Palo Alto Networks System Engineer - Prisma Cloud PSE-PrismaCloud Exam Questions

Page: 1 / 14
Total 115 questions

Want more questions? Get Premium Access.
()

Question 1

Which RQL string returns a list of all Azure virtual machines that are not currently running?

Aconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'off'

Bconfig where api.name = 'azure-vm-list' AND json.rule = powerState does not contain 'running'

Cconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'running'

Dconfig where api.name = 'azure-vm-list' AND json.rule = powerState contains 'running'

Answer : B

Question 2

Which cloud provider supports iLB-as-next-hop?

AMicrosoft Azure

BAlibaba Cloud

COracle Cloud

DAmazon Web Services

Answer : A

Question 3

Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

Aconfig where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification

Bconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

Cconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists

Dconfig where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1

Answer : B

Question 4

Which Resource Query Language (RQL) query searches for all Relational Database Service (RDS) instances that have a public IP address?

Aconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = storageEncrypted is false

Bevent from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Cconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Dconfig from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = publiclyAccessible is true

Answer : C

Question 5

Which type of Prisma Cloud Enterprise alert supports autoremediation?

Anetwork

Baudit

Canomaly

Dconfig

Answer : D

Question 6

The VM-Series integration with Amazon GuardDuty feeds malicious IP addresses to the VM-Series NGFW using XML API to populate a Dynamic Address Group within a Security policy that blocks traffic.

How does Amazon Web Services achieve this integration?

ASNS

BSQS

CCodeDeploy

DLambda

Answer : D

Question 7

Which three services can Google Cloud Security Scanner assess? (Choose three.)

AGoogle Kubernetes Engine

BBigQuery

CCompute Engine

DApp Engine

EGoogle Virtual Private Cloud

Answer : A, C, D

Question 8

Which change represents a VM-Series NGFW license transfer?

AVM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

BVM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

CVM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

DVM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services

Answer : C

Question 9

How is license utilization displayed within the Prisma Public Cloud interface?

Anavigate to the CLI and run show license command

Bnavigate to General > Licensing

Cnavigate to Dashboard > Asset Inventory

Dnavigate to Settings (via the gear icon) > Licensing

Answer : D

Question 10

Which pillar of the Prisma Cloud platform allows cloud entitlements to be quickly audited and secured?

ACloud Security Posture Management

BCloud Identity Security

CCloud Network Security

DCloud Code Security

Answer : A

Question 11

What subcommand invokes the Prisma Cloud Compute (PCC) edition image scanner?

A> twistcli images scan

B> twistcli project scan

C> twistcli scan projects

D> twistcli scan images

Answer : A

Question 12

A customer CSO has asked you to demonstrate how to identify all "Amazon RDS" resources deployed and the region that they are deployed in. What are two ways that Prisma Public Cloud can show the relevant information?(Choose two.)

AGenerate a compliance report from the Compliance dashboard

BWrite an RQL query from the 'Investigate' tab.

CConfigure an Inventory report from the 'Alerts' tab

DOpen the Asset dashboard, filter on Amazon Web Services, and click 'Amazon RDS' resources.

Answer : B, D

Question 13

What does Infrastructure as Code (laC) collect to enable automation?

Amodern representation formats that describe and deploy infrastructure

Borchestrated workflows to enable cross-functional teams to deploy infrastructure

Cimages to easily replicate and manage infrastructure

Dinfrastructure monitoring tool sets

Answer : A

Question 14

Which three services can Google Cloud Security Scanner assess? (Choose three.)

AGoogle Kubernetes Engine

BBigQuery

CCompute Engine

DApp Engine

EGoogle Virtual Private Cloud

Answer : A, C, D

Question 15

A customer has just launched a Palo Alto Networks VM-Series NGFW into an Amazon Web Services VPC to protect a cloud hosted application. They are experiencing unpredictable results and have identified that the interfaces on the firewall are in the incorrect order

Which PAN-OS CLI command resolves this issue?

Aset system setting mgmt-interface-swap enable yes

Bset mgmt-interface settings swap yes

Cset mgmt-interface swap yes

Dset system setting mgmt-interface swap yes

Answer : A

Question 16

What resource is required to receive inbound traffic from the internet to VM-Series NGFW deployed as a gateway for Azure Stack workloads?

APublic IP for the VM-Series NGFW

BNAT appliance

CAzure Stack Edge Router

DBorder Customer Network

Answer : B

Question 17

Which statement applies to optimization of registry scans with version pattern matching?

AIt requires Linux images to rely on optimizing registry scans due to various Linux elements.

BIt is only necessary in registries with tens of thousands of repositories and millions of images.

CIt is best practice to always optimize registry scans for faster results.

DIt is rarely successful in the Windows Operating System (OS).

Answer : B

Question 18

Which Amazon Web Services (AWS) service supplies information for Prisma Cloud "event where" Resource Query Language (RQL) queries?

AGuardDuty

BCloudTrail Audit Logs

CActivity Logs

DInspector

Answer : B

Question 19

Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

Aconfig where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification

Bconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

Cconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists

Dconfig where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1

Answer : B

Question 20

Which type of Prisma Cloud Enterprise alert supports autoremediation?

Anetwork

Baudit

Canomaly

Dconfig

Answer : D

Question 21

Which two data sources are ingested by Prisma Cloud? (Choose two.)

Anetwork flow logs

Blist of all database instances' tables

Cmetadata about compute resources' configuration

DCortex Data Lake

Answer : A, C

Question 22

What are the asset severity levels within Prisma Cloud asset inventory?

ALow, Medium, and High

BLow, Medium, High, and Critical

CInformational, Low, Medium, and High

DLow, Medium, High, Severe, and Critical

Answer : B

Question 23

Which statement explains the correlation between the block and alert thresholds in a vulnerability management policy?

AThe thresholds can be set to informational, low, medium, high, and critical.

BThe alert threshold always has precedence over, and can be greater than, the block threshold.

CThe block threshold must always be equal to or greater than the alert threshold.

