The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.
Which strategy should the administrator use to achieve this goal?
Answer : B
To reduce the number of alerts generated by the 'Unusual protocol activity (Internal)' network anomaly without entirely disabling the policy, setting the Alert Disposition to Conservative (option B) is the most effective strategy. This configuration adjusts the sensitivity of the anomaly detection, reducing the likelihood of false positives and minimizing alert fatigue without compromising the ability to detect genuine security threats. By adopting a more conservative approach to anomaly detection, the administrator can ensure that only the most significant and potentially harmful activities trigger alerts, thus maintaining a balance between security vigilance and operational efficiency.
Question 2
Which Prisma Cloud policy type detects port scanning activities in a customer environment?
Answer : B
In the context of Prisma Cloud, the policy type that is specifically designed to detect unusual activities, such as port scanning, within a customer's environment is classified under 'Anomaly.' Anomaly-based policies leverage advanced analytics and machine learning algorithms to identify patterns and behaviors that deviate from the norm, which could indicate potential security threats like port scanning attempts. By detecting such anomalies, these policies help organizations proactively identify and respond to potential reconnaissance activities by attackers seeking to discover open ports and vulnerable services.
Question 3
Which two statements are true about the differences between build and run config policies? (Choose two.)
Answer : C, D
In the context of Prisma Cloud, Build and Run policies serve distinct purposes in securing cloud environments. Build policies are designed to evaluate Infrastructure as Code (IaC) templates before deployment. These policies help identify and remediate security misconfigurations in the development phase, ensuring that vulnerabilities are addressed before the infrastructure is provisioned. This proactive approach enhances security by preventing misconfigurations from reaching production environments.
On the other hand, Run policies are applied to resources that are already deployed in the cloud. These policies continuously monitor the cloud environment, detecting and alerting on potential security issues that arise in the runtime. Run policies help maintain the security posture of cloud resources by identifying deviations from established security baselines and enabling quick remediation of identified issues.
Both Build and Run policies are integral to a comprehensive cloud security strategy, addressing security concerns at different stages of the cloud resource lifecycle---from development and deployment to ongoing operation.
Question 4
On which cloud service providers can you receive new API release information for Prisma Cloud?
Answer : B
Prisma Cloud, developed by Palo Alto Networks, is known for its comprehensive cloud security capabilities across various cloud service providers (CSPs). The integration and support extend to major CSPs, including AWS (Amazon Web Services), Azure (Microsoft's Cloud), GCP (Google Cloud Platform), Oracle Cloud, and Alibaba Cloud. This wide range of support ensures that organizations leveraging multi-cloud environments can maintain consistent security postures across all their cloud assets. The information regarding supported CSPs by Prisma Cloud can typically be found in their official documentation and release notes, which detail the features, integrations, and enhancements specific to each CSP.
Question 5
An administrator needs to detect and alert on any activities performed by a root account.
Which policy type should be used?
Answer : D
To detect and alert on activities performed by a root account, an audit event policy should be used. An audit event policy is a type of policy that can be used to detect suspicious activities or events that may be related to security threats. This type of policy will allow the administrator to monitor and alert on any activities performed by a root account.
The correct policy type to use in order to detect and alert on any activities performed by a root account is an 'audit event' policy. An audit event policy is designed to monitor and record a series of chronological events in the order they occur, typically used to track user activities and changes within the system. When a root account performs any actions, an audit event policy will log these events, allowing the administrator to review and potentially set up alerts if suspicious or unauthorized activities are detected. This type of policy is crucial for security and compliance purposes as it helps ensure that all actions performed with root privileges are legitimate and authorized.
Reference to this can be found in most cloud security platforms that offer CSPM (Cloud Security Posture Management) solutions. For example, within Prisma Cloud by Palo Alto Networks, audit events are a part of the Activity Monitoring features, which track user activities and system changes to facilitate investigations into suspicious or unauthorized actions.
Question 6
Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)
Answer : C, D
For upgrading Defenders with a Console v20.04 and Kubernetes deployment, the following two options are viable:
C . Remove Defenders, and then deploy the new DaemonSet: This option involves manually removing the existing Defenders and then deploying a new DaemonSet. This method ensures that the Defenders are updated to the latest version without relying on automatic updates12.
D . Let Defenders automatically upgrade: Prisma Cloud provides the capability for Defenders to automatically upgrade themselves. This feature simplifies the upgrade process by eliminating the need for manual intervention3.
Both methods are supported and can be used depending on the organization's policies and preferences regarding Defender upgrades. The automatic upgrade feature is particularly useful for maintaining up-to-date security without manual oversight, while the manual removal and redeployment of a new DaemonSet can be preferred in environments where more control over the upgrade process is desired123.
Question 7
Which file extension type is supported for Malware scanning in Prisma Cloud Data Security (PCDS)?
Prisma Cloud Data Security (PCDS) supports various file types for malware scanning, including .apk files, which are Android Package files used for installing applications on Android operating systems. This support is crucial for ensuring that applications deployed on or distributed through Android devices are free from malware and safe for user installation.
All Official Question Types