PCCP Practice Questions

A serverless function is an event-driven snippet of code that runs on managed infrastructure,

typically as part of a Function as a Service (FaaS) model. It is executed in response to events such as

HTTP requests or database changes, and the cloud provider handles the underlying infrastructure.

Pharming is an attack that redirects traffic from a legitimate website to a malicious fake website,

typically by corrupting the DNS system or modifying host files, with the intent of stealing user

credentials or sensitive data.

Containers encapsulate applications and their dependencies into lightweight, portable units that can

run consistently across multiple environments. This abstraction supports cloud-native development

by enabling microservices architectures, rapid deployment, and scaling within orchestration

platforms like Kubernetes. Containers accelerate cloud migration by decoupling applications from

infrastructure, facilitating automation, and continuous integration/continuous deployment (CI/CD)

workflows. Palo Alto Networks addresses container security by integrating runtime protection,

vulnerability scanning, and compliance enforcement within its Prisma Cloud platform, ensuring safe

adoption of cloud-native tools and methodologies.

Malicious Portable Executable (PE) files hidden inside PDFs represent a stealthy delivery tactic where

attackers embed executable payloads within seemingly benign documents. When a user opens the

PDF, the embedded PE executes, potentially installing malware. This approach combines social

engineering with file obfuscation to bypass traditional detection methods. Palo Alto Networks’

Advanced WildFire sandboxing inspects such files by detonating them in isolated environments to

observe behavior and identify hidden threats. This detection technique is critical for uncovering

evasive malware concealed within common file types before they reach end-users.

SSL/TLS decryption allows security tools to inspect encrypted traffic, enabling them to detect hidden

malware, command-and-control communication, or data exfiltration that would otherwise bypass

inspection if left encrypted.

SOAR platforms are unique in their ability to automate incident response through the use of

predefined workflows. These workflows allow repetitive security tasks to be executed automatically,

improving response speed and efficiency.

Cloud Security Posture Management (CSPM), including Prisma Cloud’s offering, continuously

monitors all cloud resources — such as compute instances, storage, network configurations, and

identities — to detect misconfigurations, vulnerabilities, and potential threats in near real time.

Reference: https://www.paloaltonetworks.com/prisma/cloud/cloud-security-posture-management

Detection of threats using data analysis – SIEM platforms analyze collected data to identify

suspicious patterns and detect threats.

Ingestion of log data – SIEM systems collect and centralize log data from various sources, which is

essential for analysis, correlation, and alerting.

Automation and prevention are more aligned with SOAR and firewall/EDR functionalities, not the

core operations of SIEM.

Application allow listing is a security practice that permits only pre-approved (trusted) applications,

files, and processes to run on a system. This approach helps prevent unauthorized or malicious

software from executing, thereby reducing the attack surface.

Social engineering attacks manipulate human trust to gain unauthorized access or information.

Convincing an employee that an attacker is also an employee builds rapport, lowering defenses for

information disclosure or credential sharing. Similarly, impersonating a company representative and

requesting unrelated personal data exploits authority bias to deceive victims. These tactics exploit

psychological vulnerabilities rather than technical flaws and are prevalent initial steps in multi-stage

attacks. Palo Alto Networks highlights the importance of training, multi-factor authentication, and

behavior-based threat detection to mitigate social engineering risks effectively.