DThe block threshold always has precedence over, and can be less than, the alert threshold.

Answer : C

Question 24

What is required for an EC2 instance to access the internet directly from an AWS VPC?

AInternet Gateway

BTransit Gateway

CVirtual Private Gateway

DCustomer Gateway

Answer : A

Question 25

Which two resources provide operational insight within the Prisma Cloud Asset Inventory? (Choose two.)

ACortex Data Lake

BCloud Storage buckets

CPrisma Access Gateways

DCompute Engine instance

Answer : A, B

Question 26

How does a customer that has deployed a VM-Series NGFW on Microsoft Azure using a BYOL license change to a PAYG license structure?

Apurchase a new PAYG license from a reseller

Bgo to Palo Alto Networks Support website to change the BYOL license to a PAYG license

Cpurchase a new PAYG license for Microsoft Azure from Palo Alto Networks

Dlaunch a new VM using the PAYG image

Answer : D

Question 27

An image containing medium vulnerabilities that do not have available fixes is being deployed into the sock-shop namespace. Prisma Cloud has been configured for vulnerability management within the organization's continuous integration (CI) tool and registry.

What will occur during the attempt to deploy this image from the CI tool into the sock-shop namespace?

AThe image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not be deployed.

BThe CI policy will fail the build; therefore, the image will not be deployed.

CThe image will be deployed successfully, and all vulnerabilities will be reported.

DThe image will be deployed successfully, but no vulnerabilities will be reported.

Answer : B

Question 28

Which Amazon Web Services (AWS) service supplies information for Prisma Cloud "event where" Resource Query Language (RQL) queries?

AGuardDuty

BCloudTrail Audit Logs

CActivity Logs

DInspector

Answer : B

Question 29

Which two valid effects are used to deal with images within a rule for trusted images? (Choose two.)

ADeny

BAlert

CBlock

DIgnore

Answer : B, C

Question 30

Which two cloud-native providers are supported by Prisma Cloud? (Choose two.)

ADigitalOcean

BAzure

CIBM Cloud

DOracle Cloud

Answer : B, D

Question 31

Which two cloud providers provide egress load balancing? (Choose two.)

AMicrosoft Azure

BAlibaba Cloud

CAmazon Web Services

DOracle Cloud

Answer : A, C

Question 32

can you create a custom compliance standard in Prisma Public Cloud?

AGenerate a new Compliance Report.

BCreate compliance framework in a spreadsheet then import into Prisma Public Cloud.

CFrom Compliance tab, clone a default framework and customize.

DFrom Compliance tab > Compliance Standards, click 'Add New.'

Answer : D

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/create-a-custom-compliance-standard

Question 33

Where can rules be configured and viewed to configure trusted images?

AMonitor > Compliance > Trusted Images

BMonitor > Compliance > Images

CDefend > Compliance > Trusted Images

DDefend > Compliance > Images

Answer : C

Question 34

Which two data sources are ingested by Prisma Cloud? (Choose two.)

Anetwork flow logs

Blist of all database instances' tables

Cmetadata about compute resources' configuration

DCortex Data Lake

Answer : A, C

Question 35

Which two actions are appropriate when configuring Prisma Cloud to scan a registry? (Choose two.)

AAllow Prisma Cloud to automatically optimize registry scans with version pattern matching.

BAllow Prisma Cloud to automatically distribute the scan job across a pool of available Defenders.

CExplicitly specify the Defender to do the job.

DExplicitly specify the predefined version pattern-matching algorithm.

Answer : A, B

Question 36

What are the two options to dynamically register tags used by Dynamic Address Groups that are referenced in policy? (Choose two.)

AVM Monitoring

BExternal Dynamic List

CCFT Template

DXML API

Answer : A, D

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy

Question 37

Which three methods can provide application-level security for a web server instance on Amazon Web Services? (Choose three.)

ATraps

BPrisma SaaS

CAmazon Web Services WAF

DVM-Series firewalls

ESecurity Groups

Answer : A, C, D

Question 38

Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

Anetwork where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))

Bnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))

Cnetwork where dest.resource IN (resource where role = 'Database'}

Dnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

Answer : D

Question 39

Which change represents a VM-Series NGFW license transfer?

AVM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

BVM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

CVM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

DVM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services

Answer : C

Question 40

What subcommand invokes the Prisma Cloud Compute (PCC) edition image scanner?

A> twistcli images scan

B> twistcli project scan

C> twistcli scan projects

D> twistcli scan images

Answer : A

Question 41

When an on-premises NGFW (customer gateway) is used to connect to the Virtual Gateway, which two IKE profiles cannot be used? (Choose two.)

AGroup2 / SHA-1 / AES-128-CBC / IKE-V1

BGroup2 / SHA-1 / AES-128-GCM / IKE-V1

CGroup14 / SHA-256 / AES-256-GCM / IKE-V1

DGroup2 / SHA-1 / AES-128-CBC

EGroup14 / SHA-256 / AES-256-CBC / IKE-V1

Answer : C, E

Question 42

What are two valid image identifiers to designate trust? (Choose two.)

Arepo

Btrusted publisher

Cregistry

Dbase layer

Answer : B, C

Question 43

Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

AAzure Application Insight

BResource Group

CAzure Security Center

DBootstrapping

EARM Template

Answer : A, C, D

Question 44

An administrator deploys a VM-Series firewall into Amazon Web Services. Which attribute must be disabled on the data-plane elastic network interface for the instance to handle traffic that is not destined to its own IP address?

Asecurity group

Btags

Celastic ip address

Dsource/destination checking

Answer : D

https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html

Question 45

What are the two options to dynamically register tags used by Dynamic Address Groups that are referenced in policy? (Choose two.)

AVM Monitoring

BExternal Dynamic List

CCFT Template

DXML API

Answer : A, D

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy

Question 46

Which two template formats are supported by the Prisma Cloud infrastructure as code (laC) scan service? (Choose two.)

AARM

BXML

CYAML

DJSON

Answer : A, C

Question 47

Which statement is specific for Prisma Cloud when integrating into cloud environments?

