Free PCCSE Practice Test

Prisma Cloud supports Net Effective Permissions calculation at three key Azure permission levels: Management Group, Subscription, and Resource Groups. These three levels form the primary hierarchical structure where Azure Role-Based Access Control (RBAC) assignments are made. Management Groups organize subscriptions, Subscriptions contain resource groups, and Resource Groups contain individual resources. While permissions ultimately affect resources, Prisma Cloud calculates effective permissions at these three organizational levels where role assignments are typically configured.

Option A (Resources): Individual resources inherit permissions from higher levels; they're not a primary calculation level.
Option B (Tenant): Tenant is the root level but not a standard RBAC assignment scope in this context.

1. Palo Alto Networks Prisma Cloud Administrator's Guide - Azure Integration section, Chapter on Permission Models

2. Microsoft Azure RBAC documentation - "Understand scope for Azure RBAC" (docs.microsoft.com/azure/role-based-access-control/scope-overview)

3. Palo Alto Networks Prisma Cloud Security Posture Management Guide - Azure Permissions section

The correct syntax for scanning a container image with twistcli requires specifying the Console's address for reporting results. The --address flag is used for this purpose, followed by the URL of the Prisma Cloud Console. The final argument is the name and tag of the image to be scanned. Option B correctly uses the --address flag with a valid URL format and the image identifier, representing the proper basic structure for an image scan command.

A. Anomaly: The --docker-address flag is used to specify the location of the Docker daemon socket, not the Prisma Cloud Console address.
C. Network: The --container flag is not a valid option for the twistcli images scan command. The image name is provided as a direct argument without a preceding flag.
D. Config: This option is incorrect for the same reason as C; it includes the invalid --container flag, which makes the command syntax invalid.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute). "CI with twistcli." The documentation provides the syntax for scanning images: twistcli images scan --address --user [OPTIONS] . This confirms that --address is the correct flag for the Console URL and that the image is specified as a positional argument.

2. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute). "twistcli command reference." The reference guide for twistcli lists --address as the option to "Specify the address of the Console," and does not list a --container flag for the images scan subcommand.

In a new (default) Prisma Cloud Compute deployment, all compliance checks are pre-set to Alert. Those settings are viewed or modified under Defend > Compliance, which lists every host, container, and image compliance rule together with its current mode (Alert or Block).

A. Monitor > Compliance only displays scan findings; it does not show or let you inspect default Alert/Block settings.
C. Manage > Compliance is not a valid navigation path in Prisma Cloud Console.
D. Custom > Compliance is not a valid menu and therefore cannot show default alerting rules.

1. Palo Alto Networks, Prisma Cloud Compute Edition Administrator’s Guide 22.12, section “Defend > Compliance”, first paragraph (“The Defend > Compliance page lists all compliance checks and indicates whether each rule is set to alert or block by default”).

2. Palo Alto Networks, Prisma Cloud Compute Edition Release Notes 22.12, “Initial default policy settings”, Table 2.

Prisma Cloud Compute identifies cryptomining attacks by detecting anomalous behavior and matching known threat signatures. Key indicators include: a container exhibiting unusually high and sustained CPU usage over time; the presence of processes with names common to cryptomining software (e.g., xmrig); and network connections to known mining pools, which often use specific, non-standard ports. These three technical indicators are actively monitored by the runtime defense mechanisms to generate a cryptominer audit.

A. Prisma Cloud has no mechanism to determine the monetary value of mined currency; its detection is based on system and network behavior.
D. Associating mined currency with a specific user token is not a function of runtime container security and is not a detectable event within the container.

1. Palo Alto Networks, "Runtime defense for containers," Prisma Cloud Administrator's Guide (Compute). This section details how runtime models are built to detect anomalous behavior, including "Anomalous process activity" and "Anomalous network activity."

2. Palo Alto Networks, "Cryptojacking," Prisma Cloud Threat Research. This documentation often describes the Tactics, Techniques, and Procedures (TTPs) of cryptojacking, which include high CPU usage, specific process names, and network connections to mining pools. The product's runtime defense is built to detect these TTPs.

