A customer has configured the JIT, and the user created by the process is trying to log in to the Prisma Cloud console. The user encounters the following error message:What is the reason for the error message?

The attribute name is not set correctly in JIT settings.

The user entered an incorrect password

The role is not assigned for the user.

If you are required to run in an air-gapped environment, which product should you install?

Prisma Cloud with self-hosted plugin

Prisma Cloud Enterprise Edition

A customer has a requirement to restrict any container from resolving the name www.evil-url.com.How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.

Choose ''copy into rule'' for any Container, set www.evil-url.com as a blocklisted DNS name in the Container policy and set the policy effect to alert.

Set www.evil-url.com as a blocklisted DNS name in the default Container runtime policy, and set the effect to block.

Choose ''copy into rule'' for any Container, set www.evil-url.com as a blocklisted DNS name, and set the effect to prevent.

Set www.evil-url.com as a blocklisted DNS name in the default Container policy and set the effect to prevent.

Which API calls can scan an image named myimage: latest with twistcli and then retrieve the results from Console?

$ twistcli images scan \ --address \ --user \ --password \ --details \ myimage: latest

$ twistcli images scan \ --address \ --user \ --password \ --verbose \ myimage: latest

$ twistcli images scan \ --address \ --user \ --password \ --details \ myimage: latest

$ twistcli images scan \ --address \ --user \ --password \ myimage: latest

$ twistcli images scan \ --address \ --user \ --password \ --console \ myimage: latest

Which two of the following are required to be entered on the IdP side when setting up SSO in Prisma Cloud? (Choose two.)

Assertion Consumer Service (ACS) URL

SP (Service Provider) Entity ID

Assertion Consumer Service (ACS) URL

SP (Service Provider) Entity ID

Which data security default policy is able to scan for vulnerabilities?

Objects containing Vulnerabilities

Which of the following are correct statements regarding the use of access keys? (Choose two.)

Up to two access keys can be active at any time

Access keys are used for API calls

Access keys must have an expiration date

Up to two access keys can be active at any time

System Admin can create access key for all users

Access keys are used for API calls

The development team is building pods to host a web front end, and they want to protect these pods with an application firewall.Which type of policy should be created to protect this pod from Layer7 attacks?

The development team should create a WAAS rule targeted at the image name of the pods.

The development team should create a WAAS rule for the host where these pods will be running.

The development team should create a WAAS rule targeted at all resources on the host.

The development team should create a runtime policy with networking protections.

The development team should create a WAAS rule targeted at the image name of the pods.

A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible.Which action should the SOC take to follow security best practices?

Enable ''AWS RDS database instance is publicly accessible'' policy and for each alert, check that it is a production instance, and then manually remediate.

Enable ''AWS S3 bucket is publicly accessible'' policy and manually remediate each alert.

Enable ''AWS RDS database instance is publicly accessible'' policy and for each alert, check that it is a production instance, and then manually remediate.

Enable ''AWS S3 bucket is publicly accessible'' policy and add policy to an auto-remediation alert rule.

Enable ''AWS RDS database instance is publicly accessible'' policy and add policy to an auto-remediation alert rule.

An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds.What does the administrator need to configure?

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF

A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment.

Let Defenders automatically upgrade.

Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.

Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.

Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment.

Let Defenders automatically upgrade.

A customer has a requirement to scan serverless functions for vulnerabilities.What is the correct option to configure scanning?

Configure a function scan policy from the Defend > Vulnerabilities > Functions page.

Configure serverless radar from the Defend > Compliance > Cloud Platforms page.

Embed serverless Defender into the function.

Configure a function scan policy from the Defend > Vulnerabilities > Functions page.

Use Lambda layers to deploy a Defender into the function.

An administrator has been tasked with a requirement by your DevSecOps team to write a script to continuously query programmatically the existing users, and the user's associated permission levels, in a Prisma Cloud Enterprise tenant.Which public documentation location should be reviewed to help determine the required attributes to carry out this step?

Prisma Cloud Administrator's Guide (Compute)

Prisma Cloud Compute API Reference

Prisma Cloud Enterprise Administrator's Guide

When would a policy apply if the policy is set under Defend > Vulnerability > Images > Deployed?

when a Container is started form an Image

when a serverless repository is scanned

when a Container is started form an Image

when the Image is built and when a Container is started form an Image

An administrator has a requirement to ingest all Console and Defender logs to Splunk.Which option will satisfy this requirement in Prisma Cloud Compute?

Enable the syslog option in the Console

Enable the API settings for logging.

Enable the CSV export in the Console.

Enable the syslog option in the Console

Enable the Splunk option in the Console.

The security team wants to enable the ''block'' option under compliance checks on the host.What effect will this option have if it violates the compliance check?

No containers will be allowed to start on that host.

The host will be taken offline.

Additional hosts will be prevented form starting.

Containers on a host will be stopped.

No containers will be allowed to start on that host.

During an initial deployment of Prisma Cloud Compute, the customer sees vulnerabilities in their environment.Which statement correctly describes the default vulnerability policy?

It alerts on all vulnerabilities, regardless of severity.

It blocks all containers that contain a vulnerability.

It alerts on any container with more than three critical vulnerabilities.

It blocks containers after 30 days if they contain a critical vulnerability.

It alerts on all vulnerabilities, regardless of severity.

Console is running in a Kubernetes cluster, and you need to deploy Defenders on nodes within this cluster.Which option shows the steps to deploy the Defenders in Kubernetes using the default Console service name?

From the deployment page in Console, choose twistlock-console for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

From the deployment page in Console, choose pod name for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace.

From the deployment page configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes.

From the deployment page in Console, choose twistlock-console for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace.

From the deployment page in Console, choose twistlock-console for Console identifier, and run the curl | bash script on the master Kubernetes node.

On which cloud service providers can you receive new API release information for Prisma Cloud?

AWS, Azure, GCP, Oracle, Alibaba

Palo Alto Networks PCCSE Practice Test 3 - Free Online Exam Prep & Questions

You are an existing customer of Prisma Cloud Enterprise. You want to onboard a public cloud account and immediately see all of the alerts associated with this account based off ALL of your tenant's existing enabled policies. There is no requirement to send alerts from this account to a downstream application at this time.

Which option shows the steps required during the alert rule creation process to achieve this objective?

Become a Premium Member for full access

Unlock Premium Member

Palo Alto Networks PCCSE Practice Test 3

Question

Palo Alto Networks PCCSE Practice Tests

Practice Tests