AAn AutoFocus license is included in Prisma Cloud.

BFor multi-cloud environment licenses are required for the number of Prisma Cloud instances.

CCan be natively integrated into Prisma Access.

DNo agents or proxies are required.

Answer : D

Question 48

Which pillar of the Prisma Cloud platform allows cloud entitlements to be quickly audited and secured?

ACloud Security Posture Management

BCloud Identity Security

CCloud Network Security

DCloud Code Security

Answer : A

Question 49

What is the Palo Alto Networks default Prisma Cloud setting for Alert Disposition to reduce the number of false positives?

AConservative

BModerate

CHigh

DAggressive

Answer : A

Question 50

What is the default capacity license of a VM-Series NGFW being deployed from the Google Cloud Platform Marketplace?

AVM-GCP

BVM-100

CVM-500

DVM-300

Answer : D

https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-google-cloud-platform/deploy-the-vm-series-firewall-on-google-cloud.html

Question 51

What will occur during the attempt to deploy this image from the CI tool into the sock-shop namespace?

AThe image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not be deployed.

BThe CI policy will fail the build; therefore, the image will not be deployed.

CThe image will be deployed successfully, and all vulnerabilities will be reported.

DThe image will be deployed successfully, but no vulnerabilities will be reported.

Answer : B

Question 52

Which three requirements are needed to register a PAYG VM-Series NGFW at the Palo Alto Networks Customer Support website? (Choose three.)

ASerial Number

BCPU ID

CAuth Code

DLicense Key

EUUID

Answer : A, B, E

Question 53

Where can rules be configured and viewed to configure trusted images?

AMonitor > Compliance > Trusted Images

BMonitor > Compliance > Images

CDefend > Compliance > Trusted Images

DDefend > Compliance > Images

Answer : C

Question 54

Asecurity group

Btags

Celastic ip address

Dsource/destination checking

Answer : D

https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html

Question 55

When protecting against attempts to exploit client-side and server-side vulnerabilities, what is the Palo Alto Networks best practice when using NGFW Vulnerability Protection Profiles?

AUse the default Vulnerability Protection Profile to protect clients from all known critical, high, and medium-severity threats

BClone the predefined Strict Profile, with packet capture settings disabled

CUse the default Vulnerability Protection Profile to protect servers from all known critical, high, and medium-severity threats

DClone the predefined Strict Profile, with packet capture settings enabled

Answer : D

Question 56

Which two types of Resource Query Language (RQL) queries can be used to create policies? (Choose two.)

Ahose from

Bnetwork from

Csystem from

Devent from

Answer : A, D

Question 57

Which statement applies to vulnerability management policies?

AHost and serverless rules support blocking, whereas container rules do not.

BRules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

CPolicies for containers, hosts, and serverless functions are not separate.

DRules are evaluated in an undefined order.

Answer : B

Question 58

How can you use Prisma Public Cloud to identify Amazon EC2 instances that have been tagged as "Private?

ACreate an RQL config query to identify resources with the tag 'Private.'

BCreate an RQL network query to identify traffic from resources tagged 'Private.'

COpen the Asset Dashboard, filter on tags: and choose 'Private.'

DGenerate a CIS compliance report and review the 'Asset Summary.'

Answer : B

Question 59

Which RQL string using network query attributes returns all traffic destined for Internet or for Suspicious IPs that also exceeds 1GB?

Anetwork where publicnetwork = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Bnetwork where dest publicnetwork IN ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Cshow traffic where destination.network = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Dnetwork where bytes > 1GB and destination = 'Internet IPs' OR 'Suspicious IPs'

Answer : B

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql-examples

All network traffic that is greater than 1GB and destined to Internet or Suspicious IPs (allows you to identify data exfiltration attempt on any cloud environment).

network where dest.publicnetwork IN ( 'Internet IPs', 'Suspicious IPs' ) AND bytes > 1000000000

Question 60

Which pillar of the Prisma Cloud platform can secure outbound traffic, stop lateral attack movement, and block inbound threats?

ACloud Workload Protection (CWP)

BCloud Code Security

CCloud Network Security

DCloud Identity Security

Answer : C

Question 61

Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

AShield

BInspector

CGuardDuty

DAmazon Web Services WAF

Answer : B

Question 62

Which type of Resource Query Language (RQL) query is used to create a custom policy that looks for untagged resources?

Aconfig

Balert

Cevent

Ddata

Answer : A

Question 63

What are the asset severity levels within Prisma Cloud asset inventory?

ALow, Medium, and High

BLow, Medium, High, and Critical

CInformational, Low, Medium, and High

DLow, Medium, High, Severe, and Critical

Answer : B

Question 64

Under which operating systems (OSs) is twistcli supported?

ALinux, macOS, and Windows

BWindows only

CLinux and Windows

DLinux, macOS, PAN-OS, and Windows

Answer : A

Question 65

Which type of Prisma Cloud Enterprise alert supports autoremediation?

Anetwork

Baudit

Canomaly

Dconfig

Answer : D

Question 66

Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

AShield

BInspector

CGuardDuty

DAmazon Web Services WAF

Answer : B

Question 67

Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

Anetwork where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))

Bnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))

Cnetwork where dest.resource IN (resource where role = 'Database'}

Dnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

Answer : D

Question 68

The Microsoft Azure virtual network gateway supports which two site-to-site connectivity options? (Choose two.)

ADirect Connect

BFast Connect

CIPsecVPN

DExpressRoute

Answer : C, D

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Question 69

When an on-premises NGFW (customer gateway) is used to connect to the Virtual Gateway, which two IKE profiles cannot be used? (Choose two.)

AGroup2 / SHA-1 / AES-128-CBC / IKE-V1

BGroup2 / SHA-1 / AES-128-GCM / IKE-V1

CGroup14 / SHA-256 / AES-256-GCM / IKE-V1

DGroup2 / SHA-1 / AES-128-CBC

EGroup14 / SHA-256 / AES-256-CBC / IKE-V1

Answer : C, E

Question 70

Which three services can Google Cloud Security Scanner assess? (Choose three.)

