status of access keys based on their usage, thereby maintaining security and compliance within the Prisma Cloud environment.
Question #69
Which method should be used to authenticate to Prisma Cloud Enterprise programmatically?
- A . single sign-on
- B . SAML
- C . basic authentication
- D . access key
Correct Answer: D
D
Explanation:
To authenticate to Prisma Cloud Enterprise programmatically, the use of an access key is the most suitable method among the given options. Access keys, typically consisting of an Access Key ID and Secret Access Key, are used for programmatic calls to the Prisma Cloud API. This method enables secure, authenticated API requests to Prisma Cloud services without requiring manual user intervention, which is essential for automation and integration with CI/CD pipelines.
Reference to the use of access keys for programmatic access can often be found in the API documentation of cloud security platforms like Prisma Cloud. While specific documentation from Prisma Cloud is not directly quoted here, the general practice across cloud services (AWS, Azure, GCP) supports the use of access keys for API authentication, making it a verified approach for Prisma Cloud as well.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with- prisma-cloud/access-the-prisma-cloud-api.html
D
Explanation:
To authenticate to Prisma Cloud Enterprise programmatically, the use of an access key is the most suitable method among the given options. Access keys, typically consisting of an Access Key ID and Secret Access Key, are used for programmatic calls to the Prisma Cloud API. This method enables secure, authenticated API requests to Prisma Cloud services without requiring manual user intervention, which is essential for automation and integration with CI/CD pipelines.
Reference to the use of access keys for programmatic access can often be found in the API documentation of cloud security platforms like Prisma Cloud. While specific documentation from Prisma Cloud is not directly quoted here, the general practice across cloud services (AWS, Azure, GCP) supports the use of access keys for API authentication, making it a verified approach for Prisma Cloud as well.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with- prisma-cloud/access-the-prisma-cloud-api.html
Question #70
Which option shows the steps to install the Console in a Kubernetes Cluster?
- A . Download the Console and Defender image Generate YAML for Defender Deploy Defender YAML using kubectl
- B . Download and extract release tarball Generate YAML for Console Deploy Console YAML using kubectl
- C . Download the Console and Defender image Download YAML for Defender from the document site Deploy Defender YAML using kubectl
- D . Download and extract release tarball Download the YAML for Console Deploy Console YAML using kubectl
Correct Answer: B
B
Explanation:
The installation of the Prisma Cloud Console in a Kubernetes cluster involves a series of steps that start with preparing the necessary deployment configurations, typically provided as YAML files. The process begins by downloading and extracting the release tarball, which contains the necessary files and instructions for the deployment. After extracting the tarball, you generate YAML files for the Console deployment. These YAML files define the Kubernetes resources needed to deploy and run the Console, such as Deployments, Services, and ConfigMaps. Finally, you deploy the Console by applying the generated YAML files using the kubectl command, which communicates with the Kubernetes API to create the specified resources in your cluster.
This process is aligned with Kubernetes best practices for deploying applications and is indicative of
the steps required for deploying complex applications like the Prisma Cloud Console. The method ensures that all necessary configurations and dependencies are correctly defined and deployed in the Kubernetes environment.
B
Explanation:
The installation of the Prisma Cloud Console in a Kubernetes cluster involves a series of steps that start with preparing the necessary deployment configurations, typically provided as YAML files. The process begins by downloading and extracting the release tarball, which contains the necessary files and instructions for the deployment. After extracting the tarball, you generate YAML files for the Console deployment. These YAML files define the Kubernetes resources needed to deploy and run the Console, such as Deployments, Services, and ConfigMaps. Finally, you deploy the Console by applying the generated YAML files using the kubectl command, which communicates with the Kubernetes API to create the specified resources in your cluster.
This process is aligned with Kubernetes best practices for deploying applications and is indicative of
the steps required for deploying complex applications like the Prisma Cloud Console. The method ensures that all necessary configurations and dependencies are correctly defined and deployed in the Kubernetes environment.
Question #71
A customer has a requirement to automatically protect all Lambda functions with runtime protection.
What is the process to automatically protect all the Lambda functions?
- A . Configure a function scan policy from the Defend/Vulnerabilities/Functions page.
- B . Configure serverless radar from the Defend/Compliance/Cloud Platforms page.
- C . Configure a manually embedded Lambda Defender.
- D . Configure a serverless auto-protect rule for the functions.
Correct Answer: D
D
Explanation:
Reference: https://blog.paloaltonetworks.com/prisma-cloud/protect-serverless-functions/Automatically protecting all Lambda functions with runtime protection in Prisma Cloud can be achieved by configuring a serverless auto-protect rule. This feature allows for the automatic application of runtime protection policies to all Lambda functions without the need for manual intervention or embedding defenders in each function. The auto-protect rule ensures that as new Lambda functions are deployed, they are automatically protected based on the predefined security policies, maintaining a consistent security posture across all serverless functions.
This approach leverages the capabilities of Prisma Cloud to integrate seamlessly with serverless architectures, providing a layer of security that is both comprehensive and adaptive to the dynamic nature of serverless computing. By automating the protection process, organizations can ensure that their serverless functions are always covered by the latest security policies, reducing the risk of vulnerabilities and attacks.
D
Explanation:
Reference: https://blog.paloaltonetworks.com/prisma-cloud/protect-serverless-functions/Automatically protecting all Lambda functions with runtime protection in Prisma Cloud can be achieved by configuring a serverless auto-protect rule. This feature allows for the automatic application of runtime protection policies to all Lambda functions without the need for manual intervention or embedding defenders in each function. The auto-protect rule ensures that as new Lambda functions are deployed, they are automatically protected based on the predefined security policies, maintaining a consistent security posture across all serverless functions.
This approach leverages the capabilities of Prisma Cloud to integrate seamlessly with serverless architectures, providing a layer of security that is both comprehensive and adaptive to the dynamic nature of serverless computing. By automating the protection process, organizations can ensure that their serverless functions are always covered by the latest security policies, reducing the risk of vulnerabilities and attacks.
Question #72
Which statement accurately characterizes SSO Integration on Prisma Cloud?
- A . Prisma Cloud supports IdP initiated SSO, and its SAML endpoint supports the POST and GET methods.
- B . Okta, Azure Active Directory, PingID, and others are supported via SAML.
- C . An administrator can configure different Identity Providers (IdP) for all the cloud accounts that Prisma Cloud monitors.
- D . An administrator who needs to access the Prisma Cloud API can use SSO after configuration.
Correct Answer: B
B
Explanation:
Prisma Cloud supports Single Sign-On (SSO) integration through Security Assertion Markup Language (SAML), enabling users to authenticate using their existing identity providers (IdPs) such as Okta, Azure Active Directory, PingID, among others. This SSO integration allows for a seamless user
authentication experience, where users can log in to Prisma Cloud using their credentials managed by their organization’s IdP. The SAML protocol facilitates this by allowing secure exchange of authentication and authorization data between the IdP and Prisma Cloud.
This integration enhances security by centralizing user authentication, reducing the number of passwords users need to remember, and enabling organizations to enforce their security policies, such as multi-factor authentication (MFA) and password complexity, across their cloud security tools. SAML support is a common feature in cloud security platforms for integrating with various IdPs, making it a verified approach for Prisma Cloud as well.
B
Explanation:
Prisma Cloud supports Single Sign-On (SSO) integration through Security Assertion Markup Language (SAML), enabling users to authenticate using their existing identity providers (IdPs) such as Okta, Azure Active Directory, PingID, among others. This SSO integration allows for a seamless user
authentication experience, where users can log in to Prisma Cloud using their credentials managed by their organization’s IdP. The SAML protocol facilitates this by allowing secure exchange of authentication and authorization data between the IdP and Prisma Cloud.
This integration enhances security by centralizing user authentication, reducing the number of passwords users need to remember, and enabling organizations to enforce their security policies, such as multi-factor authentication (MFA) and password complexity, across their cloud security tools. SAML support is a common feature in cloud security platforms for integrating with various IdPs, making it a verified approach for Prisma Cloud as well.
Question #73
DRAG DROP
Match the service on the right that evaluates each exposure type on the left. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)
Correct Answer:
Explanation:
Reference: https://www.paloaltonetworks.com/prisma/cloud/cloud-data-security
Question #74
What are two ways to scan container images in Jenkins pipelines? (Choose two.)
- A . twistcli
- B . Jenkins Docker plugin
- C . Compute Jenkins plugin
- D . Compute Azure DevOps plugin
- E . Prisma Cloud Visual Studio Code plugin with Jenkins integration
Correct Answer: AC
AC
Explanation:
To scan container images in Jenkins pipelines, two effective methods are using twistcli and the Compute Jenkins plugin. twistcli is a command-line tool provided by Prisma Cloud that allows for the scanning of container images for vulnerabilities and compliance issues directly from the CI/CD pipeline. It can be integrated into Jenkins jobs as a build or post-build step to automatically scan images as part of the build process.
The Compute Jenkins plugin is specifically designed for integration with Jenkins, providing a more seamless and automated way to include Prisma Cloud’s security scanning capabilities within Jenkins pipelines. This plugin enables Jenkins to trigger image scans with Prisma Cloud directly and can fail builds based on scan results, ensuring that only secure and compliant images are pushed through the CI/CD pipeline.
Both twistcli and the Compute Jenkins plugin are designed to integrate Prisma Cloud’s security capabilities into the CI/CD process, enabling DevOps teams to identify and fix security issues early in the development lifecycle.
AC
Explanation:
To scan container images in Jenkins pipelines, two effective methods are using twistcli and the Compute Jenkins plugin. twistcli is a command-line tool provided by Prisma Cloud that allows for the scanning of container images for vulnerabilities and compliance issues directly from the CI/CD pipeline. It can be integrated into Jenkins jobs as a build or post-build step to automatically scan images as part of the build process.
The Compute Jenkins plugin is specifically designed for integration with Jenkins, providing a more seamless and automated way to include Prisma Cloud’s security scanning capabilities within Jenkins pipelines. This plugin enables Jenkins to trigger image scans with Prisma Cloud directly and can fail builds based on scan results, ensuring that only secure and compliant images are pushed through the CI/CD pipeline.
Both twistcli and the Compute Jenkins plugin are designed to integrate Prisma Cloud’s security capabilities into the CI/CD process, enabling DevOps teams to identify and fix security issues early in the development lifecycle.
Question #75
A customer wants to harden its environment from misconfiguration.
Prisma Cloud Compute Compliance enforcement for hosts covers which three options? (Choose three.)
- A . Docker daemon configuration files
- B . Docker daemon configuration
- C . Host cloud provider tags
- D . Host configuration
- E . Hosts without Defender agents
Correct Answer: ABD
ABD
Explanation:
Prisma Cloud Compute Compliance enforcement for hosts covers several aspects to ensure a secure and compliant host environment, particularly within containerized environments. These include: Docker daemon configuration files: Ensuring that Docker daemon configuration files are set up according to best security practices is crucial. These files contain various settings that control the behavior of the Docker daemon, and misconfigurations can lead to security vulnerabilities.
