PCCSE Practice Questions

https://docs.prismacloud.io/en/classic/cspm-admin-guide/prisma-cloud-iam-security/context-usedto-calculate-effective-permissions

The correct construction for scanning a container image using the TwistCLI tool in Prisma Cloud is

option B. This command specifies the address of the Prisma Cloud Console and the image to be

scanned, including its tag. The TwistCLI tool is part of Prisma Cloud's capabilities to integrate security

into the CI/CD pipeline, allowing for the scanning of images for vulnerabilities as part of the build

process, thus ensuring that only secure images are deployed​​.

Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/compliance/ manage_compliance.html

In the context of Prisma Cloud by Palo Alto Networks, the correct navigation to identify alerted

compliance checks set by default is under the "Defend" section, specifically at "Defend >

Compliance." This section is designed to allow users to configure and manage compliance policies

and rules, monitor compliance statuses, and review alerts related to compliance violations. The

"Defend" section is tailored for setting up defenses, including compliance standards, against potential

security risks within the cloud environment, making it the logical location for managing and

reviewing compliance-related alerts and settings.

In the case of identifying a cryptominer attack through container audits, the options that could have

generated this audit include B. High CPU usage over time for the container is detected, which is a

common indicator of cryptomining activity as it consumes significant computational resources, C.

Common cryptominer process name was found, which directly indicates the presence of

cryptomining based on known malicious processes, and E. Common cryptominer port usage was

found, suggesting cryptomining activity based on network behavior typical of such attacks.

A true statement about build and run policies is A. Build policies enable you to check for security

misconfigurations in the IaC templates. This capability is crucial for identifying potential security

issues early in the development process, allowing for proactive mitigation before deployment,

thereby enhancing the overall security posture of the applications and infrastructure being

developed.

Reference tech docs: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/continuous_integration/set_policy_ci_plugins.html

Vulnerability rules that target the build tool can allow specific vulnerabilities by creating an exception

and setting the effect to 'ignore'. Block them by creating an exception and setting hte effect to 'fail'.

For example, you could create a vulnerability rule that explicitly allows CVE-2018-1234 to suppress

warnings in the scan results.

To fail CI jobs based on a specific CVE contained within an image, the development team should

configure the policy within Prisma Cloud's Console, specifically within the Continuous Integration (CI)

policy settings. By setting a specific CVE exception in the CI policy, the team can define criteria that

will cause the CI process to fail if the specified CVE is detected in the scanned image. This approach

allows for granular control over the build process, ensuring that images with known vulnerabilities

are not promoted through the CI/CD pipeline, thereby maintaining the security posture of the

deployed applications. This method is in line with best practices for integrating security into the

CI/CD process, allowing for automated enforcement of security standards directly within the

development pipeline.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMkpCAE&lang=e

n_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDe

tail

Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/19-11/prisma-cloud-computeedition- admin/install/install_amazon_ecs.html

To install the Console in an Amazon ECS Cluster, the steps involve downloading and extracting the

release tarball, which contains the necessary files for the Console. Then, an Amazon Elastic File

System (EFS) should be created and mounted to each node in the ECS cluster to provide shared

storage for Console data. Following this, a Console task definition needs to be created in ECS, which

defines how the Console container should run. Finally, this task definition is deployed to the ECS

cluster to start the Console.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admincompute/vulnerability_management/serverless_functions You can also use the twistcli command

line utility to scan your serverless functions. First download your serverless function as a ZIP file,

then run: $ twistcli serverless scan

To authenticate to Prisma Cloud Enterprise programmatically, the use of an access key is the most

suitable method among the given options. Access keys, typically consisting of an Access Key ID and

Secret Access Key, are used for programmatic calls to the Prisma Cloud API. This method enables

secure, authenticated API requests to Prisma Cloud services without requiring manual user

intervention, which is essential for automation and integration with CI/CD pipelines.

Reference to the use of access keys for programmatic access can often be found in the API

documentation of cloud security platforms like Prisma Cloud. While specific documentation from

Prisma Cloud is not directly quoted here, the general practice across cloud services (AWS, Azure,

GCP) supports the use of access keys for API authentication, making it a verified approach for Prisma

Cloud as well.

Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/getstarted-with- prisma-cloud/access-the-prisma-cloud-api.html

To add AWS accounts to the Prisma Cloud Enterprise tenant, the correct API endpoint is option C:

https://api.prismacloud.io/cloud/aws. This endpoint is specifically designed for integrating cloud

accounts with Prisma Cloud, enabling centralized visibility and security posture management across

multiple cloud environments. By using this API endpoint, each AWS account can be individually

onboarded to the Prisma Cloud platform, allowing for immediate posture visibility and consistent

security policy enforcement across the newly acquired company's extensive AWS footprint. This

process aligns with Prisma Cloud's capabilities for multi-cloud security and compliance management,

ensuring that the onboarding of cloud accounts is both efficient and aligned with the platform's best

practices for cloud security.