AGoogle Kubernetes Engine

BBigQuery

CCompute Engine

DApp Engine

EGoogle Virtual Private Cloud

Answer : A, C, D

Question 71

Which pillar of the Prisma Cloud platform allows cloud entitlements to be quickly audited and secured?

ACloud Security Posture Management

BCloud Identity Security

CCloud Network Security

DCloud Code Security

Answer : A

Question 72

Which statement applies to optimization of registry scans with version pattern matching?

AIt requires Linux images to rely on optimizing registry scans due to various Linux elements.

BIt is only necessary in registries with tens of thousands of repositories and millions of images.

CIt is best practice to always optimize registry scans for faster results.

DIt is rarely successful in the Windows Operating System (OS).

Answer : B

Question 73

Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

Anetwork where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))

Bnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))

Cnetwork where dest.resource IN (resource where role = 'Database'}

Dnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

Answer : D

Question 74

Which three types of security checks can Prisma Public Cloud perform? (Choose three.)

Acompliance where

Bnetwork where

Cuser where

Dconfig where

Eevent where

Answer : B, D, E

Question 75

Which type of Resource Query Language (RQL) query is used to create a custom policy that looks for untagged resources?

Aconfig

Balert

Cevent

Ddata

Answer : A

Question 76

How can a range of dates in the Prisma Cloud default policy be modified?

AClone the existing policy and change the value.

BClick the gear icon next to the policy name to open the 'Edit Policy' dialog.

CManually create the Resource Query Language (RQL) statement.

DOverride the value and commit the configuration.

Answer : A

Question 77

What occurs with the command twistcli when scanning images?

AIf options are listed after the image name; they will be ignored.

BIf option '--user' is used, it is mandatory to use option '--password.

CIf option '--address' is unspecified, all images are scanned.

DOption '--output-file' cannot be used in conjunction with option '--details.'

Answer : B

Question 78

Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

AAzure Application Insight

BResource Group

CAzure Security Center

DBootstrapping

EARM Template

Answer : A, C, D

Question 79

Which pillar of the Prisma Cloud platform provides support for both public and private clouds as well as flexible agentless scanning and agent-based protection?

ACloud Network Security

BCloud Security Posture Management

CCloud Identity Security

DCloud Workload Protection (CWP)

Answer : D

Question 80

The following error is received when performing a manual twistcli scan on an image:

What is missing from the command?

Aregistry path for image name

Bpassword

Cconsole address

Dusername

Answer : A

Question 81

Which cloud provider supports iLB-as-next-hop?

AMicrosoft Azure

BAlibaba Cloud

COracle Cloud

DAmazon Web Services

Answer : A

Question 82

Which two cloud-native providers are supported by Prisma Cloud? (Choose two.)

ADigitalOcean

BAzure

CIBM Cloud

DOracle Cloud

Answer : B, D

Question 83

Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

AShield

BInspector

CGuardDuty

DAmazon Web Services WAF

Answer : B

Question 84

What are the asset severity levels within Prisma Cloud asset inventory?

ALow, Medium, and High

BLow, Medium, High, and Critical

CInformational, Low, Medium, and High

DLow, Medium, High, Severe, and Critical

Answer : B

Question 85

Which type of alert captures unusual user activity and excessive login failures?

AAnomaly

BAudit Event

CConfiguration

DNetwork

Answer : A

Question 86

A Prisma Cloud Administrator has been asked to create a custom policy which notifies the InfoSec team each time a configuration mange is made to a Security group.

Which type of Resource Query Language (RQL) query would be used in this policy?

Aaudit from

Bnetwork from

Cevent from

Dconfig from

Answer : A

Question 87

Which statement applies to vulnerability management policies?

AHost and serverless rules support blocking, whereas container rules do not.

BRules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

CPolicies for containers, hosts, and serverless functions are not separate.

DRules are evaluated in an undefined order.

Answer : B

Question 88

In which two ways does Palo Alto Networks VM orchestration help service providers automatically provision security instances and policies? (Choose two.)

Afully instrumented API

BAperture Orchestration Engine

CVM Orchestration Policy Editor

Dsupport for Dynamic Address Groups

Answer : A, D

Question 89

What are the asset severity levels within Prisma Cloud asset inventory?

ALow, Medium, and High

BLow, Medium, High, and Critical

CInformational, Low, Medium, and High

DLow, Medium, High, Severe, and Critical

Answer : B

Question 90

Which two templates are supported by Cloud Code Security scan service? (Choose two.)

AAzure Resource Manager (ARM)

BHyper Text Markup Language (HTML)

CGitHub

DTerraform

Answer : A, D

Question 91

What occurs with the command twistcli when scanning images?

AIf options are listed after the image name; they will be ignored.

BIf option '--user' is used, it is mandatory to use option '--password.

CIf option '--address' is unspecified, all images are scanned.

DOption '--output-file' cannot be used in conjunction with option '--details.'

Answer : B

Question 92

What is the Palo Alto Networks default Prisma Cloud setting for Alert Disposition to reduce the number of false positives?

AConservative

BModerate

CHigh

DAggressive

Answer : A

Question 93

Which three types of security checks can Prisma Public Cloud perform? (Choose three.)

Acompliance where

Bnetwork where

Cuser where

Dconfig where

Eevent where

Answer : B, D, E

Question 94

Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

Aconfig where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification

Bconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

Cconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists

Dconfig where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1

Answer : B

Question 95

How can you modify a range of dates default policy in Prisma Public Cloud?

AOverride the value and commit the configuration.

BClone the existing policy and change the value.

CManually create the RQL statement.

DClick the Gear icon next to the policy name to open the Edit Policy dialog

Answer : B

Question 96

Which two cloud-native providers are supported by Prisma Cloud? (Choose two.)

ADigitalOcean

BAzure

CIBM Cloud

DOracle Cloud

Answer : B, D

Question 97

Which three services can Google Cloud Security Scanner assess? (Choose three.)