Docker daemon configuration: Beyond just the configuration files, the overall configuration of the Docker daemon itself is critical. This encompasses runtime settings and command-line options that determine how Docker containers are executed and managed on the host.
Host configuration: The security of the underlying host on which Docker and other container runtimes are installed is paramount. This includes the configuration of the host’s operating system, network settings, file permissions, and other system-level settings that can impact the security of the containerized applications running on top.
By focusing on these areas, Prisma Cloud ensures that not just the containers but also the environment they run in is secure, adhering to compliance standards and best practices to mitigate risks associated with containerized deployments.
ABD
Explanation:
Prisma Cloud Compute Compliance enforcement for hosts covers several aspects to ensure a secure and compliant host environment, particularly within containerized environments. These include: Docker daemon configuration files: Ensuring that Docker daemon configuration files are set up according to best security practices is crucial. These files contain various settings that control the behavior of the Docker daemon, and misconfigurations can lead to security vulnerabilities.
Docker daemon configuration: Beyond just the configuration files, the overall configuration of the Docker daemon itself is critical. This encompasses runtime settings and command-line options that determine how Docker containers are executed and managed on the host.
Host configuration: The security of the underlying host on which Docker and other container runtimes are installed is paramount. This includes the configuration of the host’s operating system, network settings, file permissions, and other system-level settings that can impact the security of the containerized applications running on top.
By focusing on these areas, Prisma Cloud ensures that not just the containers but also the environment they run in is secure, adhering to compliance standards and best practices to mitigate risks associated with containerized deployments.
Question #76
A Prisma Cloud administrator is tasked with pulling a report via API. The Prisma Cloud tenant is located on app2.prismacloud.io.
What is the correct API endpoint?
- A . https://api.prismacloud.io
- B . https://api2.eu.prismacloud.io
- C . httsp://api.prismacloud.cn
- D . https://api2.prismacloud.io
Correct Answer: D
D
Explanation:
https://prisma.pan.dev/api/cloud/api-urls/
When accessing the Prisma Cloud API for a tenant located on app2.prismacloud.io, the correct API endpoint to use would be https://api2.prismacloud.io. This endpoint corresponds to the Prisma Cloud service instance hosted on app2.prismacloud.io, ensuring that API requests are directed to the correct instance of the service for processing.
The use of api2 in the URL indicates that this is the second instance or a different geographical or functional partition of the Prisma Cloud service, which might be used for load balancing, redundancy, or serving different sets of users. It is crucial to use the correct endpoint corresponding to the Prisma Cloud console URL to ensure successful API communication and authentication.
D
Explanation:
https://prisma.pan.dev/api/cloud/api-urls/
When accessing the Prisma Cloud API for a tenant located on app2.prismacloud.io, the correct API endpoint to use would be https://api2.prismacloud.io. This endpoint corresponds to the Prisma Cloud service instance hosted on app2.prismacloud.io, ensuring that API requests are directed to the correct instance of the service for processing.
The use of api2 in the URL indicates that this is the second instance or a different geographical or functional partition of the Prisma Cloud service, which might be used for load balancing, redundancy, or serving different sets of users. It is crucial to use the correct endpoint corresponding to the Prisma Cloud console URL to ensure successful API communication and authentication.
Question #77
A customer has Defenders connected to Prisma Cloud Enterprise. The Defenders are deployed as a DaemonSet in OpenShift.
How should the administrator get a report of vulnerabilities on hosts?
- A . Navigate to Monitor > Vulnerabilities > CVE Viewer
- B . Navigate to Defend > Vulnerabilities > VM Images
- C . Navigate to Defend > Vulnerabilities > Hosts
- D . Navigate to Monitor > Vulnerabilities > Hosts
Correct Answer: D
D
Explanation:
To view the vulnerabilities identified on a host, navigating to the "Monitor > Vulnerabilities > Hosts" section within the Prisma Cloud Console is the correct approach. This section is specifically designed to provide a comprehensive overview of all detected vulnerabilities within the host environment, offering detailed insights into each vulnerability’s nature, severity, and potential impact.
This pathway allows users to efficiently assess the security posture of their hosts, prioritize vulnerabilities based on their severity, and take appropriate remediation actions. The "Hosts" section under "Vulnerabilities" is tailored to display vulnerabilities related to host configurations, installed software, and other host-level security concerns, making it the ideal location within the Prisma Cloud Console for this purpose.
D
Explanation:
To view the vulnerabilities identified on a host, navigating to the "Monitor > Vulnerabilities > Hosts" section within the Prisma Cloud Console is the correct approach. This section is specifically designed to provide a comprehensive overview of all detected vulnerabilities within the host environment, offering detailed insights into each vulnerability’s nature, severity, and potential impact.
This pathway allows users to efficiently assess the security posture of their hosts, prioritize vulnerabilities based on their severity, and take appropriate remediation actions. The "Hosts" section under "Vulnerabilities" is tailored to display vulnerabilities related to host configurations, installed software, and other host-level security concerns, making it the ideal location within the Prisma Cloud Console for this purpose.
Question #78
DRAG DROP
Order the steps involved in onboarding an AWS Account for use with Data Security feature.
Correct Answer:
Explanation:
Create CloudTrail with S3 as storage
Enter SNS Topic in CloudTrail
Enter RoleARN and SNSARN
Create Stack
Comprehensive Detailed
Onboarding an AWS account for use with the Data Security feature involves setting up AWS CloudTrail to monitor API calls and log the data to an Amazon S3 bucket, which is essential for auditing and security purposes.
The first step in the onboarding process is to create an AWS CloudTrail with S3 as the storage destination. This is where all the CloudTrail logs will be collected and stored. The S3 bucket must be properly configured to receive and store logs.
After setting up CloudTrail, the next step is to enter the Amazon Simple Notification Service (SNS) topic in CloudTrail. This step involves specifying an SNS topic that CloudTrail will use to send notifications of log file delivery to the specified S3 bucket.
The third step is to enter the Role Amazon Resource Name (RoleARN) and the SNS Amazon Resource Name (SNSARN). RoleARN refers to the IAM role that grants permissions to the CloudTrail to access resources, while SNSARN is the identifier for the SNS topic created in the previous step.
Finally, the last step is to create a stack, which typically refers to deploying a CloudFormation template or another infrastructure as code service in AWS. This stack will set up all the necessary resources and configurations automatically, including the correct permissions and settings for the Data Security feature to function correctly.
These steps ensure that the AWS account is properly configured to capture and store API call logs and to notify the appropriate systems or personnel when specific events occur, thereby enhancing data security monitoring and compliance.
Question #79
A customer has a requirement to scan serverless functions for vulnerabilities.
Which three settings are required to configure serverless scanning? (Choose three.)
- A . Defender Name
- B . Region
- C . Credential
- D . Console Address
- E . Provider
Correct Answer: BCE
BCE
Explanation:
To configure serverless scanning in a cloud security platform like Prisma Cloud, the system needs to know where (Region) the serverless functions are deployed, how to access them (Credential), and on which cloud platform they are running (Provider). These settings ensure that the scanning tool can accurately locate and authenticate to the serverless functions across different cloud environments for vulnerability assessment. This aligns with the principle of providing comprehensive visibility and consistent security across multi-cloud environments as outlined in the "Guide to Cloud Security Posture Management Tools" document.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/vulnerability_management/serverless_functions.html
BCE
Explanation:
To configure serverless scanning in a cloud security platform like Prisma Cloud, the system needs to know where (Region) the serverless functions are deployed, how to access them (Credential), and on which cloud platform they are running (Provider). These settings ensure that the scanning tool can accurately locate and authenticate to the serverless functions across different cloud environments for vulnerability assessment. This aligns with the principle of providing comprehensive visibility and consistent security across multi-cloud environments as outlined in the "Guide to Cloud Security Posture Management Tools" document.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/vulnerability_management/serverless_functions.html
Question #80
You are tasked with configuring a Prisma Cloud build policy for Terraform.
What type of query is necessary to complete this policy?
- A . YAML
- B . JSON
- C . CloudFormation
- D . Terraform
Correct Answer: D
D
Explanation:
When configuring a Prisma Cloud build policy specifically for Terraform, the type of query necessary is Terraform. Terraform is an infrastructure as code (IaC) tool that allows users to define and provision cloud infrastructure using a declarative configuration language. Prisma Cloud can analyze Terraform templates to identify potential security risks and misconfigurations before the infrastructure is provisioned, aligning with the best practices for integrating security into the application development pipeline and ensuring secure cloud configurations from the start.
D
Explanation:
When configuring a Prisma Cloud build policy specifically for Terraform, the type of query necessary is Terraform. Terraform is an infrastructure as code (IaC) tool that allows users to define and provision cloud infrastructure using a declarative configuration language. Prisma Cloud can analyze Terraform templates to identify potential security risks and misconfigurations before the infrastructure is provisioned, aligning with the best practices for integrating security into the application development pipeline and ensuring secure cloud configurations from the start.
Question #81
You have onboarded a public cloud account into Prisma Cloud Enterprise. Configuration Resource
ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account.
Config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully.
Why are no alerts being generated?
- A . The public cloud account is not associated with an alert notification.
- B . The public cloud account does not have audit trail ingestion enabled.
- C . The public cloud account does not access to configuration resources.
- D . The public cloud account is not associated with an alert rule.
Correct Answer: D
D
Explanation:
In Prisma Cloud Enterprise, for alerts to be generated for configuration assets in an onboarded public cloud account, it is essential that the account is associated with an alert rule that matches the enabled config policies. If the account is not linked to an alert rule or if the existing alert rules do not match the config policies, no alerts will be generated even though configuration resource ingestion is visible, and RQL statements return config resource results. This requirement emphasizes the need for a well-structured alerting mechanism to ensure that security incidents are promptly identified and addressed.
D
Explanation:
In Prisma Cloud Enterprise, for alerts to be generated for configuration assets in an onboarded public cloud account, it is essential that the account is associated with an alert rule that matches the enabled config policies. If the account is not linked to an alert rule or if the existing alert rules do not match the config policies, no alerts will be generated even though configuration resource ingestion is visible, and RQL statements return config resource results. This requirement emphasizes the need for a well-structured alerting mechanism to ensure that security incidents are promptly identified and addressed.
Question #82
The security team wants to target a CNAF policy for specific running Containers.
How should the administrator scope the policy to target the Containers?
- A . scope the policy to Image names.
- B . scope the policy to namespaces.
- C . scope the policy to Defender names.
- D . scope the policy to Host names.
