Free PSE-PRISMACLOUD Practice Test

In some public cloud environments, including Amazon Web Services (AWS), the order in which network interfaces are attached to a virtual machine can be unpredictable. This can cause the VM-Series firewall's management interface (eth0) and the first data interface (eth1/ethernet1/1) to be swapped. The PAN-OS command set system setting mgmt-interface-swap enable yes is specifically designed to resolve this issue by instructing the firewall to swap these two interfaces internally, ensuring correct traffic flow and management access.

B. set mgmt-interface settings swap yes: This is not a valid PAN-OS command. System-level settings are configured under the set system hierarchy, not directly under a non-existent set mgmt-interface path.
C. set mgmt-interface swap yes: This is also an invalid PAN-OS command syntax. The command structure is incorrect for modifying this specific system setting.
D. set system setting mgmt-interface swap yes: This command is syntactically incorrect. The correct parameter to enable this boolean feature is enable yes, not just swap yes.

1. Palo Alto Networks Documentation, VM-Series Deployment Guide for AWS: In the section "Initial Configuration on the VM-Series Firewall on AWS," the guide explicitly states: "If the management interface and the first dataplane interface are swapped, you can use the following CLI command to correct the interface order: > set system setting mgmt-interface-swap enable yes". (Reference: VM-Series Deployment Guide, AWS, Initial Configuration on the VM-Series Firewall on AWS).

2. Palo Alto Networks Documentation, PAN-OS® CLI Quick Start: The command hierarchy for system settings is detailed here. It confirms that modifications to system behavior, such as interface swapping, are located under the set system setting path. The specific command mgmt-interface-swap is listed with its enable parameter. (Reference: PAN-OS® CLI Quick Start, Use Set Commands to Modify the Configuration).

The question is fundamentally flawed and cannot be answered with the options provided. The question asks for a Resource Query Language (RQL) query for "Azure SQL Databases," but all the answer options refer to a Google Cloud Platform API (gcloud-compute-instances-list). Furthermore, the syntax used in all four options is incorrect according to the official RQL specification. A valid RQL query requires precise JSON path notation (e.g., json.rule.attribute = 'value') and uses documented operators, none of which are correctly implemented in the choices.

A. ...is TERMINATED: The operator is is not a valid RQL operator, and the query is for the wrong cloud provider and resource type.
B. ...= TERMINATED: This incorrectly compares an entire JSON object (json.rule) to an unquoted string and targets the wrong cloud resource.
C. ...== status TERMINATED: This option contains invalid syntax; the attribute status is misplaced and should be part of the json.rule path.
D. ...= status contains TERMINATED: This option also uses invalid syntax and targets the wrong cloud resource as described in the question.

1. Palo Alto Networks. (n.d.). Prisma Cloud RQL (Resource Query Language) Reference. This document details the correct syntax for RQL queries, including valid operators (=, !=, contains, etc.) and the requirement for full JSON path notation (e.g., json.rule.name = 'value'), which are not followed in the provided options.

2. Palo Alto Networks. (n.d.). Prisma Cloud Administrator's Guide (SaaS). "Investigate and Search". This section provides examples of valid RQL queries, which differ significantly in structure and syntax from the flawed options presented in the question.

To view license utilization in Prisma Cloud, an administrator must access the administrative settings. The standard navigation path within the web interface is to click the gear icon, which represents "Settings," and then select the "Licensing" option from the menu. This page provides a comprehensive overview of purchased credits, consumed credits, and the remaining balance. It also details the consumption breakdown by different resource types and enabled security capabilities, which is essential for license management and forecasting.

A. Prisma Cloud is a SaaS platform primarily managed through its web UI; a CLI command is not the standard method for viewing license data.
B. The navigation path "General > Licensing" is not a valid menu structure within the Prisma Cloud user interface.
C. The "Dashboard > Asset Inventory" section displays discovered resources, which contribute to license usage, but it is not the dedicated page for viewing license utilization summaries.

1. Palo Alto Networks. (2024). Manage Your Prisma Cloud License. Prisma Cloud Administrator's Guide. Retrieved from https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-licenses.

Reference Specifics: In the section "View Your License Usage

" the first sentence explicitly states

"To view your license usage and the number of credits you have available

select Settings > Licensing." This directly confirms the correct navigation path.

Prisma Cloud Compute (PCC) capabilities are available through two primary deployment models. The first is the self-hosted Prisma Cloud Compute Edition, where the customer deploys and manages the Console and Defenders in their own environment, such as a Kubernetes cluster or other container platform. The second model is through the fully SaaS Prisma Cloud Enterprise Edition, which is cloud-hosted and managed by Palo Alto Networks. In this model, the Compute (CWPP) capabilities are integrated into the broader platform, and customers only need to deploy the Defenders.

B. Prisma Cloud Compute is a software solution and is not delivered as a self-contained physical hardware appliance.
C. The Prisma Cloud Compute Console is deployed as a container, not as a standalone native Windows application.