AGoogle Kubernetes Engine

BBigQuery

CCompute Engine

DApp Engine

EGoogle Virtual Private Cloud

Answer : A, C, D

Question 98

Which two valid effects are used to deal with images within a rule for trusted images? (Choose two.)

ADeny

BAlert

CBlock

DIgnore

Answer : B, C

Question 99

What will occur during the attempt to deploy this image from the CI tool into the sock-shop namespace?

AThe image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not be deployed.

BThe CI policy will fail the build; therefore, the image will not be deployed.

CThe image will be deployed successfully, and all vulnerabilities will be reported.

DThe image will be deployed successfully, but no vulnerabilities will be reported.

Answer : B

Question 100

How can you modify a range of dates default policy in Prisma Public Cloud?

AOverride the value and commit the configuration.

BClone the existing policy and change the value.

CManually create the RQL statement.

DClick the Gear icon next to the policy name to open the Edit Policy dialog

Answer : B

Question 101

Which regulatory framework in Prisma Public Cloud measures compliance with EU data privacy regulations in Amazon Web Services workloads?

AGDPR

BEU Data Protection Directive 95/46/EC

CISO 27001

DPayment Card Industry 3.0

Answer : A

Question 102

Which Prisma Public Cloud policy alerts administrators to unusual user activity?

AAnomaly

BAudit Event

CNetwork

DConfiguration

Answer : A

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies.html

Question 103

can you create a custom compliance standard in Prisma Public Cloud?

AGenerate a new Compliance Report.

BCreate compliance framework in a spreadsheet then import into Prisma Public Cloud.

CFrom Compliance tab, clone a default framework and customize.

DFrom Compliance tab > Compliance Standards, click 'Add New.'

Answer : D

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/create-a-custom-compliance-standard

Question 104

What resource is required to receive inbound traffic from the internet to VM-Series NGFW deployed as a gateway for Azure Stack workloads?

APublic IP for the VM-Series NGFW

BNAT appliance

CAzure Stack Edge Router

DBorder Customer Network

Answer : B

Question 105

Which Amazon Web Services security service can provide host vulnerability information to Prisma Public Cloud?

AShield

BInspector

CGuardDuty

DAmazon Web Services WAF

Answer : B

Question 106

Which three methods can provide application-level security for a web server instance on Amazon Web Services? (Choose three.)

ATraps

BPrisma SaaS

CAmazon Web Services WAF

DVM-Series firewalls

ESecurity Groups

Answer : A, C, D

Question 107

Which RQL string returns a list of all Azure virtual machines that are not currently running?

Aconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'off'

Bconfig where api.name = 'azure-vm-list' AND json.rule = powerState does not contain 'running'

Cconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'running'

Dconfig where api.name = 'azure-vm-list' AND json.rule = powerState contains 'running'

Answer : B

Question 108

What are two business values of Cloud Code Security? (Choose two.)

Aconsistent controls from build time to runtime

Bprebuilt and customizable polices to detect data such as personally identifiable information (PII) in publicly exposed objects

Csupport for multiple languages, runtimes and frameworks

Dcontinuous monitoring of all could resources for vulnerabilities, misconfigurations, and other threats

Answer : A, D

Question 109

Which statement applies to vulnerability management policies?

AHost and serverless rules support blocking, whereas container rules do not.

BRules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

CPolicies for containers, hosts, and serverless functions are not separate.

DRules are evaluated in an undefined order.

Answer : B

Question 110

What is a permanent public IP called on Amazon Web Services?

AReserved IP

BPIP

CEIP

DFloating IP

Answer : C

Question 111

Which two cloud providers provide egress load balancing? (Choose two.)

AMicrosoft Azure

BAlibaba Cloud

CAmazon Web Services

DOracle Cloud

Answer : A, C

Question 112

What are two valid image identifiers to designate trust? (Choose two.)

Arepo

Btrusted publisher

Cregistry

Dbase layer

Answer : B, C

Question 113

What is the Palo Alto Networks recommended setting for the Prisma Cloud Training Model Threshold?

ALow

BThorough

CHigh

DBaseline

Answer : C

Question 114

Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

Aconfig where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification

Bconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

Cconfig where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists

Dconfig where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1

Answer : B

Question 115

Which Amazon Web Services (AWS) service supplies information for Prisma Cloud "event where" Resource Query Language (RQL) queries?

AGuardDuty

BCloudTrail Audit Logs

CActivity Logs

DInspector

Answer : B

Question 116

Which Resource Query Language (RQL) query returns a list of all TERMINATED Google Compute Engine (GCE) instances?

AConfig from.cloud.resource where api.name = gcloud-compute-instance-list' and json.rule = status == TERMINATED

BConfig from.cloud.resource where api.name = gcloud-compute-instance-list' and json.rule = TERMINATED

CConfig from.cloud.resource where api.name = gcloud-compute-instance-list' and json.rule = status contains TERMINATED

DConfig from.cloud.resource where api.name = gcloud-compute-instance-list' and json.rule = is TERMINATED

Answer : C

Question 117

Which two items are required when a VM-100 BYOL instance is upgraded to a VM-300 BYOL instance? (Choose two.)

AUUID

Bnew Auth Code

CCPU ID

DAPI Key

Answer : B, D

In a public cloud deployment, if your firewall is licensed with the BYOL option, you mustDeactivate VMbefore you change the instance type or VM type and apply the license again on the firewall after you complete the model or instance upgrade. When you change the instance type, because the firewall has a new UUID and CPU ID, the existing license will no longer be valid.

https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/about-the-vm-series-firewall/upgrade-the-vm-series-firewall/upgrade-the-vm-series-model

Question 118

Which two elements does Prisma Cloud monitor when analyzing for unusual user activity? (Choose two.)

AOperating System (OS)

Bbrowser

Clocation

Dtime

Answer : C, D

Question 119

Which three anomaly policies are predefined in Prisma Public Cloud? (Choose three.)