Correct Answer: A
A
Explanation:
To specifically target running containers with a Cloud Native Application Framework (CNAF) policy in Prisma Cloud, the administrator should scope the policy to Image names. By doing so, the policy will apply to containers based on the images they were created from, allowing for precise targeting of security policies to specific containers. This approach is part of Prisma Cloud’s capabilities to provide granular security controls for containerized environments, ensuring that policies are effectively applied to the relevant containers.
A
Explanation:
To specifically target running containers with a Cloud Native Application Framework (CNAF) policy in Prisma Cloud, the administrator should scope the policy to Image names. By doing so, the policy will apply to containers based on the images they were created from, allowing for precise targeting of security policies to specific containers. This approach is part of Prisma Cloud’s capabilities to provide granular security controls for containerized environments, ensuring that policies are effectively applied to the relevant containers.
Question #83
The InfoSec team wants to be notified via email each time a Security Group is misconfigured.
Which Prisma Cloud tab should you choose to complete this request?
- A . Notifications
- B . Policies
- C . Alert Rules
- D . Events
Correct Answer: C
C
Explanation:
In Prisma Cloud, to notify the InfoSec team via email about misconfigured Security Groups, the appropriate tab to use is "Alert Rules." Alert rules in Prisma Cloud define the conditions under which alerts are generated and the notification channels, including email, where these alerts are sent. By configuring alert rules related to Security Group misconfigurations, the platform can automatically notify the team when such an event occurs, ensuring prompt awareness and response to potential security issues.
C
Explanation:
In Prisma Cloud, to notify the InfoSec team via email about misconfigured Security Groups, the appropriate tab to use is "Alert Rules." Alert rules in Prisma Cloud define the conditions under which alerts are generated and the notification channels, including email, where these alerts are sent. By configuring alert rules related to Security Group misconfigurations, the platform can automatically notify the team when such an event occurs, ensuring prompt awareness and response to potential security issues.
Question #84
An administrator has access to a Prisma Cloud Enterprise.
What are the steps to deploy a single container Defender on an ec2 node?
- A . Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running.
- B . Execute the curl | bash script on the ec2 node.
- C . Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node.
- D . Generate DaemonSet file and apply DaemonSet to the twistlock namespace.
Correct Answer: A
A
Explanation:
To deploy a single container Defender on an EC2 node in Prisma Cloud Enterprise, the correct steps involve pulling the Defender image to the EC2 node, executing the provided curl | bash script to install the Defender, and then starting the Defender to ensure it is actively running. This process allows the Defender to integrate with the Prisma Cloud platform and provide real-time monitoring and protection for the EC2 instance it is deployed on, aligning with Prisma Cloud’s approach to extending security coverage to individual cloud resources.
Reference: https://docs.twistlock.com/docs/compute_edition/install/install_kubernetes.html
A
Explanation:
To deploy a single container Defender on an EC2 node in Prisma Cloud Enterprise, the correct steps involve pulling the Defender image to the EC2 node, executing the provided curl | bash script to install the Defender, and then starting the Defender to ensure it is actively running. This process allows the Defender to integrate with the Prisma Cloud platform and provide real-time monitoring and protection for the EC2 instance it is deployed on, aligning with Prisma Cloud’s approach to extending security coverage to individual cloud resources.
Reference: https://docs.twistlock.com/docs/compute_edition/install/install_kubernetes.html
Question #85
A customer wants to turn on Auto Remediation.
Which policy type has the built-in CLI command for remediation?
- A . Anomaly
- B . Audit Event
- C . Network
- D . Config
Correct Answer: D
D
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy.html
In Prisma Cloud, Config policies have built-in CLI commands for auto-remediation. These policies help in identifying misconfigurations within cloud environments and can automatically execute remediation commands to correct the configurations without manual intervention. This feature is part of Prisma Cloud’s comprehensive approach to maintaining cloud security posture by ensuring that cloud resources are configured in accordance with best practices and compliance standards.
D
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy.html
In Prisma Cloud, Config policies have built-in CLI commands for auto-remediation. These policies help in identifying misconfigurations within cloud environments and can automatically execute remediation commands to correct the configurations without manual intervention. This feature is part of Prisma Cloud’s comprehensive approach to maintaining cloud security posture by ensuring that cloud resources are configured in accordance with best practices and compliance standards.
Question #86
A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying.
How should the customer automate vulnerability scanning for images deployed to Fargate?
- A . Set up a vulnerability scanner on the registry
- B . Embed a Fargate Defender to automatically scan for vulnerabilities
- C . Designate a Fargate Defender to serve a dedicated image scanner
- D . Use Cloud Compliance to identify misconfigured AWS accounts
Correct Answer: A
A
Explanation:
To automate vulnerability scanning for images deployed to Fargate, the customer should set up a vulnerability scanner on the container registry where the images are stored before they are deployed. By scanning the images in the registry, any vulnerabilities can be identified and addressed before the images are used to create Fargate tasks. This proactive approach to vulnerability management is crucial in cloud-native environments to ensure that deployed containers are free from known vulnerabilities.
Reference: https://blog.paloaltonetworks.com/prisma-cloud/securing-aws-fargate-tasks/
A
Explanation:
To automate vulnerability scanning for images deployed to Fargate, the customer should set up a vulnerability scanner on the container registry where the images are stored before they are deployed. By scanning the images in the registry, any vulnerabilities can be identified and addressed before the images are used to create Fargate tasks. This proactive approach to vulnerability management is crucial in cloud-native environments to ensure that deployed containers are free from known vulnerabilities.
Reference: https://blog.paloaltonetworks.com/prisma-cloud/securing-aws-fargate-tasks/
Question #87
Which container image scan is constructed correctly?
- A . twistcli images scan –docker-address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest
- B . twistcli images scan –address https://us-west1.cloud.twistlock.com/us-3-123456789 myimage/latest
- C . twistcli images scan –address https://us-west1.cloud.twistlock.com/us-3-123456789 –container myimage/latest
- D . twistcli images scan –address https://us-west1.cloud.twistlock.com/us-3-123456789 –container myimage/latest –details
Correct Answer: B
B
Explanation:
The correct construction for scanning a container image using the TwistCLI tool in Prisma Cloud is option
B. This command specifies the address of the Prisma Cloud Console and the image to be scanned, including its tag. The TwistCLI tool is part of Prisma Cloud’s capabilities to integrate security into the CI/CD pipeline, allowing for the scanning of images for vulnerabilities as part of the build process, thus ensuring that only secure images are deployed.
B
Explanation:
The correct construction for scanning a container image using the TwistCLI tool in Prisma Cloud is option
B. This command specifies the address of the Prisma Cloud Console and the image to be scanned, including its tag. The TwistCLI tool is part of Prisma Cloud’s capabilities to integrate security into the CI/CD pipeline, allowing for the scanning of images for vulnerabilities as part of the build process, thus ensuring that only secure images are deployed.
Question #88
DRAG DROP
An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.
In which order will the APIs be executed for this service? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #88
DRAG DROP
An administrator has been tasked with creating a custom service that will download any existing compliance report from a Prisma Cloud Enterprise tenant.
In which order will the APIs be executed for this service? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Question #90
Which two processes ensure that builds can function after a Console upgrade? (Choose two.)
- A . allowing Jenkins to automatically update the plugin
- B . updating any build environments that have twistcli included to use the latest version
- C . configuring build pipelines to download twistcli at the start of each build
- D . creating a new policy that allows older versions of twistcli to connect the Console
Correct Answer: BC
BC
Explanation:
Ensuring that builds can function properly after a Console upgrade in Prisma Cloud involves strategies that maintain compatibility and functionality with the latest versions of the Prisma Cloud tools and services.
Option B: Updating any build environments that have twistcli included to use the latest version is crucial because twistcli is Prisma Cloud’s CLI tool used for scanning images, serverless functions, and IaC for vulnerabilities and compliance issues. Ensuring that twistcli is up to date in all build environments guarantees compatibility with the latest features and security definitions provided by Prisma Cloud, as well as ensures that any new or updated policies and checks are accurately enforced during the build process.
Option C: Configuring build pipelines to download twistcli at the start of each build ensures that the most current version of twistcli is used every time a build is initiated. This approach is beneficial in dynamic CI/CD environments where builds are frequent, and maintaining the latest security posture is critical. By downloading twistcli dynamically, teams can automatically adapt to any updates or changes introduced in the Prisma Cloud Console without manual intervention, ensuring seamless integration and continuous compliance with Prisma Cloud’s security standards.
Reference: Prisma Cloud Documentation: Emphasizes the importance of keeping security tools up to date and integrating them into CI/CD pipelines for continuous security.
Best Practices for Integrating Security Tools in CI/CD: Guides on how to effectively incorporate security scanning tools like twistcli into the CI/CD process to ensure builds are secure and compliant.
BC
Explanation:
Ensuring that builds can function properly after a Console upgrade in Prisma Cloud involves strategies that maintain compatibility and functionality with the latest versions of the Prisma Cloud tools and services.
Option B: Updating any build environments that have twistcli included to use the latest version is crucial because twistcli is Prisma Cloud’s CLI tool used for scanning images, serverless functions, and IaC for vulnerabilities and compliance issues. Ensuring that twistcli is up to date in all build environments guarantees compatibility with the latest features and security definitions provided by Prisma Cloud, as well as ensures that any new or updated policies and checks are accurately enforced during the build process.
Option C: Configuring build pipelines to download twistcli at the start of each build ensures that the most current version of twistcli is used every time a build is initiated. This approach is beneficial in dynamic CI/CD environments where builds are frequent, and maintaining the latest security posture is critical. By downloading twistcli dynamically, teams can automatically adapt to any updates or changes introduced in the Prisma Cloud Console without manual intervention, ensuring seamless integration and continuous compliance with Prisma Cloud’s security standards.
Reference: Prisma Cloud Documentation: Emphasizes the importance of keeping security tools up to date and integrating them into CI/CD pipelines for continuous security.
Best Practices for Integrating Security Tools in CI/CD: Guides on how to effectively incorporate security scanning tools like twistcli into the CI/CD process to ensure builds are secure and compliant.
Question #91
The compliance team needs to associate Prisma Cloud policies with compliance frameworks.
Which option should the team select to perform this task?
- A . Custom Compliance
- B . Policies
- C . Compliance
- D . Alert Rules
Correct Answer: A
A
Explanation:
Associating Prisma Cloud policies with compliance frameworks is done through the Custom Compliance feature in Prisma Cloud. This feature allows teams to map Prisma Cloud’s out-of-the-box (OOTB) policies to various compliance standards and frameworks, thereby enabling organizations to tailor their compliance reporting and management according to specific regulatory requirements or internal compliance mandates.
Option A: Custom Compliance is the correct choice as it provides the flexibility to customize and align Prisma Cloud policies with an organization’s specific compliance needs. It enables the compliance team to create custom compliance standards, map existing Prisma Cloud policies to these standards, and generate compliance reports that reflect the organization’s unique compliance posture.
