CloudSec-Pro Practice Questions

The official registry that distributes Prisma Cloud Compute Edition images is registry.twistlock.com. Using basic authentication you first run docker login against that registry and then docker pull the required Console image.

A. registry.paloaltonetworks.com hosts other Palo Alto assets, not Compute Console images.

C. registry-url-auth.twistlock.com is not an official endpoint; URL-embedded auth is unsupported.

D. registry-auth.twistlock.com is used for programmatic token retrieval, not for basic-auth pulls.

1. Palo Alto Networks “Prisma Cloud Compute Edition Admin Guide” v22.06

Install > Deploy Console

p. 54 (“docker login registry.twistlock.com … docker pull registry.twistlock.com/twistlock/console:”).

2. Palo Alto Networks Knowledge Base Article #PCS-IMG-001 (“Registry endpoints for Compute Edition images”).

To deploy Defenders on the same Kubernetes cluster as the Console, the standard and recommended method is using a DaemonSet. This ensures each node gets a Defender. The deployment manifest is generated from the Console UI (Manage > Defenders > Deploy). When prompted for the Console's address, the Kubernetes service name for the Console, which is twistlock-console by default, should be used. This provides a stable endpoint for Defenders to connect to. The generated DaemonSet YAML file is then applied to the cluster, typically in the twistlock namespace.

A. Using a specific pod name is incorrect because pods are ephemeral; the stable Kubernetes service name must be used for reliable communication.

B. Cloud discovery and auto-protection is a different deployment method and not the direct manual deployment process described.

D. The curl | bash script is for single Docker hosts, not for deploying across a Kubernetes cluster using a DaemonSet.

1. Palo Alto Networks

"Prisma Cloud Compute - Administrator's Guide

" Version Self-Hosted 32.01. The "Deploy Defenders" section for Kubernetes details the process of generating a DaemonSet YAML file from the Console. It specifies using the Console's service name (default: twistlock-console) as the address for the Defenders to connect to.

Prisma Cloud provides two primary methods for generating compliance reports. Users can generate a report immediately on-demand, which corresponds to a "One time" frequency. Alternatively, users can schedule reports to run automatically on a "Recurring" basis. The recurring schedule can be set to daily, weekly, or monthly intervals to automate compliance monitoring and reporting over time. These two options cover both ad-hoc and continuous compliance assessment needs.

A. Weekly: This is a specific type of recurring schedule. The broader category "Recurring" is a more encompassing choice alongside "One time."

C. Monthly: Like "Weekly," this is a specific instance of a recurring schedule, making the general term "Recurring" the better high-level option.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide. "Generate Compliance Reports on Prisma Cloud." The documentation describes the options to either "Run Now" (One time) or "Schedule" (Recurring) a report. The scheduling options listed are Daily

Weekly

and Monthly.

Just-In-Time (JIT) provisioning in Prisma Cloud creates a user account upon their first successful SSO login. The user's role is assigned based on attributes passed in the SAML assertion from the Identity Provider (IdP). If the attribute name configured in Prisma Cloud's JIT settings does not exactly match the attribute name sent by the IdP, Prisma Cloud cannot map the user to a role. This results in an authorization failure, as the user has no permissions within the console.

B. The user is created by the JIT process upon the first login attempt, so the user does exist, but they lack a role.

C. Authentication is handled by the IdP via SSO; the user does not enter a password directly into the Prisma Cloud console.

D. While the user does not have a role assigned, this is a symptom. The root cause is the misconfiguration of the attribute name (A).

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS). "Configure SAML Integration with JIT User Provisioning". In the troubleshooting section for JIT

it is often noted that attribute mapping is a common point of failure. The guide states

"Enter the name of the attribute that defines the role for a user in the SAML assertion." If this is incorrect

role assignment fails.

2. Palo Alto Networks

Prisma Cloud Docs. "Add a SAML 2.0 IdP for SSO to Prisma Cloud". The documentation emphasizes the need to "Map the attributes on your IdP to the Prisma Cloud attributes." An incorrect mapping for the role attribute is a primary cause of login errors for JIT users.

Performing a rolling upgrade of Prisma Cloud Defenders requires specific conditions to ensure compatibility and functionality. First, the Console must be upgraded to version 'n' before the Defenders. The new Console (version n) is designed to be backward compatible, managing Defenders from the previous version (n-1). This allows Defenders to be upgraded gradually. Second, the upgrade process for Defenders utilizes the twistcli command-line tool. It is a prerequisite to download the new release package, which contains the version of twistcli corresponding to the new Defender version, to generate the correct deployment manifests.

B. Defenders must remain active to communicate with the Console and enforce policy. Setting them to read-only mode is not a documented step and would disrupt their function.

C. A second location for the Console pertains to a blue-green deployment strategy for the Console itself, not a rolling upgrade of its distributed Defenders.

D. A software version upgrade does not inherently require additional licenses unless the number of protected nodes or workloads is also being increased.

1. Palo Alto Networks

Prisma Cloud Self-Hosted Administrator's Guide

"Upgrade Console and Defenders". The guide states

"Prisma Cloud supports backward compatibility

where a new Console can manage Defenders from the previous release (n-1)." This confirms the n-1 prerequisite.

2. Palo Alto Networks

Prisma Cloud Self-Hosted Administrator's Guide

"Upgrade Defenders". The upgrade procedure details downloading the new software tarball and using the enclosed twistcli to deploy the new Defenders

establishing this as a required step.