1. Palo Alto Networks, Prisma Cloud Docs. "Prisma Cloud Compute Edition Administrator's Guide". The introduction states: "Prisma Cloud Compute Edition is the self-hosted version of the product. You deploy, manage, and operate the Prisma Cloud console and defenders in your own environment." This directly supports option A.

2. Palo Alto Networks, Prisma Cloud Docs. "Get Started with Prisma Cloud". This documentation for the SaaS platform describes the unified solution hosted by Palo Alto Networks, which includes both cloud security posture management and cloud workload protection (Compute). This supports option D.

3. Palo Alto Networks, Prisma Cloud Docs. "System Requirements" for Compute Edition. This page specifies that the Console is delivered as a container image to be run on a Linux host with a container runtime, confirming it is not a Windows application or a hardware appliance.

When an administrator modifies the Training Model Threshold or the Alert Disposition for an anomaly policy in Prisma Cloud, the platform does not wait for a new learning cycle or only apply the change to future events. Instead, it immediately re-evaluates the existing learned behavioral model against the new settings. This re-evaluation process is retrospective, meaning Prisma Cloud will regenerate alerts based on the updated criteria. As a result, some existing alerts may be closed, and new alerts may be created from the same historical data that now violates the new threshold or disposition.

A. A new 30-day learning phase is not initiated. The system re-evaluates the currently established model against the new settings immediately.
B. A system reboot and deletion of historical alerts are drastic, disruptive actions not associated with tuning anomaly detection policies.
D. The change is not only for new alerts. Prisma Cloud applies the new settings retrospectively to regenerate the entire alert set for that policy.

1. Palo Alto Networks, "Prisma Cloud Administrator's Guide (Cloud Native)". In the section on "Anomalies," the sub-section "Tune Anomaly Policies" describes the process of adjusting thresholds. It states, "When you change the threshold, Prisma Cloud re-evaluates the model and regenerates alerts according to the new setting." This confirms the retrospective re-evaluation and regeneration of alerts.

2. Palo Alto Networks, "Prisma Cloud Administrator's Guide (Cloud Native)". The section on "Manage Alerts on the Prisma Cloud Console" explains how changing an alert's disposition affects its status. Applying this at the policy level (Alert Disposition) triggers a similar re-evaluation for all alerts governed by that policy.

In Prisma Cloud Compute, policy rules for images use a pattern-matching syntax of //:. To create a rule that applies to all images within a specific registry, you must specify the registry's hostname followed by /. The / acts as a wildcard that matches all repositories, images, and tags within that registry. Therefore, registry.acme.com/ is the correct and most efficient pattern to add all images from the registry.acme.com registry to a trusted images rule.

A. .acme.com: This is a wildcard DNS pattern used for matching hostnames, not the correct format for specifying image repositories.
B. acme/: This pattern is incomplete because it lacks a specific registry hostname, making it ambiguous and not a valid identifier for a trust rule.
C. acme.com/myrepo/allimages:/: This pattern is overly specific, as it only trusts a single image named allimages within a single repository.

1. Palo Alto Networks. (n.d.). Prisma Cloud Compute Edition Administrator's Guide. "Defend > Trusted Images". This section explicitly documents the use of wildcards for creating trusted image policies, providing examples that show registry-name/ as the syntax for trusting an entire registry.

2. Palo Alto Networks. (n.d.). Prisma Cloud Compute Edition Administrator's Guide. "Manage > Collections and Rules". The documentation on rule creation confirms that wildcards () are used to match any string in the registry, repository, image, or tag fields.

Prisma Cloud provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP) for a wide range of major cloud service providers. According to the official Palo Alto Networks documentation, Prisma Cloud natively integrates with Microsoft Azure and Oracle Cloud Infrastructure (OCI) via APIs. This integration enables continuous monitoring of cloud resources for misconfigurations, compliance violations, and threats, providing unified visibility and control across these multi-cloud environments.

A. DigitalOcean: Prisma Cloud’s native, API-based integration for CSPM does not include DigitalOcean. Support is focused on the larger, enterprise-grade cloud service providers.
C. IBM Cloud: While IBM Cloud is also a supported provider, the question requires selecting only two options. Azure and Oracle Cloud are both correct and represent the platform's multi-cloud capabilities.

1. Palo Alto Networks Official Documentation

"Prisma Cloud Supported Cloud Service Providers." Prisma Cloud Admin Guide. This document explicitly lists the cloud platforms that Prisma Cloud supports for native

API-based security. The list includes Microsoft Azure

Oracle Cloud Infrastructure (OCI)

and IBM Cloud

but not DigitalOcean.

Source: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/get-started-with-prisma-cloud/supported-cloud-service-providers (Accessed on the current date). Section: "Supported Cloud Service Providers".