3. Palo Alto Networks, "Runtime policy rules," Prisma Cloud Administrator's Guide (Compute). The rules engine can be configured to detect suspicious processes and network connections, which are key components in identifying cryptominers.

Build policies in Prisma Cloud are designed to "shift left," integrating security into the early stages of the development lifecycle. They specifically scan Infrastructure as Code (IaC) templates, such as Terraform, CloudFormation, and Kubernetes manifests, for misconfigurations and policy violations before the infrastructure is ever deployed. This proactive approach helps prevent insecure configurations from reaching production environments. These policies are a key component of a comprehensive Cloud Native Application Protection Platform (CNAPP) strategy, ensuring that security is codified and automated.

B. Auto-remediation is a powerful but potentially disruptive feature; it is not enabled by default for any policy type and must be explicitly configured by an administrator.
C. The main policy categories in Prisma Cloud are typically grouped by function (e.g., Vulnerability, Compliance, Runtime) or by lifecycle stage (Build, Deploy, Run), not this specific combination.
D. Run policies monitor a wide range of runtime activities, including process, file system, and system call events, not just network activities.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute). "Secure the build." In the section on "CI/CD Security," the documentation states, "Prisma Cloud can scan Infrastructure-as-code (IaC) templates such as Terraform, CloudFormation, Kubernetes, Helm, and ARM to identify insecure configurations that can expose your cloud environment to risk."

2. Palo Alto Networks, Prisma Cloud Docs. "Policies." The documentation describes different policy types. For Build policies, it specifies their use for scanning IaC files and container images for vulnerabilities and compliance issues during the CI process.

To enforce failure of a CI/CD job based on the presence of a specific CVE, the policy must be configured centrally in the Prisma Cloud Compute Console. An administrator would navigate to Defend > Vulnerabilities > Images > CI and create a new rule. This rule can be configured to trigger on the specific CVE ID and set the action to "Block". When twistcli runs in the CI pipeline, it sends the scan results to the Console, which evaluates them against this policy and returns a fail status if the blocking rule is matched.

A. Set the specific CVE exception as an option in Jenkins or twistcli.: twistcli and its CI plugins do not have command-line flags to block specific CVEs; they act as enforcers for policies defined in the Console.
B. Set the specific CVE exception as an option in Defender running the scan.: Defenders enforce runtime policies and can execute scans, but the CI scan policy logic is managed and configured centrally in the Console.
C. Set the specific CVE exception as an option using the magic string in the Console.: Magic strings (e.g., #twistlock: ignore) are used in Dockerfiles to create exceptions for specific rules, not to create blocking policies.

Palo Alto Networks, Prisma Cloud Compute Administrator's Guide, "CI/CD Integration". This guide explains, "The exit code from twistcli is determined by the rules in the policy that apply to the scan."

Palo Alto Networks, Prisma Cloud Compute Administrator's Guide, "Vulnerability Policies". This section details how to create vulnerability rules, specifying criteria such as CVE ID, severity, and the effect (e.g., Alert, Block, Fail CI build).

The correct steps to install the Prisma Cloud Compute Console in an Amazon ECS cluster involve ensuring data persistence and availability. The Console requires a shared, persistent file system so that if the Console task is rescheduled to a different EC2 instance, it can access its existing data. Amazon EFS (Elastic File System) provides this capability. Therefore, the correct procedure is to download the release, create and mount a shared EFS file system to the cluster nodes, create the ECS task definition referencing the EFS volume, and then deploy the task.

A. The Console can be deployed natively in an ECS cluster; a onebox deployment is typically for non-production or small-scale environments.
B. Using local storage on each node is incorrect because the Console data would be lost or inaccessible if the task moves to a different node.
C. "Download task from AWS" is not a standard step; an administrator creates a task definition based on the vendor's specifications, not downloads it from AWS.

