PCCSE practice test

1. Question 1 · 1

   Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default. Where should the customer navigate in Console?

   Choose one answer.

   • Monitor > Compliance
   • Defend > Compliance
   • Manage > Compliance
   • Custom > Compliance

2. Question 2 · 1

   A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps. Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?

   Choose one answer.

   • The SecOps lead should investigate the attack using Vulnerability Explorer and Runtime Radar.
   • The SecOps lead should use Incident Explorer and Compliance Explorer.
   • The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits.
   • The SecOps lead should review the vulnerability scans in the CI/CD process to determine blame.

3. Question 3 · 1

   An administrator sees that a runtime audit has been generated for a container. The audit message is: “/bin/ls launched and is explicitly blocked in the runtime rule. Full command: ls -latr” Which protection in the runtime rule would cause this audit?

   Choose one answer.

   • Networking
   • File systems
   • Processes
   • Container

4. Question 4 · 1

   Which data security default policy is able to scan for vulnerabilities?

   Choose one answer.

   • Objects containing Vulnerabilities
   • Objects containing Threats
   • Objects containing Malware
   • Objects containing Exploits

5. Question 5 · 1

   Which three fields are mandatory when authenticating the Prisma Cloud plugin in the IntelliJ application? (Choose three.)

   Choose all answers that apply.

   • Secret Key
   • Prisma Cloud API URL
   • Tags
   • Access Key
   • Asset Name

6. Question 6 · 1

   Which of the following are correct statements regarding the use of access keys? (Choose two.)

   Choose all answers that apply.

   • Access keys must have an expiration date
   • Up to two access keys can be active at any time
   • System Admin can create access key for all users
   • Access keys are used for API calls

7. Question 7 · 1

   The development team is building pods to host a web front end, and they want to protect these pods with an application firewall. Which type of policy should be created to protect this pod from Layer7 attacks?

   Choose one answer.

   • The development team should create a WAAS rule for the host where these pods will be running.
   • The development team should create a WAAS rule targeted at all resources on the host.
   • The development team should create a runtime policy with networking protections.
   • The development team should create a WAAS rule targeted at the image name of the pods.

8. Question 8 · 1

   A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible. Which action should the SOC take to follow security best practices?

   Choose one answer.

   • Enable “AWS S3 bucket is publicly accessible” policy and manually remediate each alert.
   • Enable “AWS RDS database instance is publicly accessible” policy and for each alert, check that it is a production instance, and then manually remediate.
   • Enable “AWS S3 bucket is publicly accessible” policy and add policy to an auto-remediation alert rule.
   • Enable “AWS RDS database instance is publicly accessible” policy and add policy to an auto-remediation alert rule.

9. Question 9 · 1

   An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds. What does the administrator need to configure?

   Choose one answer.

   • A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS
   • A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF
   • A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS
   • A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

10. Question 10 · 1

    What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

    Choose one answer.

    • policy
    • incident
    • audit
    • anomaly

11. Question 11 · 1

    A customer wants to monitor the company’s AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now. Which two pieces of information do you need to onboard this account? (Choose two.)

    Choose all answers that apply.

    • Cloudtrail
    • Subscription ID
    • Active Directory ID
    • External ID
    • Role ARN

12. Question 12 · 1

    An administrator for Prisma Cloud needs to obtain a graphical view to monitor all connections, including connections across hosts and connections to any configured network objects. Which setting does the administrator enable or configure to accomplish this task?

    Choose one answer.

    • ADEM
    • WAAS Analytics
    • Telemetry
    • Cloud Native Network Firewall
    • Host Insight

13. Question 13 · 1

    Which two CI/CD plugins are supported by Prisma Cloud as part of its DevOps Security? (Choose two.)

    Choose all answers that apply.

    • BitBucket
    • Visual Studio Code
    • CircleCI
    • IntelliJ

14. Question 14 · 1

    Given the following JSON query: $.resource[*].aws_s3_bucket exists Which tab is the correct place to add the JSON query when creating a Config policy?

    Choose one answer.

    • Details
    • Compliance Standards
    • Remediation
    • Build Your Rule (Run tab)
    • Build Your Rule (Build tab)

15. Question 15 · 1

    Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

    Choose all answers that apply.

    • Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders.
    • Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders.
    • Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment.
    • Let Defenders automatically upgrade.

Paid access to all 161 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.