AExcessive login failures

BUnusual user activity

CDenial-of-service activity

DAccount hijacking attempts

ESuspicious file activity

Answer : A, B, D

Account hijacking attempts

---Detect potential account hijacking attempts discovered by identifying unusual login activities. These can happen if there are concurrent login attempts made in short duration from two different geographic locations, which is

impossible time travel

, or login from a previously unknown browser, operating system, or location.

Excessive login failures

---Detect potential account hijacking attempts discovered by identifying brute force login attempts. Excessive login failure attempts are evaluated dynamically based on the models observed with continuous learning.

Unusual user activity

---Discover insider threat and an account compromise using advanced data science. The Prisma Cloud machine learning algorithm profiles a user's activities on the console, as well as the usage of access keys based on the location and the type of cloud resources.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies.html

Question 120

Which Resource Query Language (RQL) query searches for all Relational Database Service (RDS) instances that have a public IP address?

Aconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = storageEncrypted is false

Bevent from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Cconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Dconfig from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = publiclyAccessible is true

Answer : C

Question 121

Prevention against which type of attack is configurable in Web-Application and API Security (WAAS)?

Acredential stuffing

Bcross-site scripting (XSS)

Cshoulder surfing

Ddistributed denial of service (DDoS)

Answer : B

Question 122

When an on-premises NGFW (customer gateway) is used to connect to the Virtual Gateway, which two IKE profiles cannot be used? (Choose two.)

AGroup2 / SHA-1 / AES-128-CBC / IKE-V1

BGroup2 / SHA-1 / AES-128-GCM / IKE-V1

CGroup14 / SHA-256 / AES-256-GCM / IKE-V1

DGroup2 / SHA-1 / AES-128-CBC

EGroup14 / SHA-256 / AES-256-CBC / IKE-V1

Answer : C, E

Question 123

Which three types of security checks can Prisma Public Cloud perform? (Choose three.)

Acompliance where

Bnetwork where

Cuser where

Dconfig where

Eevent where

Answer : B, D, E

Question 124

Which pattern syntax will add all images to a trusted images rule within a registry?

A*.acme.com

Bacme/*

Cacme.com/myrepo/allimages:/*

Dregistry.acme.com/*

Answer : D

This pattern syntax will add all images within the specified registry (registry.acme.com) to a trusted images rule in Prisma Cloud. It ensures that any image from that registry is trusted by matching all images under that domain.

Question 125

What is the scope of the Amazon Web Services 1AM Service?

Aglobal

Bregional

CVPC

Dzonal

Answer : A

Question 126

In which two ways can Prisma Cloud Compute (PCC) edition be installed? (Choose two.)

Aself-managed in a customer's own container platform

Bself-contained hardware appliance

Cas a stand-alone Windows application

DCloud-hosted as part of a Prisma Cloud Enterprise tenant from Palo Alto Networks

Answer : A, D

Question 127

Which change represents a VM-Series NGFW license transfer?

AVM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

BVM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

CVM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

DVM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services

Answer : C

Question 128

What are two business values of Cloud Code Security? (Choose two.)

Aconsistent controls from build time to runtime

Bprebuilt and customizable polices to detect data such as personally identifiable information (PII) in publicly exposed objects

Csupport for multiple languages, runtimes and frameworks

Dcontinuous monitoring of all could resources for vulnerabilities, misconfigurations, and other threats

Answer : A, D

Question 129

All Amazon Regional Database Service (RDS)-deployed resources and the regions in which they are deployed can be identified by prisma Cloud using which two methods? (Choose two.)

AConfigure an Inventory report from the 'Alerts' tab.

BWrite an RQL query from the 'Investigate' tab.

COpen the Asset dashboard, filter on Amazon Web Services, and click 'Amazon RDS' resources.

DGenerate a compliance report from the Compliance dashboard.

Answer : B, C

Question 130

What are the two options to dynamically register tags used by Dynamic Address Groups that are referenced in policy? (Choose two.)

AVM Monitoring

BExternal Dynamic List

CCFT Template

DXML API

Answer : A, D

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy

Question 131

Which subcommand invokes the scan for images built with Jenkins in an OpenShift environment?

A> twistcli project scan

B> twistcli scar, projects

C> twistcli hosts scan

D> twistcli scar, hosts

Answer : A

Question 132

Which Prisma Public Cloud policy alerts administrators to unusual user activity?

AAnomaly

BAudit Event

CNetwork

DConfiguration

Answer : A

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies.html

Question 133

Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''

Anetwork where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))

Bnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))

Cnetwork where dest.resource IN (resource where role = 'Database'}

Dnetwork where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

Answer : D

Question 134

Prisma Public Cloud enables compliance monitoring and reporting by mapping which configurations to compliance standards?

ARQL queries

Balert rules

Cnotification templates

Dpolicies

Answer : D

Question 135

What is the Palo Alto Networks default Prisma Cloud setting for Alert Disposition to reduce the number of false positives?

AConservative

BModerate

CHigh

DAggressive

Answer : A

Question 136

Which option is defined by the creation and change of public cloud services managed in a repeatable and predictable fashion?

Aplatform as a service

Binfrastructure as a service

Csoftware as code

Dinfrastructure as code

Answer : B

Question 137

Which RQL query should be used to quickly identify any events related to an organization's Google Cloud Platform Big Query database the last 24 hours?

Aevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'Google Bigtable Instance'

Bevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'cloudsql.googleapis.com'

Cevent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'bigquery.googleapis.com'

Devent from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'dataproc.googleapis.com'

Answer : C

Question 138

Which framework in Prisma Public Cloud can be used to provide general best practices when no specific legal requirements or regulatory standards need to be met?

AHIPAA

BCIS Benchmark

CPayment Card Industry DSS V3

DGDPR

Answer : B

Question 139

How does a customer that has deployed a VM-Series NGFW on Microsoft Azure using a BYOL license change to a PAYG license structure?

Apurchase a new PAYG license from a reseller

Bgo to Palo Alto Networks Support website to change the BYOL license to a PAYG license

Cpurchase a new PAYG license for Microsoft Azure from Palo Alto Networks

Dlaunch a new VM using the PAYG image

Answer : D

Question 140

Which RQL string returns a list of all Azure virtual machines that are not currently running?

Aconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'off'

Bconfig where api.name = 'azure-vm-list' AND json.rule = powerState does not contain 'running'

Cconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'running'

Dconfig where api.name = 'azure-vm-list' AND json.rule = powerState contains 'running'

Answer : B

Question 141

Based on the diagram, how many routes will the virtual gateway advertise to the on-premises NGFW over the Amazon Web Services Direct Connect link?

Answer : A

Question 142

Palo Alto Networks recommends which two options for outbound HA design in Amazon Web Services using VM-Series NGFW? (Choose two.)

AiLB-as-next-hop

Btransit gateway and security VPC with VM-Series

Ctraditional active/standby HA on VM-Series

Dtransit VPC and security VPC with VM-Series

Answer : B, C

Question 143

Which statement applies to optimization of registry scans with version pattern matching?

AIt requires Linux images to rely on optimizing registry scans due to various Linux elements.

BIt is only necessary in registries with tens of thousands of repositories and millions of images.

CIt is best practice to always optimize registry scans for faster results.

DIt is rarely successful in the Windows Operating System (OS).

Answer : B

Question 144

What is a permanent public IP called on Amazon Web Services?

AReserved IP

BPIP

CEIP

DFloating IP

Answer : C

Question 145

How can all alerts related to "Amazon RDS" be quickly identified within the Prisma Cloud dashboard?

AGenerate a Center for Internet Security (CIS) compliance report and search for 'Amazon RDS' policy violations.

BView the alert data on the 'Asset Inventory' dashboard and filter on 'Amazon RDS.

CWithin the 'Alerts' tab. filter on 'Amazon RDS' as a service.

DCreate a custom Resource Query Language (RQL) configuration report.

Answer : C

Question 146

Under which operating systems (OSs) is twistcli supported?

ALinux, macOS, and Windows

BWindows only

CLinux and Windows

DLinux, macOS, PAN-OS, and Windows

Answer : A

Question 147

Which Resource Query Language (RQL) query searches for all Relational Database Service (RDS) instances that have a public IP address?

Aconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = storageEncrypted is false

Bevent from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Cconfig from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

Dconfig from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = publiclyAccessible is true

Answer : C

Question 148

What is the scope of the Amazon Web Services 1AM Service?

Aglobal

Bregional

CVPC

Dzonal

Answer : A

Question 149

Which framework in Prisma Public Cloud can be used to provide general best practices when no specific legal requirements or regulatory standards need to be met?

AHIPAA

BCIS Benchmark

CPayment Card Industry DSS V3

DGDPR

Answer : B

Question 150

Which two actions are appropriate when configuring Prisma Cloud to scan a registry? (Choose two.)

AAllow Prisma Cloud to automatically optimize registry scans with version pattern matching.

BAllow Prisma Cloud to automatically distribute the scan job across a pool of available Defenders.

CExplicitly specify the Defender to do the job.

DExplicitly specify the predefined version pattern-matching algorithm.

Answer : A, B

Question 151

What is required for an EC2 instance to access the internet directly from an AWS VPC?

AInternet Gateway

BTransit Gateway

CVirtual Private Gateway

DCustomer Gateway

Answer : A

Question 152

Which cloud provider supports iLB-as-next-hop?

AMicrosoft Azure

BAlibaba Cloud

COracle Cloud

DAmazon Web Services

Answer : A

Question 153

Which type of alert captures unusual user activity and excessive login failures?

AAnomaly

BAudit Event

CConfiguration

DNetwork

Answer : A

Question 154

Which statement is specific for Prisma Cloud when integrating into cloud environments?

AAn AutoFocus license is included in Prisma Cloud.

BFor multi-cloud environment licenses are required for the number of Prisma Cloud instances.

CCan be natively integrated into Prisma Access.

DNo agents or proxies are required.

Answer : D

Question 155

Which two cloud-native providers are supported by Prisma Cloud? (Choose two.)

ADigitalOcean

BAzure

CIBM Cloud

DOracle Cloud

Answer : B, D

Question 156

Which pillar of the Prisma Cloud platform provides support for both public and private clouds as well as flexible agentless scanning and agent-based protection?

ACloud Network Security

BCloud Security Posture Management

CCloud Identity Security

DCloud Workload Protection (CWP)

Answer : D

Question 157

How can all alerts related to "Amazon RDS" be quickly identified within the Prisma Cloud dashboard?

AGenerate a Center for Internet Security (CIS) compliance report and search for 'Amazon RDS' policy violations.

BView the alert data on the 'Asset Inventory' dashboard and filter on 'Amazon RDS.

CWithin the 'Alerts' tab. filter on 'Amazon RDS' as a service.

DCreate a custom Resource Query Language (RQL) configuration report.

Answer : C

Question 158

What are two ways to enable interface swap when deploying a VM-Series NGFW in Google Cloud Platform? (Choose two.)

Arun the PAN-OS CLI command: set system mgmt-interface-swap enable yes

Brun the PAN-OS CLI command: set system mgmt-interface-swap setting enable yes

Ccreate a bootstrap file that includes the mgmt-interface-swap command

Din the Google Cloud Console Metadata Field, enter a key-value pair where mgmt-interface-swap is the key and enable is the value

Answer : C, D

https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-google-cloud-platform/deploy-the-vm-series-firewall-on-google-cloud/management-interface-mapping-for-google-internal-load-balancing.html

Question 159

Which RQL string returns a list of all Azure virtual machines that are not currently running?

Aconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'off'

Bconfig where api.name = 'azure-vm-list' AND json.rule = powerState does not contain 'running'

Cconfig where api.name = 'azure-vm-list' AND json.rule = powerState = 'running'

Dconfig where api.name = 'azure-vm-list' AND json.rule = powerState contains 'running'

Answer : B

Question 160

Which two statements are true about CloudFormation? (Choose two.)

ACloudFormation is a procedural configuration management tool.