In a Kubernetes environment managed by Prisma Cloud Compute, Defenders have two primary upgrade paths. The default and most common method is automatic upgrade. When the Console is upgraded, deployed Defenders will detect the version mismatch on their next check-in, download the new image, and restart themselves to complete the upgrade. Alternatively, for more granular control, an administrator can perform a manual upgrade. This involves deleting the existing Defender DaemonSet from the cluster (kubectl delete -f defender.yaml) and then deploying the new DaemonSet manifest provided by the upgraded Console.

A. Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders: The curl script is for installation, not removal, and Cloud Discovery only identifies unprotected hosts, it does not deploy Defenders.

B. Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders: Cloud Discovery is not a deployment mechanism; it is used for visibility and identifying where protection is needed.

1. Palo Alto Networks

Prisma Cloud Compute Administrator's Guide. "Upgrade Prisma Cloud". The section on "Upgrading Defenders" explicitly states

"By default

Defenders automatically upgrade themselves after Console is upgraded."

2. Palo Alto Networks

Prisma Cloud Compute Administrator's Guide. "Deploy Defenders". The guide details the manual deployment process using the DaemonSet YAML file. The manual upgrade process is the reverse (delete old DaemonSet) followed by this deployment process with the new file. This confirms the validity of the manual redeployment option.

In Prisma Cloud, the setting to automatically enable newly added default (system) policies is managed within the policy section itself. The correct navigation path is to the Policies tab, then to the Settings sub-section. Within these settings, there is an option for "auto-enable default policies" where an administrator can select which severity levels (e.g., high, medium, low) of new policies should be automatically activated upon release by Palo Alto Networks.

A. The alarm center is for viewing and managing alerts, not for configuring policy enablement settings. Enterprise Settings is for tenant-level configurations, not this specific policy setting.

B. The alarm center is for viewing alerts. While the path starts correctly with Policies > Settings, the reference to the alarm center is incorrect.

C. Settings > Enterprise Settings is the incorrect location for managing the auto-enablement of default security policies. This is a policy-specific setting.

1. Palo Alto Networks. (2023). Manage Policies on Prisma Cloud. Prisma Cloud Administrator's Guide. The section "Enable

Disable

or Snooze a Policy" describes policy management. The related settings page

accessible from the Policies tab

contains the "Auto-Enable Default Policies" feature.

2. Palo Alto Networks. (2023). Prisma Cloud Default Policies. Prisma Cloud Administrator's Guide. This document references that new policies are added regularly and their automatic enablement is controlled under Policies > Settings.

The Prisma Cloud Adoption Advisor for Cloud Security Posture Management (CSPM) is a dashboard that helps organizations track their progress in adopting the platform's capabilities. It organizes features and policies into four distinct, high-level security domains: Visibility, Compliance, Governance, and Threat Detection and Response. This structure allows security teams to measure maturity, identify gaps in their security posture, and prioritize the implementation of controls across these key areas to enhance their cloud security framework effectively.

B. Network, Anomaly, and Audit Event are types of policies or data sources within Prisma Cloud, not the main categories used by the Adoption Advisor for measuring progress.

C. This option is incomplete. While Visibility and Compliance are correct categories, it omits the equally important Governance and Threat Detection and Response domains.

D. Foundations, Advanced, and Optimize represent a generic maturity model structure but are not the specific categories used by the Prisma Cloud Adoption Advisor for CSPM.

1. Palo Alto Networks. (2023). Prisma Cloud Administrator's Guide. "Adoption Advisor for CSPM". The documentation states

"The Adoption Advisor for CSPM measures your adoption progress in the following categories: Visibility

Compliance

Governance

and Threat Detection and Response."

For the Prisma Cloud Compute Self-Hosted Edition, Palo Alto Networks provides two primary methods for retrieving the necessary software images. The first method involves authenticating to the official Prisma Cloud container registry using a unique access token obtained from the Palo Alto Networks support portal, and then using standard docker pull or similar commands. The second method involves downloading a comprehensive .tar.gz archive directly from the support portal. This is done using a command like curl with a URL that embeds the access token for authentication.

A. Pull the images from the Prisma Cloud registry without any authentication: This is incorrect. Access to the official software images is restricted and requires authentication with a valid access token.

D. Download Prisma Cloud images from github.paloaltonetworks.com: This is incorrect. While Palo Alto Networks maintains a GitHub presence for some projects, the official, supported software images for Prisma Cloud Compute are not distributed there.

1. Palo Alto Networks

"Prisma Cloud Compute Edition - Self-Hosted Administrator's Guide"

Section: "Install"

Subsection: "Install Console". The guide provides detailed instructions for both methods: "Authenticate with the Prisma Cloud registry

and then pull the images" and "Retrieve Prisma Cloud images using URL auth by embedding an access token" (curl command example).

In a CI vulnerability policy (Defend → Vulnerabilities → CI) you can:

• Scope the rule to images built on specific hosts, repositories, or tags;

• Specify that CVEs are only evaluated when a vendor-supplied fix is available;

• Define the failure (build-break) threshold based on CVE severity.

No credential entry is configured in the policy itself, and a “Grace Period” parameter exists only for runtime/registry vulnerability policies, not CI.

B. Credential – Registry/Jenkins credentials are configured outside the CI policy, not as a selectable policy field.

E. Grace Period – Available for runtime/registry policies; CI policies expose no grace-period control.

1. Prisma Cloud Compute Edition Administrator’s Guide v31

“Defend > Vulnerabilities > CI – Add Policy” (table ‘Field descriptions’: Scope

Apply rule only when vendor fix is available

Fail build threshold) – pdf p. 316-317.

2. Palo Alto Networks TechDocs

“Configuring CI Image Scanning Policies”

last updated 2023-10-12

Step 5 (no Credential or Grace Period field).