Reference: Prisma Cloud Compliance Documentation: Offers detailed guidance on setting up and managing custom compliance standards within Prisma Cloud, including how to associate policies with these standards.
Compliance Management Best Practices: Provides insights into effective compliance management strategies in cloud environments, emphasizing the role of customizable compliance frameworks to meet diverse regulatory requirements.
A
Explanation:
Associating Prisma Cloud policies with compliance frameworks is done through the Custom Compliance feature in Prisma Cloud. This feature allows teams to map Prisma Cloud’s out-of-the-box (OOTB) policies to various compliance standards and frameworks, thereby enabling organizations to tailor their compliance reporting and management according to specific regulatory requirements or internal compliance mandates.
Option A: Custom Compliance is the correct choice as it provides the flexibility to customize and align Prisma Cloud policies with an organization’s specific compliance needs. It enables the compliance team to create custom compliance standards, map existing Prisma Cloud policies to these standards, and generate compliance reports that reflect the organization’s unique compliance posture.
Reference: Prisma Cloud Compliance Documentation: Offers detailed guidance on setting up and managing custom compliance standards within Prisma Cloud, including how to associate policies with these standards.
Compliance Management Best Practices: Provides insights into effective compliance management strategies in cloud environments, emphasizing the role of customizable compliance frameworks to meet diverse regulatory requirements.
Question #92
Review this admission control policy:
match[{"msg": msg}] { input.request.operation == "CREATE" input.request.kind.kind == "Pod"
input.request.resource.resource == "pods"
input.request.object.spec.containers[_].securityContext.privileged msg := "Privileged"
}
Which response to this policy will be achieved when the effect is set to “block”?
- A . The policy will block all pods on a Privileged host.
- B . The policy will replace Defender with a privileged Defender.
- C . The policy will alert only the administrator when a privileged pod is created.
- D . The policy will block the creation of a privileged pod.
Correct Answer: D
D
Explanation:
The given admission control policy is designed to evaluate pod creation requests in a Kubernetes environment, specifically targeting the creation of privileged pods, which can pose significant security risks.
Option D: The policy will block the creation of a privileged pod is the correct answer when the effect of the policy is set to “block”. In this context, the policy’s logic checks if a pod being created is set to run in privileged mode (a high-risk configuration that grants the pod extended system privileges). If such a configuration is detected, the policy triggers an action to block the pod’s creation, thereby preventing the deployment of privileged pods that could undermine the security posture of the Kubernetes environment.
Reference: Kubernetes Admission Controllers Documentation: Provides a comprehensive overview of admission controllers in Kubernetes, including how they can be used to enforce policy decisions, such as preventing the creation of privileged pods.
Best Practices for Kubernetes Security: Discusses the importance of admission control policies in maintaining the security and integrity of Kubernetes environments, with specific emphasis on the risks associated with privileged pods.
D
Explanation:
The given admission control policy is designed to evaluate pod creation requests in a Kubernetes environment, specifically targeting the creation of privileged pods, which can pose significant security risks.
Option D: The policy will block the creation of a privileged pod is the correct answer when the effect of the policy is set to “block”. In this context, the policy’s logic checks if a pod being created is set to run in privileged mode (a high-risk configuration that grants the pod extended system privileges). If such a configuration is detected, the policy triggers an action to block the pod’s creation, thereby preventing the deployment of privileged pods that could undermine the security posture of the Kubernetes environment.
Reference: Kubernetes Admission Controllers Documentation: Provides a comprehensive overview of admission controllers in Kubernetes, including how they can be used to enforce policy decisions, such as preventing the creation of privileged pods.
Best Practices for Kubernetes Security: Discusses the importance of admission control policies in maintaining the security and integrity of Kubernetes environments, with specific emphasis on the risks associated with privileged pods.
Question #93
Per security requirements, an administrator needs to provide a list of people who are receiving e-mails for Prisma Cloud alerts.
Where can the administrator locate this list of e-mail recipients?
- A . Target section within an Alert Rule.
- B . Notification Template section within Alerts.
- C . Users section within Settings.
- D . Set Alert Notification section within an Alert Rule.
Correct Answer: D
D
Explanation:
In Prisma Cloud, the list of people who are receiving e-mails for alerts is managed within the configuration of individual Alert Rules.
Option D: Set Alert Notification section within an Alert Rule is where administrators can specify the e-mail recipients for alerts generated by Prisma Cloud. This section allows for the customization of alert notifications, including the selection of recipients who should receive email notifications when an alert is triggered. This granularity ensures that the right stakeholders are informed about specific security incidents or compliance violations, facilitating timely and appropriate responses.
Reference: Prisma Cloud Alert Configuration Documentation: Details the process of setting up alert rules in Prisma Cloud, including how to configure notification settings and specify recipients for email alerts. Alert Management Best Practices: Offers insights into effective alert management strategies, highlighting the importance of targeted alert notifications in ensuring that critical security information reaches the relevant parties promptly.
D
Explanation:
In Prisma Cloud, the list of people who are receiving e-mails for alerts is managed within the configuration of individual Alert Rules.
Option D: Set Alert Notification section within an Alert Rule is where administrators can specify the e-mail recipients for alerts generated by Prisma Cloud. This section allows for the customization of alert notifications, including the selection of recipients who should receive email notifications when an alert is triggered. This granularity ensures that the right stakeholders are informed about specific security incidents or compliance violations, facilitating timely and appropriate responses.
Reference: Prisma Cloud Alert Configuration Documentation: Details the process of setting up alert rules in Prisma Cloud, including how to configure notification settings and specify recipients for email alerts. Alert Management Best Practices: Offers insights into effective alert management strategies, highlighting the importance of targeted alert notifications in ensuring that critical security information reaches the relevant parties promptly.
Question #94
A customer wants to scan a serverless function as part of a build process.
Which twistcli command can be used to scan serverless functions?
- A . twistcli function scan <SERVERLESS_FUNCTION.ZIP>
- B . twistcli scan serverless <SERVERLESS_FUNCTION.ZIP>
- C . twistcli serverless AWS <SERVERLESS_FUNCTION.ZIP>
- D . twiscli serverless scan <SERVERLESS_FUNCTION.ZIP>
Correct Answer: A
A
Explanation:
Scanning serverless functions for vulnerabilities and compliance issues is a critical aspect of securing serverless architectures. Prisma Cloud provides a CLI tool, twistcli, which supports scanning serverless function packages.
Option A: twistcli function scan <SERVERLESS_FUNCTION.ZIP> is the correct command for scanning serverless functions. This command allows users to scan the serverless function package (typically a ZIP file) for vulnerabilities, compliance issues, and other security concerns before deployment. By incorporating this scanning step into the CI/CD pipeline, organizations can ensure that their serverless functions are secure and compliant with relevant policies and standards before they are deployed to production.
Reference: Prisma Cloud twistcli Documentation: Provides comprehensive usage instructions for the twistcli tool, including commands for scanning serverless functions, container images, and IaC templates. Serverless Security Best Practices: Discusses the unique security considerations for serverless architectures and the importance of pre-deployment scanning to identify and remediate potential security risks in serverless function code.
A
Explanation:
Scanning serverless functions for vulnerabilities and compliance issues is a critical aspect of securing serverless architectures. Prisma Cloud provides a CLI tool, twistcli, which supports scanning serverless function packages.
Option A: twistcli function scan <SERVERLESS_FUNCTION.ZIP> is the correct command for scanning serverless functions. This command allows users to scan the serverless function package (typically a ZIP file) for vulnerabilities, compliance issues, and other security concerns before deployment. By incorporating this scanning step into the CI/CD pipeline, organizations can ensure that their serverless functions are secure and compliant with relevant policies and standards before they are deployed to production.
Reference: Prisma Cloud twistcli Documentation: Provides comprehensive usage instructions for the twistcli tool, including commands for scanning serverless functions, container images, and IaC templates. Serverless Security Best Practices: Discusses the unique security considerations for serverless architectures and the importance of pre-deployment scanning to identify and remediate potential security risks in serverless function code.
Question #95
A customer has a development environment with 50 connected Defenders. A maintenance window is set for Monday to upgrade 30 stand-alone Defenders in the development environment, but there is no maintenance window available until Sunday to upgrade the remaining 20 stand-alone Defenders.
Which recommended action manages this situation?
- A . Go to Manage > Defender > Manage, then click Defenders, and use the Scheduler to choose which Defenders will be automatically upgraded during the maintenance window.
- B . Find a maintenance window that is suitable to upgrade all stand-alone Defenders in the development environment.
- C . Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window.
- D . Open a support case with Palo Alto Networks to arrange an automatic upgrade.
Correct Answer: C
C
Explanation:
Managing Defender upgrades in a Prisma Cloud environment requires careful planning, especially in scenarios where not all Defenders can be upgraded simultaneously due to maintenance window constraints.
Option C: Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window is the recommended approach in this situation. This option allows administrators to manually select specific Defenders for upgrade within the available maintenance window, providing control over the upgrade process and ensuring that upgrades are aligned with operational requirements and maintenance schedules.
Reference: Prisma Cloud Defender Management Documentation: Details the procedures for managing and upgrading Prisma Cloud Defenders, including manual upgrade processes for individual Defenders. Best Practices for Managing Defender Upgrades: Offers guidelines on effectively planning and executing Defender upgrades, emphasizing the importance of aligning upgrade activities with maintenance windows to minimize disruption to the development environment.
C
Explanation:
Managing Defender upgrades in a Prisma Cloud environment requires careful planning, especially in scenarios where not all Defenders can be upgraded simultaneously due to maintenance window constraints.
Option C: Upgrade a subset of the Defenders by clicking the individual Actions > Upgrade button in the row that corresponds to the Defender that should be upgraded during the maintenance window is the recommended approach in this situation. This option allows administrators to manually select specific Defenders for upgrade within the available maintenance window, providing control over the upgrade process and ensuring that upgrades are aligned with operational requirements and maintenance schedules.
Reference: Prisma Cloud Defender Management Documentation: Details the procedures for managing and upgrading Prisma Cloud Defenders, including manual upgrade processes for individual Defenders. Best Practices for Managing Defender Upgrades: Offers guidelines on effectively planning and executing Defender upgrades, emphasizing the importance of aligning upgrade activities with maintenance windows to minimize disruption to the development environment.
Question #96
What is an example of an outbound notification within Prisma Cloud?
- A . AWS Inspector
- B . Qualys
- C . Tenable
- D . PagerDuty
Correct Answer: D
D
Explanation:
Outbound notifications in Prisma Cloud refer to the integration with external systems or services for the purpose of alerting or incident management.
Option D: PagerDuty is an example of an outbound notification within Prisma Cloud. PagerDuty is a popular incident response and alerting service that teams use to manage, track, and respond to incidents in real-time. Prisma Cloud’s integration with PagerDuty allows organizations to automatically forward alerts from Prisma Cloud to PagerDuty, enabling streamlined incident management and response workflows.