In an Amazon Web Services (AWS) Virtual Private Cloud (VPC), all resources, including the server EC2 instances and the VM-Series firewall, are assigned private IP addresses from the RFC 1918 address space. To enable internet access, AWS networking infrastructure is used. An Internet Gateway (IGW) is attached to the VPC, and a public IP address (such as an Elastic IP) is associated with the firewall's external network interface. The IGW performs the one-to-one Network Address Translation (NAT) between this public IP and the firewall's private IP. Therefore, it is the AWS cloud infrastructure that handles the fundamental address translation to make the service publicly accessible.

A. This is incorrect because if AWS infrastructure translated the server VM addresses directly, traffic would bypass the VM-Series firewall, defeating the purpose of securing the service with it.
B. While the VM-Series firewall performs Destination NAT (DNAT) to forward traffic to the internal servers, the initial and primary translation from the public internet IP to the firewall's private IP is handled by the AWS infrastructure (Internet Gateway).
D. This is incorrect. Instances within a VPC are natively assigned private IPs. Public IPs are not assigned directly to the instances but are mapped to their private IPs by the AWS networking infrastructure.

1. Palo Alto Networks

VM-Series Deployment Guide for AWS (Version 11.1)

"Reference Architectures for the VM-Series Firewall on AWS

" Section: "Security VPC with an Internet Gateway." The diagrams and traffic flow descriptions in this section illustrate that internet traffic first traverses the AWS Internet Gateway before reaching the VM-Series firewall. The firewall and the application servers reside in subnets with private (RFC 1918) IP addresses.

2. Amazon Web Services (AWS) Documentation

"VPC user guide

" Section: "Internet gateways." The documentation states

"An internet gateway... performs network address translation (NAT) for instances that have been assigned public IPv4 addresses." This confirms that the AWS infrastructure is responsible for the NAT function that maps a public IP to the private IP of an instance

such as the VM-Series firewall.

3. Amazon Web Services (AWS) Documentation

"VPC user guide

" Section: "IP addressing in your VPC." This guide specifies

"When you launch an instance into a default VPC

we assign it a public IPv4 address... When you launch an instance into a nondefault VPC

we do not assign it a public IPv4 address by default... A private IPv4 address is an IP address that's not reachable over the internet." This establishes that instances natively operate with private IPs within the VPC.

The Cloud Workload Protection (CWP) pillar of the Prisma Cloud platform is specifically designed to secure modern applications, including hosts, containers, and serverless functions. A key differentiator of CWP is its flexible deployment model, which supports environments across public clouds (AWS, Azure, GCP), private clouds (VMware, OpenShift), and on-premises data centers. It provides both agentless scanning for visibility into vulnerabilities and compliance on dormant workloads and agent-based protection (via Defenders) for comprehensive runtime security on active workloads.

A. Cloud Network Security focuses on network traffic analysis and microsegmentation, not the comprehensive agent-based and agentless protection of the workloads themselves.
B. Cloud Security Posture Management (CSPM) is primarily agentless and focuses on the security configuration of cloud infrastructure, not runtime protection of workloads.
C. Cloud Identity Security is focused on Cloud Infrastructure Entitlement Management (CIEM), managing permissions and access, not workload protection.

1. Palo Alto Networks, Prisma Cloud Datasheet. "Cloud Workload Protection". The official product datasheet describes CWP capabilities, highlighting support for hybrid and multi-cloud environments and its dual approach of using agentless scanning and agent-based runtime defense.

2. Palo Alto Networks, Prisma Cloud Platform Architecture Guide. "Platform Components". This guide details the different modules, explaining that CWP (which includes technology from the Twistlock acquisition) provides the agent-based and agentless capabilities for securing compute workloads across any cloud.

Prisma Cloud Compute container Defenders are deployed onto hosts that run containers to monitor and protect them. For Kubernetes environments, the standard and recommended deployment method is as a Kubernetes DaemonSet. This ensures that a Defender pod runs on every node in the cluster, providing comprehensive coverage. Google Kubernetes Engine (GKE) is a supported Kubernetes platform where this DaemonSet deployment method is used. Therefore, GKE is a supported environment, and DaemonSet is the specific method used within it.

A. Defenders are not deployed on managed database services like Azure SQL; they are deployed on compute hosts (VMs, container nodes) that run applications.
C. Oracle Functions is a serverless platform. While Prisma Cloud protects serverless functions, it uses a specific Serverless Defender, not the container Defender mentioned in the question.

Palo Alto Networks, "Prisma Cloud Administrator's Guide (Compute)". Section: "Deploy Prisma Cloud Defenders". The documentation provides detailed instructions for deploying Defenders.

Palo Alto Networks, "Prisma Cloud Administrator's Guide (Compute)". Sub-section: "Deploying Defenders on a Kubernetes cluster". This section explicitly states: "For Kubernetes, you’ll deploy Defender as a DaemonSet," and lists Google Kubernetes Engine (GKE) as a supported orchestrator.