Palo Alto Networks Prisma Certified Cloud Security Engineer PCCSE Exam Questions

Answer : A, B, D

This section describes the incident types surfaced in Incident Explorer.

Altered binary

Backdoor admin accounts

Backdoor SSH access

Brute force

Crypto miners

Execution flow hijack attempt

Kubernetes attack

Lateral movement

Malware

Port scanning

Reverse shell

Suspicious binary

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/runtime_defense/incident_types

Answer : B

When an administrator adds a Cloud account to Prisma Cloud and then deletes it, if the deleted account is added back to Prisma Cloud within a 24-hour period, the existing alerts associated with that account will be displayed again. This behavior ensures continuity in monitoring and alerting, allowing security teams to retain visibility into potential security issues or compliance violations associated with the cloud account. Re-displaying existing alerts helps maintain a consistent security posture and ensures that no critical alerts are overlooked during the re-addition process.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-alerts/view-respond-to-prisma-cloud-alerts

Answer : B, D, E

SSH Events in Host Observations within Prisma Cloud focus on activities related to Secure Shell (SSH) usage, which is critical for secure communication and remote management of cloud resources. The elements that are part of SSH Events include the User involved in the SSH session, the Process path that indicates the executable or command invoked during the session, and the Command itself that was executed. These elements are crucial for security monitoring and forensic analysis as they provide detailed context about SSH activities, helping security teams to identify unauthorized access, potential breaches, or malicious activities within their cloud environments. Startup process and System calls, while important in other contexts, are not directly associated with SSH Events in Host Observations.

Answer : A, D

Upon enabling alarms in Prisma Cloud, two critical alarm types that are registered are Onboarded Cloud Accounts status (A) and External integrations status (D). These alarms are pivotal for maintaining the health and security of the cloud environment. The Onboarded Cloud Accounts status alarms alert administrators about the connectivity and health of cloud accounts integrated with Prisma Cloud, ensuring continuous monitoring and security coverage. The External integrations status alarms provide notifications regarding the operational status of third-party services and tools integrated with Prisma Cloud, such as SIEMs, ticketing systems, or other security tools, ensuring that these integrations function correctly to support comprehensive security and incident response workflows.

Answer : B

When enabling Registry Scanning in Prisma Cloud for a registry that stores Windows images, it's important to note that Windows host defenders must be deployed in the environment to scan these images effectively. The Windows host defenders are specialized versions of the Prisma Cloud Defender that are designed to run on Windows operating systems. They provide the necessary functionality to scan Windows container images stored in registries, identifying vulnerabilities and ensuring the images comply with security policies before they are deployed. This requirement underscores the importance of having the appropriate Defender deployments that match the operating systems of the images being scanned.

Answer : B, C

RESOURCE_DELETED Resource was deleted. USER_DISMISSED Alert was dismissed or snoozed by the Prisma Cloud administrator with role of System admin, Account Group Admin, or Account and Cloud Provisioning Admin. POLICY_UPDATED Policy was updated. This status indicates a change in the policy RQL that results in a resource not being in scope for the policy evaluation.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OQ2CAM

Answer : B

The correct RQL (Resource Query Language) that detected the vulnerability is:

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-credential-report' AND json.rule = '(access_key_1_active is true and access_key_1_last_rotated != N/A and DateTime. ageInDays (access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime. ageInDays (access_key_2_last_rotated) > 90)'

This RQL is designed to check the age of the AWS IAM user's access keys to ensure that they are rotated within a recommended period, typically 90 days. If the access keys have not been rotated within this timeframe, it would be considered a security risk or vulnerability, as old keys may potentially be compromised. By enforcing access key rotation, it minimizes the risk of unauthorized access.

The reference for this type of policy check can be seen in cloud security best practices that advocate for regular rotation of access keys to minimize the potential impact of key compromise. CSPM tools like Prisma Cloud include such checks to automate compliance with these best practices.