Reference: Prisma Cloud Integration Documentation: Provides instructions for integrating Prisma Cloud with various external services, including PagerDuty, to enhance alerting and incident management capabilities.
Incident Management Best Practices: Discusses strategies for effective incident management, highlighting the role of integrations with external alerting services like PagerDuty in improving response times and incident resolution.
D
Explanation:
Outbound notifications in Prisma Cloud refer to the integration with external systems or services for the purpose of alerting or incident management.
Option D: PagerDuty is an example of an outbound notification within Prisma Cloud. PagerDuty is a popular incident response and alerting service that teams use to manage, track, and respond to incidents in real-time. Prisma Cloud’s integration with PagerDuty allows organizations to automatically forward alerts from Prisma Cloud to PagerDuty, enabling streamlined incident management and response workflows.
Reference: Prisma Cloud Integration Documentation: Provides instructions for integrating Prisma Cloud with various external services, including PagerDuty, to enhance alerting and incident management capabilities.
Incident Management Best Practices: Discusses strategies for effective incident management, highlighting the role of integrations with external alerting services like PagerDuty in improving response times and incident resolution.
Question #97
A security team has been asked to create a custom policy.
Which two methods can the team use to accomplish this goal? (Choose two.)
- A . add a new policy
- B . clone an existing policy
- C . disable an out-of-the-box policy
- D . edit the query in the out-of-the-box policy
Correct Answer: AB
AB
Explanation:
To create a custom policy within a cloud security platform like Prisma Cloud, security teams have the flexibility to either add a new policy from scratch or clone an existing one to serve as a foundation for customization. Adding a new policy allows for the creation of a completely tailored rule set based on specific security requirements. Cloning an existing policy, on the other hand, provides a quick start by using the structure of an already established policy, which can then be modified to fit particular needs. This approach is beneficial for maintaining consistency with existing policies while addressing unique security scenarios. Disabling an out-of-the-box policy (option C) or editing the query in an out-of-the-box policy (option D) are actions that might be taken to customize policy enforcement but do not equate to the creation of a new custom policy.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/manage-prisma-cloud-policies
AB
Explanation:
To create a custom policy within a cloud security platform like Prisma Cloud, security teams have the flexibility to either add a new policy from scratch or clone an existing one to serve as a foundation for customization. Adding a new policy allows for the creation of a completely tailored rule set based on specific security requirements. Cloning an existing policy, on the other hand, provides a quick start by using the structure of an already established policy, which can then be modified to fit particular needs. This approach is beneficial for maintaining consistency with existing policies while addressing unique security scenarios. Disabling an out-of-the-box policy (option C) or editing the query in an out-of-the-box policy (option D) are actions that might be taken to customize policy enforcement but do not equate to the creation of a new custom policy.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/manage-prisma-cloud-policies
Question #98
The security auditors need to ensure that given compliance checks are being run on the host.
Which option is a valid host compliance policy?
- A . Ensure functions are not overly permissive.
- B . Ensure host devices are not directly exposed to containers.
- C . Ensure images are created with a non-root user.
- D . Ensure compliant Docker daemon configuration.
Correct Answer: D
D
Explanation:
The question focuses on valid host compliance policies within a cloud environment. Among the given options, the most relevant to host compliance is ensuring compliant Docker daemon configuration. Docker daemon configurations are critical for securing the host environment where containers are run. A compliant Docker daemon configuration involves setting security-related options to ensure the Docker engine operates securely. This can include configurations related to TLS for secure communication, logging levels, authorization plugins, and user namespace remapping for isolation.
Ensuring functions are not overly permissive (Option A) and ensuring images are created with a non-root user (Option C) are more directly related to the security best practices for serverless functions and container images, respectively, rather than host-specific compliance checks. Ensuring host devices are not directly exposed to containers (Option B) is also important for security, but it falls under the broader category of container runtime security rather than host-specific compliance.
Thus, the most valid host compliance policy from the given options is to ensure a compliant Docker daemon configuration, as it directly impacts the security posture of the host environment in a containerized infrastructure. This aligns with best practices for securing Docker environments and is a common recommendation in container security guidelines, including those from Docker and cybersecurity frameworks.
Reference: Docker Documentation: Security configuration and best practices for Docker engine:
https://docs.docker.com/engine/security/
CIS Docker Benchmark: Providing consensus-based best practices for securing Docker environments:
https://www.cisecurity.org/benchmark/docker/
D
Explanation:
The question focuses on valid host compliance policies within a cloud environment. Among the given options, the most relevant to host compliance is ensuring compliant Docker daemon configuration. Docker daemon configurations are critical for securing the host environment where containers are run. A compliant Docker daemon configuration involves setting security-related options to ensure the Docker engine operates securely. This can include configurations related to TLS for secure communication, logging levels, authorization plugins, and user namespace remapping for isolation.
Ensuring functions are not overly permissive (Option A) and ensuring images are created with a non-root user (Option C) are more directly related to the security best practices for serverless functions and container images, respectively, rather than host-specific compliance checks. Ensuring host devices are not directly exposed to containers (Option B) is also important for security, but it falls under the broader category of container runtime security rather than host-specific compliance.
Thus, the most valid host compliance policy from the given options is to ensure a compliant Docker daemon configuration, as it directly impacts the security posture of the host environment in a containerized infrastructure. This aligns with best practices for securing Docker environments and is a common recommendation in container security guidelines, including those from Docker and cybersecurity frameworks.
Reference: Docker Documentation: Security configuration and best practices for Docker engine:
https://docs.docker.com/engine/security/
CIS Docker Benchmark: Providing consensus-based best practices for securing Docker environments:
https://www.cisecurity.org/benchmark/docker/
Question #99
DRAG DROP
Match the correct scanning mode for each given operation. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)
Correct Answer:
Explanation:
Create SNS Topic Triggers: No data security scan
Select an S3 bucket: Forward Scan only
Select an S3 bucket with existing files: Forward or Backward Scan
Link an S3 logging to CloudTrail: Backward Scan only
The scanning mode for Data Security in AWS typically depends on the configuration and the desired outcomes for monitoring and protecting data within S3 buckets.
Creating SNS Topic Triggers is a configuration step that does not directly involve scanning. It is part of setting up notifications for events in S3 buckets, but on its own, it does not initiate a data security scan.
Selecting an S3 bucket without specifying existing files typically implies that you intend to scan new objects as they are added to the bucket, which is known as a Forward Scan. This mode is proactive and scans files upon their arrival in the bucket.
When you select an S3 bucket with existing files, you can perform either Forward Scanning for new files or Backward Scanning to scan all existing files in the bucket. This option provides the most comprehensive scanning coverage for both new and existing data.
Linking an S3 logging to CloudTrail is usually a step taken to monitor access and changes to S3 resources. In the context of scanning, linking S3 to CloudTrail does not initiate a scan, but the CloudTrail logs can be used to trigger a Backward Scan if configured to do so, which scans historical
files in the bucket based on CloudTrail events.
Question #100
A customer wants to be notified about port scanning network activities in their environment.
Which policy type detects this behavior?
- A . Network
- B . Port Scan
- C . Anomaly
- D . Config
Correct Answer: B
B
Explanation:
To detect port scanning activities within an environment, a "Port Scan" policy type (option B) would be the most appropriate. Port scanning is a technique used to identify open ports and services available on a host, often used by attackers to find vulnerabilities. A Port Scan policy is designed to detect and alert on such scanning activities, allowing security teams to take preventive measures. While Network (option A), Anomaly (option C), and Config (option D) policies play critical roles in cloud security, they do not specifically target the detection of port scanning behavior.
B
Explanation:
To detect port scanning activities within an environment, a "Port Scan" policy type (option B) would be the most appropriate. Port scanning is a technique used to identify open ports and services available on a host, often used by attackers to find vulnerabilities. A Port Scan policy is designed to detect and alert on such scanning activities, allowing security teams to take preventive measures. While Network (option A), Anomaly (option C), and Config (option D) policies play critical roles in cloud security, they do not specifically target the detection of port scanning behavior.
Question #101
A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80.
Which port should the team specify in the CNAF rule to protect the application?
- A . 443
- B . 80
- C . 8080
- D . 8888
Correct Answer: B
B
Explanation:
In the deployment scenario described, where an NGINX container is listening on port 8080 and mapped to host port 80, the Cloud Native Application Firewall (CNAF) rule should specify host port 80 (option B) to protect the application. This is because the external traffic directed towards the containerized application will be accessing it through the host port 80, which is the exposed port to the outside network. Specifying port 80 in the CNAF rule ensures that the firewall can inspect and protect the incoming traffic to the application effectively.
B
Explanation:
In the deployment scenario described, where an NGINX container is listening on port 8080 and mapped to host port 80, the Cloud Native Application Firewall (CNAF) rule should specify host port 80 (option B) to protect the application. This is because the external traffic directed towards the containerized application will be accessing it through the host port 80, which is the exposed port to the outside network. Specifying port 80 in the CNAF rule ensures that the firewall can inspect and protect the incoming traffic to the application effectively.
Question #102
Which three types of buckets exposure are available in the Data Security module? (Choose three.)
- A . Public
- B . Private
- C . International
- D . Differential
- E . Conditional
Correct Answer: ABE
ABE
Explanation:
In the Data Security module of cloud security platforms like Prisma Cloud, the types of bucket exposures typically include Public (option A), Private (option B), and Conditional (option E). Public buckets are accessible by anyone on the internet, posing a significant data leakage risk. Private buckets are restricted to authorized users only, offering a higher level of security. Conditional exposure involves buckets that may be accessible under certain conditions or to specific users, requiring careful configuration and policy enforcement to prevent unauthorized access. International (option C) and Differential (option D) do not represent standard types of bucket exposures in cloud security contexts.
ABE
Explanation:
In the Data Security module of cloud security platforms like Prisma Cloud, the types of bucket exposures typically include Public (option A), Private (option B), and Conditional (option E). Public buckets are accessible by anyone on the internet, posing a significant data leakage risk. Private buckets are restricted to authorized users only, offering a higher level of security. Conditional exposure involves buckets that may be accessible under certain conditions or to specific users, requiring careful configuration and policy enforcement to prevent unauthorized access. International (option C) and Differential (option D) do not represent standard types of bucket exposures in cloud security contexts.
Question #103
The administrator wants to review the Console audit logs from within the Console.
Which page in the Console should the administrator use to review this data, if it can be reviewed at all?
- A . Navigate to Monitor > Events > Host Log Inspection
- B . The audit logs can be viewed only externally to the Console
- C . Navigate to Manage > Defenders > View Logs
- D . Navigate to Manage > View Logs > History
Correct Answer: B
B
Explanation:
Console audit logs, which provide records of user activities and changes within the cloud security platform, are typically not viewable directly within the Console itself. They are usually accessible externally to the Console (option B), either through a dedicated logging or security information and event management (SIEM) system, or via cloud provider’s logging services. This external access ensures that audit logs are securely stored and managed, providing an immutable record of activities for compliance and forensic analysis.