1. Palo Alto Networks, "Prisma Cloud Administrator’s Guide (Compute)", Version Self-Hosted 32.01, Chapter: "Install Console on an ECS Cluster". This section explicitly states the prerequisite: "Create a shared file system, such as AWS EFS, and mount it on all the EC2 instances in your ECS cluster. The Console needs a persistent storage solution."

2. Palo Alto Networks, "Prisma Cloud Administrator’s Guide (Compute)", Version Self-Hosted 32.01, Chapter: "Install Console on an ECS Cluster", Section: "Create the Console task definition". This part of the guide details creating the task definition, which includes configuring the volume mount for the shared EFS file system.

twistcli is the command-line interface for Prisma Cloud Compute. To scan serverless functions for vulnerabilities and compliance issues as part of a CI/CD pipeline or build process, the correct command syntax is twistcli serverless scan. This command takes the function's code package (e.g., a .zip file) as an argument and analyzes its contents, including dependencies, against the vulnerability intelligence and compliance policies configured in the Prisma Cloud console.

A. twistcli function scan: The function keyword is not the correct component name for this type of scan in the twistcli syntax; serverless is the correct term.
B. twistcli scan serverless: This reverses the standard twistcli [component] [action] command structure, making the syntax invalid.
C. twistcli serverless AWS: This command is incomplete. It specifies the component (serverless) but lacks an action verb like scan.

1. Palo Alto Networks, Prisma Cloud Administrator's Guide (Compute), "Scanning functions with twistcli". This section explicitly documents the command and its usage: "Use twistcli serverless scan to scan your functions for vulnerabilities."

2. Palo Alto Networks, Prisma Cloud Docs, "twistcli command reference". The official command reference lists serverless scan as the command for scanning serverless function packages, providing syntax examples and available options.

Programmatic, or machine-to-machine, interaction with the Prisma Cloud Enterprise API is authenticated using access keys. An administrator first creates an access key, which consists of an Access Key ID and a Secret Key, within the Prisma Cloud UI. This long-lived key is then used to make an initial API call to an authentication endpoint, which returns a short-lived JSON Web Token (JWT). This JWT is then used as a bearer token in the authorization header for all subsequent API calls, providing a secure method for automated scripts and integrations.

A: Single sign-on (SSO) is a mechanism designed for interactive user logins to a user interface, not for programmatic API authentication. B: SAML is a specific protocol used to implement web-based SSO for human users and is not used for authenticating direct API calls. C: Basic authentication (sending a username and password with each request) is not the primary, secure method used by the Prisma Cloud API.

- Palo Alto Networks, "Prisma Cloud API Reference," Authentication section. The documentation explicitly states: "To use the API, you must first create an access key... Use the access key to log in to the API. A successful login returns a JSON Web Token (JWT) that you must include in the header of all subsequent requests."

The correct API endpoint to programmatically onboard AWS cloud accounts to a Prisma Cloud Enterprise tenant is https://api.prismacloud.io/cloud/aws. A POST request to this endpoint is used to add a new AWS account. The path /cloud designates the resource type as a cloud service provider, and /aws specifies the particular provider. This endpoint is designed for the singular action of onboarding accounts, which aligns with the scenario's requirement to script the process for multiple individual accounts.

A: .../cloud/ is a generic parent endpoint for cloud resources and is not the specific endpoint used for onboarding an AWS account. B: .../account/aws is incorrect. The /account endpoint typically refers to user accounts within the Prisma Cloud platform, not cloud provider accounts. D: .../accountgroup/aws is used for managing account groups (collections of cloud accounts), not for onboarding the individual cloud accounts themselves.

1. Palo Alto Networks, "Prisma Cloud API Reference". The "Cloud Accounts" section details the endpoint for "Onboard an AWS Account". The documented request is POST /cloud/aws. This explicitly confirms the correct endpoint structure.

2. Palo Alto Networks, "Prisma Cloud API Reference". The "Account Groups" section shows endpoints like GET /cloud/group and POST /cloud/group, confirming that /accountgroup is not the correct path for this operation.