BCloudFormation templates can be used on both Amazon Web Services and Microsoft Azure

CCloudFormation templates can be written in JSON or YAML

DCloudFormation is a declarative orchestration tool.

Answer : C, D

Question 161

Which two types of Resource Query Language (RQL) queries can be used to create policies? (Choose two.)

Ahose from

Bnetwork from

Csystem from

Devent from

Answer : A, D

Question 162

Which RQL string using network query attributes returns all traffic destined for Internet or for Suspicious IPs that also exceeds 1GB?

Anetwork where publicnetwork = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Bnetwork where dest publicnetwork IN ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Cshow traffic where destination.network = ('Internet IPs', 'Suspicious IPs') AND bytes > 1000000000

Dnetwork where bytes > 1GB and destination = 'Internet IPs' OR 'Suspicious IPs'

Answer : B

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/rql-examples

All network traffic that is greater than 1GB and destined to Internet or Suspicious IPs (allows you to identify data exfiltration attempt on any cloud environment).

network where dest.publicnetwork IN ( 'Internet IPs', 'Suspicious IPs' ) AND bytes > 1000000000

Question 163

The Microsoft Azure virtual network gateway supports which two site-to-site connectivity options? (Choose two.)

ADirect Connect

BFast Connect

CIPsecVPN

DExpressRoute

Answer : C, D

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Question 164

AGenerate a compliance report from the Compliance dashboard

BWrite an RQL query from the 'Investigate' tab.

CConfigure an Inventory report from the 'Alerts' tab

DOpen the Asset dashboard, filter on Amazon Web Services, and click 'Amazon RDS' resources.

Answer : B, D

Question 165

Which three services can Google Cloud Security Scanner assess? (Choose three.)

AGoogle Kubernetes Engine

BBigQuery

CCompute Engine

DApp Engine

EGoogle Virtual Private Cloud

Answer : A, C, D

Question 166

Which two valid effects are used to deal with images within a rule for trusted images? (Choose two.)

ADeny

BAlert

CBlock

DIgnore

Answer : B, C

Question 167

What is required for an EC2 instance to access the internet directly from an AWS VPC?

AInternet Gateway

BTransit Gateway

CVirtual Private Gateway

DCustomer Gateway

Answer : A

Question 168

What is the Palo Alto Networks default Prisma Cloud setting for Alert Disposition to reduce the number of false positives?

AConservative

BModerate

CHigh

DAggressive

Answer : A

Question 169

Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

AAzure Application Insight

BResource Group

CAzure Security Center

DBootstrapping

EARM Template

Answer : A, C, D

Question 170

Which two actions are appropriate when configuring Prisma Cloud to scan a registry? (Choose two.)

AAllow Prisma Cloud to automatically optimize registry scans with version pattern matching.

BAllow Prisma Cloud to automatically distribute the scan job across a pool of available Defenders.

CExplicitly specify the Defender to do the job.

DExplicitly specify the predefined version pattern-matching algorithm.

Answer : A, B

Question 171

Which statement is specific for Prisma Cloud when integrating into cloud environments?

AAn AutoFocus license is included in Prisma Cloud.

BFor multi-cloud environment licenses are required for the number of Prisma Cloud instances.

CCan be natively integrated into Prisma Access.

DNo agents or proxies are required.

Answer : D

Question 172

Which Resource Query Language (RQL) query returns a list of all Azure SQL Databases that have transparent data encryption turned in?

Aconfig from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = is TERMINATED

Bconfig from cloud.resource where api.name = 'gcloud-compute-instances-list' = TERMINATED

Cconfig from cloud.resource where api.name = 'gcloud-compute-instances-list* and json.rule == status TERMINATED

Dconfig from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = status contains TERMINATED

Answer : A

Question 173

Under which operating systems (OSs) is twistcli supported?

ALinux, macOS, and Windows

BWindows only

CLinux and Windows

DLinux, macOS, PAN-OS, and Windows

Answer : A

Question 174

Which statement reflects the default vulnerability management policy?

APolicy rule order has little impact on optimization.

BPrisma Cloud scans images in all containers immediately upon policy activation.

CThe default vulnerability policy rule has an alert threshold to critical.

DPrisma Cloud ships all vulnerability policy with a default alert for containers, hosts, and serverless functions.

Answer : D

Question 175

Which type of Resource Query Language (RQL) query is used to create a custom policy that looks for untagged resources?

Aconfig

Balert

Cevent

Ddata

Answer : A

Question 176

What is a permanent public IP called on Amazon Web Services?

AReserved IP

BPIP

CEIP

DFloating IP

Answer : C

Question 177

Under which operating systems (OSs) is twistcli supported?

ALinux, macOS, and Windows

BWindows only

CLinux and Windows

DLinux, macOS, PAN-OS, and Windows

Answer : A

Question 178

An administrator has deployed an AWS transit gateway and used multiple VPC spokes to segregate a multi-tier application. The administrator also created a security VPC with multiple VM-Series NGFWs in an active/active deployment model via ECMP using Amazon Web Services VPN-based attachments.

What must be configured on the firewall to avoid asymmetric routing?

Asource address translation

Bdestination address translation

Cport address translation

Dsource and destination address translation

Answer : A

Question 179

Amazon Web Services WAF can be enabled on which two resources?(Choose two.)

AAWS CDN

BAWS NAT Gateway

CAWS ALB

DAWS NLB

Answer : A, C

Question 180

Which three methods can provide application-level security for a web server instance on Amazon Web Services? (Choose three.)

ATraps

BPrisma SaaS

CAmazon Web Services WAF

DVM-Series firewalls

ESecurity Groups

Answer : A, C, D

Question 181

Which type of Prisma Cloud Enterprise alert supports autoremediation?

Anetwork

Baudit

Canomaly

Dconfig

Answer : D

Question 182

Which two cloud providers support Load Balancers as next hop configurations for outbound connections? (Choose two.)

AGoogle Cloud Platform

BMicrosoft Azure

COracle Cloud

DAmazon Web Services

Answer : A, B