B
Explanation:
Console audit logs, which provide records of user activities and changes within the cloud security platform, are typically not viewable directly within the Console itself. They are usually accessible externally to the Console (option B), either through a dedicated logging or security information and event management (SIEM) system, or via cloud provider’s logging services. This external access ensures that audit logs are securely stored and managed, providing an immutable record of activities for compliance and forensic analysis.
Question #104
DRAG DROP
What is the order of steps in a Jenkins pipeline scan? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Build Image, Scan Image, Publish Scan, Commit to Registry (if scan result is passed)
Question #105
DRAG DROP
What is the order of steps to create a custom network policy? (Drag the steps into the correct order of occurrence, from the first step to the last.)
Correct Answer:
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-
policies/create-a- policy.html
Select Policies and click Add Policy
Build the query
Add the compliance standards
Click Submit.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy
Question #106
DRAG DROP
You wish to create a custom policy with build and run subtypes.
Match the query types for each example. (Select your answer from the pull-down list. Answers may be used more than once or not at all.)
Correct Answer:
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a- policy.html
Question #107
Which statement is true regarding CloudFormation templates?
- A . Scan support does not currently exist for nested references, macros, or intrinsic functions.
- B . A single template or a zip archive of template files cannot be scanned with a single API request.
- C . Request-Header-Field ‘cloudformation-version’ is required to request a scan.
- D . Scan support is provided for JSON, HTML and YAML formats.
Correct Answer: A
A
Explanation:
CloudFormation templates, used to describe and provision all the infrastructure resources in cloud environments, support various elements including resources, mappings, parameters, and outputs. However, scan support for CloudFormation templates does not currently exist for nested references, macros, or intrinsic functions (option A). These advanced CloudFormation features can introduce complexity in scanning and interpreting the templates accurately for security and compliance checks.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-devops-security/use-the-prisma-cloud-iac-scan-rest-api.html
A
Explanation:
CloudFormation templates, used to describe and provision all the infrastructure resources in cloud environments, support various elements including resources, mappings, parameters, and outputs. However, scan support for CloudFormation templates does not currently exist for nested references, macros, or intrinsic functions (option A). These advanced CloudFormation features can introduce complexity in scanning and interpreting the templates accurately for security and compliance checks.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-devops-security/use-the-prisma-cloud-iac-scan-rest-api.html
Question #108
A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time.
What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)
- A . manual installation of the latest twistcli tool prior to the rolling upgrade
- B . all Defenders set in read-only mode before execution of the rolling upgrade
- C . a second location where you can install the Console
- D . additional workload licenses are required to perform the rolling upgrade
- E . an existing Console at version n-1
Correct Answer: BE
BE
Explanation:
Prior to performing a rolling upgrade of Defenders, which are components responsible for enforcing security policies and protecting cloud workloads, one of the prerequisites is having an existing Console at version n-1 (option E). This ensures that the Console, which manages the Defenders, is compatible and can support the upgraded Defenders. A rolling upgrade allows for minimal disruption and ensures continuous protection during the upgrade process. The other options listed do not directly pertain to the prerequisites for a Defender rolling upgrade.
BE
Explanation:
Prior to performing a rolling upgrade of Defenders, which are components responsible for enforcing security policies and protecting cloud workloads, one of the prerequisites is having an existing Console at version n-1 (option E). This ensures that the Console, which manages the Defenders, is compatible and can support the upgraded Defenders. A rolling upgrade allows for minimal disruption and ensures continuous protection during the upgrade process. The other options listed do not directly pertain to the prerequisites for a Defender rolling upgrade.
Question #109
An administrator sees that a runtime audit has been generated for a Container. The audit message is “DNS resolution of suspicious name wikipedia.com. type A”.
Why would this message appear as an audit?
- A . The DNS was not learned as part of the Container model or added to the DNS allow list.
- B . This is a DNS known to be a source of malware.
- C . The process calling out to this domain was not part of the Container model.
- D . The Layer7 firewall detected this as anomalous behavior.
Correct Answer: A
A
Explanation:
The runtime audit message indicating "DNS resolution of suspicious name wikipedia.com. type A" would appear as an audit because the DNS was not learned as part of the Container model or added to the DNS allow list (option A). In cloud security platforms like Prisma Cloud, runtime protection policies monitor the behavior of running containers and compare it against a learned model of expected behavior. If a container attempts to resolve a DNS name that was not observed during the learning phase or specifically allowed, it triggers an audit event to alert security teams of potentially malicious activity.
A
Explanation:
The runtime audit message indicating "DNS resolution of suspicious name wikipedia.com. type A" would appear as an audit because the DNS was not learned as part of the Container model or added to the DNS allow list (option A). In cloud security platforms like Prisma Cloud, runtime protection policies monitor the behavior of running containers and compare it against a learned model of expected behavior. If a container attempts to resolve a DNS name that was not observed during the learning phase or specifically allowed, it triggers an audit event to alert security teams of potentially malicious activity.
Question #110
Which “kind” of Kubernetes object is configured to ensure that Defender is acting as the admission controller?
- A . MutatingWebhookConfiguration
- B . DestinationRules
- C . ValidatingWebhookConfiguration
- D . PodSecurityPolicies
Correct Answer: C
C
Explanation:
In the context of Kubernetes, an admission controller is a piece of code that intercepts requests to the Kubernetes API server before the persistence of the object, but after the request is authenticated and authorized. The admission controller lets you apply complex validation and policy controls to objects before they are created or updated.
The ValidatingWebhookConfiguration is a Kubernetes object that tells the API server to send an admission validation request to a service (the admission webhook) when a request to create, update, or delete a Kubernetes object matches the rules defined in the configuration. The webhook can then approve or deny the request based on custom logic.
The MutatingWebhookConfiguration is similar but is used to modify objects before they are created or updated, which is not the primary function of an admission controller acting in a protective or validating capacity.
DestinationRules are related to Istio service mesh and are not relevant to Kubernetes admission control.
PodSecurityPolicies (PSPs) are a type of admission controller in Kubernetes but they are predefined by Kubernetes and do not require a specific configuration object like ValidatingWebhookConfiguration. PSPs are also deprecated in recent versions of Kubernetes.
Therefore, the correct answer is
C. ValidatingWebhookConfiguration, as it is the Kubernetes object used to configure admission webhooks for validating requests, which aligns with the role of Defender acting as an admission controller in Prisma Cloud.
Reference from the provided documents:
The documents uploaded do not contain specific details about Kubernetes objects or Prisma Cloud’s integration with Kubernetes. However, this explanation aligns with general Kubernetes practices and Prisma Cloud’s capabilities in securing Kubernetes environments.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/access_control/open_policy_agent.html
C
Explanation:
In the context of Kubernetes, an admission controller is a piece of code that intercepts requests to the Kubernetes API server before the persistence of the object, but after the request is authenticated and authorized. The admission controller lets you apply complex validation and policy controls to objects before they are created or updated.
The ValidatingWebhookConfiguration is a Kubernetes object that tells the API server to send an admission validation request to a service (the admission webhook) when a request to create, update, or delete a Kubernetes object matches the rules defined in the configuration. The webhook can then approve or deny the request based on custom logic.
The MutatingWebhookConfiguration is similar but is used to modify objects before they are created or updated, which is not the primary function of an admission controller acting in a protective or validating capacity.
DestinationRules are related to Istio service mesh and are not relevant to Kubernetes admission control.
PodSecurityPolicies (PSPs) are a type of admission controller in Kubernetes but they are predefined by Kubernetes and do not require a specific configuration object like ValidatingWebhookConfiguration. PSPs are also deprecated in recent versions of Kubernetes.
Therefore, the correct answer is
C. ValidatingWebhookConfiguration, as it is the Kubernetes object used to configure admission webhooks for validating requests, which aligns with the role of Defender acting as an admission controller in Prisma Cloud.
Reference from the provided documents:
The documents uploaded do not contain specific details about Kubernetes objects or Prisma Cloud’s integration with Kubernetes. However, this explanation aligns with general Kubernetes practices and Prisma Cloud’s capabilities in securing Kubernetes environments.
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition-admin/access_control/open_policy_agent.html
Question #111
Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)
- A . Scope – Scans run on a particular host
- B . Credential
- C . Apply rule only when vendor fixes are available
- D . Failure threshold
- E . Grace Period
Correct Answer: BCD
BCD
Explanation:
For CI policy in image scanning with Jenkins or twistcli, options related to scoping include specifying credentials for accessing and scanning the images, setting conditions such as applying the rule only when vendor fixes are available to prioritize remediation efforts, and establishing failure thresholds to determine the severity levels that will cause the build to fail. These options focus on integrating security into the CI/CD pipeline, ensuring images are scanned for vulnerabilities, and enforcing security standards without hindering the development process. This approach aligns with best practices in DevSecOps by embedding security early in the development lifecycle, allowing for early detection and mitigation of vulnerabilities.
BCD
Explanation:
For CI policy in image scanning with Jenkins or twistcli, options related to scoping include specifying credentials for accessing and scanning the images, setting conditions such as applying the rule only when vendor fixes are available to prioritize remediation efforts, and establishing failure thresholds to determine the severity levels that will cause the build to fail. These options focus on integrating security into the CI/CD pipeline, ensuring images are scanned for vulnerabilities, and enforcing security standards without hindering the development process. This approach aligns with best practices in DevSecOps by embedding security early in the development lifecycle, allowing for early detection and mitigation of vulnerabilities.
Question #112
Which component(s), if any, will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?
- A . Defenders
- B . Console
- C . Jenkins
- D . twistcli
Correct Answer: B
B
Explanation:
In Prisma Cloud Enterprise Edition, Palo Alto Networks hosts and runs the Console component. The Console serves as the central management interface for Prisma Cloud, allowing customers to configure policies, view alerts, and manage their cloud security posture without the need to host this component themselves.
B
Explanation:
In Prisma Cloud Enterprise Edition, Palo Alto Networks hosts and runs the Console component. The Console serves as the central management interface for Prisma Cloud, allowing customers to configure policies, view alerts, and manage their cloud security posture without the need to host this component themselves.
Question #113
Which port should a security team use to pull data from Console’s API?
- A . 53
- B . 25
- C . 8084
- D . 8083
Correct Answer: C
C
Explanation:
Port 8084 is commonly used for accessing the Console’s API in Prisma Cloud. This port allows security teams to programmatically interact with the Prisma Cloud Console, pulling data and automating various security and compliance tasks.
C
Explanation:
Port 8084 is commonly used for accessing the Console’s API in Prisma Cloud. This port allows security teams to programmatically interact with the Prisma Cloud Console, pulling data and automating various security and compliance tasks.
Question #114
You are an existing customer of Prisma Cloud Enterprise. You want to onboard a public cloud account and immediately see all of the alerts associated with this account based off ALL of your tenant’s existing enabled policies. There is no requirement to send alerts from this account to a downstream application at this time.
Which option shows the steps required during the alert rule creation process to achieve this objective?
- A . Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule
Select “select all policies” checkbox as part of the alert rule Confirm the alert rule - B . Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule
Select one or more policies checkbox as part of the alert rule Confirm the alert rule - C . Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule
Select one or more policies as part of the alert rule Add alert notifications Confirm the alert rule - D . Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule
Select “select all policies” checkbox as part of the alert rule Add alert notifications Confirm the alert rule
Correct Answer: A
A
Explanation:
To immediately see all alerts associated with a newly onboarded public cloud account based on existing enabled policies, it is essential to assign the account to an account group and then create an alert rule that applies to this account group. By selecting "select all policies," the alert rule will trigger alerts for all existing enabled policies without the need to specify individual policies or add alert notifications for downstream applications.
A
Explanation:
To immediately see all alerts associated with a newly onboarded public cloud account based on existing enabled policies, it is essential to assign the account to an account group and then create an alert rule that applies to this account group. By selecting "select all policies," the alert rule will trigger alerts for all existing enabled policies without the need to specify individual policies or add alert notifications for downstream applications.
Question #115
A customer has configured the JIT, and the user created by the process is trying to log in to the
Prisma Cloud console.
The user encounters the following error message:
What is the reason for the error message?
- A . The attribute name is not set correctly in JIT settings.
- B . The user does not exist.
- C . The user entered an incorrect password
- D . The role is not assigned for the user.
Correct Answer: A
A
Explanation:
Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmZ4CAK
The error message encountered by the user trying to log into the Prisma Cloud console is likely due to an incorrect configuration in the Just-In-Time (JIT) settings, specifically the attribute name used for JIT authentication. This could prevent the user from being recognized correctly by the Prisma Cloud console.
A
Explanation:
Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmZ4CAK
The error message encountered by the user trying to log into the Prisma Cloud console is likely due to an incorrect configuration in the Just-In-Time (JIT) settings, specifically the attribute name used for JIT authentication. This could prevent the user from being recognized correctly by the Prisma Cloud console.
Question #116
What are the two ways to scope a CI policy for image scanning? (Choose two.)
- A . container name
- B . image name
- C . hostname
- D . image labels
Correct Answer: B, D
B, D
Explanation:
Reference: https://www.optiv.com/insights/source-zero/blog/defending-against-container-threats-palo-alto-prisma-cloud
In Prisma Cloud, CI policies for image scanning can be scoped based on the image name and image labels. These scoping options allow for targeted scanning of images, ensuring that policies are applied to relevant images based on their identifiers or metadata.
B, D
Explanation:
Reference: https://www.optiv.com/insights/source-zero/blog/defending-against-container-threats-palo-alto-prisma-cloud
In Prisma Cloud, CI policies for image scanning can be scoped based on the image name and image labels. These scoping options allow for targeted scanning of images, ensuring that policies are applied to relevant images based on their identifiers or metadata.
Question #117
Which policy type in Prisma Cloud can protect against malware?
- A . Data
- B . Config
- C . Network
- D . Event
Correct Answer: A
A
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy.html#:~:text=%E2%80%94Data%20policies%20protect%20against%20malware,for%20Data%20Exposure%20or%20Malware
The Data policy type in Prisma Cloud is designed to protect against malware by scanning data and files for malicious content. This policy type helps in identifying and mitigating malware threats in the cloud environment.
A
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/create-a-policy.html#:~:text=%E2%80%94Data%20policies%20protect%20against%20malware,for%20Data%20Exposure%20or%20Malware
The Data policy type in Prisma Cloud is designed to protect against malware by scanning data and files for malicious content. This policy type helps in identifying and mitigating malware threats in the cloud environment.
Question #118
If you are required to run in an air-gapped environment, which product should you install?
- A . Prisma Cloud Jenkins Plugin
- B . Prisma Cloud Compute Edition
- C . Prisma Cloud with self-hosted plugin
- D . Prisma Cloud Enterprise Edition
Correct Answer: B
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud.html
Prisma Cloud Compute Edition is the suitable product for air-gapped environments, where there is no direct internet access. This edition can be installed and operated in isolated environments, providing cloud security capabilities without the need for external connectivity.
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud.html
Prisma Cloud Compute Edition is the suitable product for air-gapped environments, where there is no direct internet access. This edition can be installed and operated in isolated environments, providing cloud security capabilities without the need for external connectivity.
Question #119
What is the maximum number of access keys a user can generate in Prisma Cloud with a System Admin role?
- A . 1
- B . 2
- C . 3
- D . 4
Correct Answer: B
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys.html#:~:text=You%20can%20enable%20API%20access,generate%20one%20access%20key%20only
In Prisma Cloud, a user with a System Admin role can generate a maximum of 2 access keys. These keys are used for API access and automation, enabling secure and controlled interactions with Prisma Cloud’s capabilities.
B
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys.html#:~:text=You%20can%20enable%20API%20access,generate%20one%20access%20key%20only
In Prisma Cloud, a user with a System Admin role can generate a maximum of 2 access keys. These keys are used for API access and automation, enabling secure and controlled interactions with Prisma Cloud’s capabilities.
Question #120
DRAG DROP
Put the steps involved to configure and scan using the IntelliJ plugin in the correct order.
Correct Answer:
Explanation:
Install IntelliJ IDE
Add Prisma Cloud plugin
Configure the Prisma Cloud plugin
Scan using the Prisma Cloud plugin
To configure and use the Prisma Cloud plugin for scanning within the IntelliJ Integrated Development Environment (IDE), you must follow a series of steps in a specific order to ensure proper setup and functionality.
Firstly, you need to have the IntelliJ IDE installed on your system. Without the IDE, you cannot add or use the Prisma Cloud plugin, as it is designed to work within this development environment. Secondly, after installing the IntelliJ IDE, you add the Prisma Cloud plugin. This involves navigating to the plugin marketplace within IntelliJ and selecting the Prisma Cloud plugin for installation.
Once the plugin is added to your IntelliJ IDE, the next step is to configure the Prisma Cloud plugin. This configuration may include setting up your Prisma Cloud credentials, specifying your scan options, and other settings that tailor the plugin’s functionality to your needs.
Finally, after the plugin is installed and configured, you can proceed to scan your project using the Prisma Cloud plugin. This will check your code against security policies and compliance standards, providing feedback and recommendations for any identified issues.
Following these steps ensures that the Prisma Cloud plugin is properly integrated into your IntelliJ development workflow, allowing for continuous security and compliance checks as part of the development process.
Question #121
An administrator needs to detect and alert on any activities performed by a root account.
Which policy type should be used?
- A . config-run
- B . config-build
- C . network
- D . audit event
Correct Answer: D
D
Explanation:
To detect and alert on activities performed by a root account, an audit event policy should be used. An audit event policy is a type of policy that can be used to detect suspicious activities or events that may be related to security threats. This type of policy will allow the administrator to monitor and alert on any activities performed by a root account.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/prisma-cloud-threat-detection
The correct policy type to use in order to detect and alert on any activities performed by a root account is an "audit event" policy. An audit event policy is designed to monitor and record a series of chronological events in the order they occur, typically used to track user activities and changes within the system. When a root account performs any actions, an audit event policy will log these events, allowing the administrator to review and potentially set up alerts if suspicious or unauthorized activities are detected. This type of policy is crucial for security and compliance purposes as it helps ensure that all actions performed with root privileges are legitimate and authorized.
Reference to this can be found in most cloud security platforms that offer CSPM (Cloud Security Posture Management) solutions. For example, within Prisma Cloud by Palo Alto Networks, audit events are a part of the Activity Monitoring features, which track user activities and system changes to facilitate investigations into suspicious or unauthorized actions.
D
Explanation:
To detect and alert on activities performed by a root account, an audit event policy should be used. An audit event policy is a type of policy that can be used to detect suspicious activities or events that may be related to security threats. This type of policy will allow the administrator to monitor and alert on any activities performed by a root account.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/prisma-cloud-threat-detection
The correct policy type to use in order to detect and alert on any activities performed by a root account is an "audit event" policy. An audit event policy is designed to monitor and record a series of chronological events in the order they occur, typically used to track user activities and changes within the system. When a root account performs any actions, an audit event policy will log these events, allowing the administrator to review and potentially set up alerts if suspicious or unauthorized activities are detected. This type of policy is crucial for security and compliance purposes as it helps ensure that all actions performed with root privileges are legitimate and authorized.
Reference to this can be found in most cloud security platforms that offer CSPM (Cloud Security Posture Management) solutions. For example, within Prisma Cloud by Palo Alto Networks, audit events are a part of the Activity Monitoring features, which track user activities and system changes to facilitate investigations into suspicious or unauthorized actions.
Question #122
One of the resources on the network has triggered an alert for a Default Config policy.
Given the following resource JSON snippet:
Which RQL detected the vulnerability?
A)
B)
C)
D)
- A . Option A
- B . Option B
- C . Option C
- D . Option D
Correct Answer: B
B
Explanation:
The correct RQL (Resource Query Language) that detected the vulnerability is:
config from cloud.resource where cloud.type = ‘aws’ and api.name = ‘aws-iam-get-credential-report’ AND json.rule = ‘(access_key_1_active is true and access_key_1_last_rotated != N/A and DateTime. ageInDays (access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime. ageInDays (access_key_2_last_rotated) > 90)’ This RQL is designed to check the age of the AWS IAM user’s access keys to ensure that they are rotated within a recommended period, typically 90 days. If the access keys have not been rotated within this timeframe, it would be considered a security risk or vulnerability, as old keys may potentially be compromised. By enforcing access key rotation, it minimizes the risk of unauthorized access.
The reference for this type of policy check can be seen in cloud security best practices that advocate for regular rotation of access keys to minimize the potential impact of key compromise. CSPM tools like Prisma Cloud include such checks to automate compliance with these best practices.
B
Explanation:
The correct RQL (Resource Query Language) that detected the vulnerability is:
config from cloud.resource where cloud.type = ‘aws’ and api.name = ‘aws-iam-get-credential-report’ AND json.rule = ‘(access_key_1_active is true and access_key_1_last_rotated != N/A and DateTime. ageInDays (access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime. ageInDays (access_key_2_last_rotated) > 90)’ This RQL is designed to check the age of the AWS IAM user’s access keys to ensure that they are rotated within a recommended period, typically 90 days. If the access keys have not been rotated within this timeframe, it would be considered a security risk or vulnerability, as old keys may potentially be compromised. By enforcing access key rotation, it minimizes the risk of unauthorized access.
The reference for this type of policy check can be seen in cloud security best practices that advocate for regular rotation of access keys to minimize the potential impact of key compromise. CSPM tools like Prisma Cloud include such checks to automate compliance with these best practices.
Question #123
A customer has multiple violations in the environment including:
User namespace is enabled
An LDAP server is enabled
SSH root is enabled
Which section of Console should the administrator use to review these findings?
- A . Manage
- B . Vulnerabilities
- C . Radar
- D . Compliance
Correct Answer: D
D
Explanation:
The correct section of the Console that the administrator should use to review findings such as "User namespace is enabled", "An LDAP server is enabled", and "SSH root is enabled" is "Compliance".
The "Compliance" section in CSPM tools like Prisma Cloud provides an overview of the current compliance posture against various regulatory standards and best practices. It can help identify configurations that do not adhere to best practices or that may violate compliance requirements, such as enabling the user namespace, which could be a security risk, or having an LDAP server and SSH root enabled, which may not comply with certain security standards.
Reference to the use of the "Compliance" section can be found in CSPM documentation, where it details how compliance checks are used to assess the security and configuration of cloud resources against established benchmarks and standards, allowing organizations to maintain compliance and improve their security posture.
D
Explanation:
The correct section of the Console that the administrator should use to review findings such as "User namespace is enabled", "An LDAP server is enabled", and "SSH root is enabled" is "Compliance".
The "Compliance" section in CSPM tools like Prisma Cloud provides an overview of the current compliance posture against various regulatory standards and best practices. It can help identify configurations that do not adhere to best practices or that may violate compliance requirements, such as enabling the user namespace, which could be a security risk, or having an LDAP server and SSH root enabled, which may not comply with certain security standards.
Reference to the use of the "Compliance" section can be found in CSPM documentation, where it details how compliance checks are used to assess the security and configuration of cloud resources against established benchmarks and standards, allowing organizations to maintain compliance and improve their security posture.
Question #124
A customer has serverless functions that are deployed in multiple clouds.
Which serverless cloud provider is covered be “overly permissive service access” compliance check?
- A . Alibaba
- B . GCP
- C . AWS
- D . Azure
Correct Answer: C
C
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/serverless.html
The serverless cloud provider covered by the “overly permissive service access” compliance check is AWS (Amazon Web Services). AWS Lambda, which is the serverless computing platform provided by
AWS, may have functions that are assigned more permissions than they require to perform their operations, leading to security risks.
In the context of CSPM tools, such as Prisma Cloud, checks for overly permissive service access would typically include examining the policies attached to AWS Lambda functions to ensure that they adhere to the principle of least privilege. Such checks help identify and rectify overly broad permissions that could potentially be exploited by attackers.
The reference for this can be found in AWS best practices for Lambda security, which emphasize the importance of granting minimal privileges necessary for the Lambda function to perform its tasks, thereby reducing the potential attack surface.
C
Explanation:
Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/compliance/serverless.html
The serverless cloud provider covered by the “overly permissive service access” compliance check is AWS (Amazon Web Services). AWS Lambda, which is the serverless computing platform provided by
AWS, may have functions that are assigned more permissions than they require to perform their operations, leading to security risks.
In the context of CSPM tools, such as Prisma Cloud, checks for overly permissive service access would typically include examining the policies attached to AWS Lambda functions to ensure that they adhere to the principle of least privilege. Such checks help identify and rectify overly broad permissions that could potentially be exploited by attackers.
The reference for this can be found in AWS best practices for Lambda security, which emphasize the importance of granting minimal privileges necessary for the Lambda function to perform its tasks, thereby reducing the potential attack surface.
Question #125
A customer has a requirement to restrict any container from resolving the name www.evil-url.com.
How should the administrator configure Prisma Cloud Compute to satisfy this requirement?
- A . Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name in the Container policy and set the policy effect to alert.
- B . Set www.evil-url.com as a blocklisted DNS name in the default Container runtime policy, and set the effect to block.
- C . Choose “copy into rule” for any Container, set www.evil-url.com as a blocklisted DNS name, and set the effect to prevent.
- D . Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.
Correct Answer: D
D
Explanation:
To restrict any container from resolving the name www.evil-url.com, the administrator should set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent. This configuration in Prisma Cloud, or similar CSPM tools, ensures that any attempt to resolve the specified blocklisted DNS name within any container will be prevented, thus enhancing security by proactively blocking potential communication with known malicious domains.
Reference to this feature can be found in the documentation of CSPM tools that offer runtime protection for containers. These tools allow administrators to define security policies that can include DNS-based controls to prevent containers from accessing known malicious or undesirable URLs, thereby preventing potential data exfiltration, malware communication, or other security threats
D
Explanation:
To restrict any container from resolving the name www.evil-url.com, the administrator should set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent. This configuration in Prisma Cloud, or similar CSPM tools, ensures that any attempt to resolve the specified blocklisted DNS name within any container will be prevented, thus enhancing security by proactively blocking potential communication with known malicious domains.
Reference to this feature can be found in the documentation of CSPM tools that offer runtime protection for containers. These tools allow administrators to define security policies that can include DNS-based controls to prevent containers from accessing known malicious or undesirable URLs, thereby preventing potential data exfiltration, malware communication, or other security threats
Question #126
Which API calls can scan an image named myimage: latest with twistcli and then retrieve the results from Console?
- A . $ twistcli images scan
–address <COMPUTE_CONSOLE>
–user <COMPUTER_CONSOLE_USER>
–password <COMPUTER_CONSOLE_PASSWD>
–verbose
myimage: latest - B . $ twistcli images scan
–address <COMPUTE_CONSOLE>
–user <COMPUTER_CONSOLE_USER>
–password <COMPUTER_CONSOLE_PASSWD>
–details
myimage: latest - C . $ twistcli images scan
–address <COMPUTE_CONSOLE>
–user <COMPUTER_CONSOLE_USER>
–password <COMPUTER_CONSOLE_PASSWD>
myimage: latest - D . $ twistcli images scan
–address <COMPUTE_CONSOLE>
–user <COMPUTER_CONSOLE_USER>
–password <COMPUTER_CONSOLE_PASSWD>
–console
myimage: latest
Correct Answer: C
C
Explanation:
The API calls that can scan an image named myimage: latest with twistcli and then retrieve the results from Console do not require any additional flags beyond the address, user, and password for the Prisma Cloud Compute console. The –verbose, –details, and –console flags are not necessary for performing the scan and retrieving the results. The twistcli command with the required parameters initiates the scan, and upon completion, the results are available in the Prisma Cloud Compute console for review.
Reference to this process is provided in the Prisma Cloud Compute documentation, which outlines the steps for scanning container images with the twistcli command-line tool and retrieving the results from the Compute Console for analysis and action.
C
Explanation:
The API calls that can scan an image named myimage: latest with twistcli and then retrieve the results from Console do not require any additional flags beyond the address, user, and password for the Prisma Cloud Compute console. The –verbose, –details, and –console flags are not necessary for performing the scan and retrieving the results. The twistcli command with the required parameters initiates the scan, and upon completion, the results are available in the Prisma Cloud Compute console for review.
Reference to this process is provided in the Prisma Cloud Compute documentation, which outlines the steps for scanning container images with the twistcli command-line tool and retrieving the results from the Compute Console for analysis and action.
Question #127
Given the following RQL:
event from cloud.audit_logs where operation IN (‘CreateCryptoKey’, ‘DestroyCryptoKeyVersion’, ‘v1.compute.disks.createSnapshot’)
Which audit event snippet is identified?
A)
B)
C)
D)
- A . Option A
- B . Option B
- C . Option C
- D . Option D
Correct Answer: C
C
Explanation:
The given RQL (Resource Query Language) query is looking for specific audit events related to cryptographic key actions and snapshot creation. The snippet that matches this query is Option C, which contains the statement indicating permissions that allow any action ("Action": "*") and the reference to the version date "2012-10-17" that corresponds to the policy within the audit log.
This can be cross-referenced with cloud provider documentation, such as AWS CloudTrail or Google Cloud Audit Logs, which record user activities and API usage. The RQL provided would be used in a CSPM tool to query these audit logs for the specified events.
C
Explanation:
The given RQL (Resource Query Language) query is looking for specific audit events related to cryptographic key actions and snapshot creation. The snippet that matches this query is Option C, which contains the statement indicating permissions that allow any action ("Action": "*") and the reference to the version date "2012-10-17" that corresponds to the policy within the audit log.
This can be cross-referenced with cloud provider documentation, such as AWS CloudTrail or Google Cloud Audit Logs, which record user activities and API usage. The RQL provided would be used in a CSPM tool to query these audit logs for the specified events.
Question #128
Which two of the following are required to be entered on the IdP side when setting up SSO in Prisma Cloud? (Choose two.)
- A . Username
- B . SSO Certificate
- C . Assertion Consumer Service (ACS) URL
- D . SP (Service Provider) Entity ID
Correct Answer: C, D
C, D
Explanation:
When setting up Single Sign-On (SSO) in Prisma Cloud on the Identity Provider (IdP) side, it is essential to configure the Assertion Consumer Service (ACS) URL and the Service Provider (SP) Entity ID. The ACS URL is the endpoint to which the IdP will send the SAML assertion, and the SP Entity ID is a unique identifier for the service provider that often resembles a URL but does not necessarily point to a location. These elements are crucial for establishing the trust relationship between the IdP and the service provider, enabling secure user authentication and authorization.
C, D
Explanation:
When setting up Single Sign-On (SSO) in Prisma Cloud on the Identity Provider (IdP) side, it is essential to configure the Assertion Consumer Service (ACS) URL and the Service Provider (SP) Entity ID. The ACS URL is the endpoint to which the IdP will send the SAML assertion, and the SP Entity ID is a unique identifier for the service provider that often resembles a URL but does not necessarily point to a location. These elements are crucial for establishing the trust relationship between the IdP and the service provider, enabling secure user authentication and authorization.
Question #129
An administrator sees that a runtime audit has been generated for a container.
The audit message is: “/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr”
Which protection in the runtime rule would cause this audit?
- A . Networking
- B . File systems
- C . Processes
- D . Container
Correct Answer: C
C
Explanation:
The protection in the runtime rule that would cause the audit message indicating "/bin/ls launched and is explicitly blocked in the runtime rule" is related to "Processes". In container security, a runtime rule set to monitor and restrict processes can block specific executables or commands from running within a container. If the rule is triggered, it indicates that a process that is explicitly denied by the policy attempted to execute, which in this case is the ‘ls’ command.
C
Explanation:
The protection in the runtime rule that would cause the audit message indicating "/bin/ls launched and is explicitly blocked in the runtime rule" is related to "Processes". In container security, a runtime rule set to monitor and restrict processes can block specific executables or commands from running within a container. If the rule is triggered, it indicates that a process that is explicitly denied by the policy attempted to execute, which in this case is the ‘ls’ command.