Prisma Certified Cloud Security Engineer (PCCSE) Free Practice Test

Question 1

A customer's Security Operations Center (SOC) team wants to receive alerts from Prisma Cloud via email once a day about all policies that have a violation, rather than receiving an alert every time a new violation occurs.
Which alert rule configuration meets this requirement?

A. Configure an alert rule. Under the "Policies" tab, select "All Policies." In the "Set Alert Notifications" tab, select "Email > Recurring," set to repeat every 1 day, and then enable "Email."

B. Configure an alert rule with all the defaults except selecting email within the "Alert Notifications" tab and specifying recipient.

C. Configure an alert rule. Under the "Policies" tab, select "High Risk Severity Policies." In the "Set Alert Notifications" tab, select "Email > Recurring," set to repeat every 1 day, and enable "Email."

D. Set up email integrations under the "Integrations" tab in "Settings" and create a notification template.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

The administrator wants to review the Console audit logs from within the Console.
Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

A. Navigate to Manage > Defenders > View Logs

B. Navigate to Monitor > Events > Host Log Inspection

C. The audit logs can be viewed only externally to the Console

D. Navigate to Manage > View Logs > History

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.
In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS. Which port will twistcli need to use to access the Prisma Compute APIs?

A. 8084

B. 443

C. 8083

D. 8081

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Given this information:
The Console is located at https://prisma-console.mydomain.local The username is: cluster The password is: password123 The image to scan is: myimage:latest Which twistcli command should be used to scan a Container for vulnerabilities and display the details about each vulnerability?

A. twistcli images scan --console-address https://prisma-console.mydomain.local -u cluster -p password123
-- details myimage:latest

B. twistcli images scan --address prisma-console.mydomain.local -u cluster -p password123
--vulnerability- details myimage:latest

C. twistcli images scan --address https://prisma-console.mydomain.local -u cluster -p password123 --details myimage:latest

D. twistcli images scan --console-address prisma-console.mydomain.local -u cluster -p password123 -- vulnerability-details myimage:latest

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

Which RQL will trigger the following audit event activity?

A. event from cloud.audit_logs where operation IN ( 'GetBucketWebsite', 'PutBucketWebsite',
'DeleteBucketWebsite')

B. event from cloud.audit_logs where cloud.service = s3.amazonaws.com' AND json.rule = $.userAgent contains 'parrot1

C. event from cloud.audit_logs where operation ConsoleLogin AND user = 'root'

D. event from cloud.audit_logs where operation IN
('cloudsql.instances.update','cloudsql.sslCerts.create', cloudsql.instances.create','cloudsq

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

An administrator sees that a runtime audit has been generated for a Container. The audit message is "DNS resolution of suspicious name wikipedia.com. type A".
Why would this message appear as an audit?

A. The DNS was not learned as part of the Container model or added to the DNS allow list.

B. The process calling out to this domain was not part of the Container model.

C. The Layer7 firewall detected this as anomalous behavior.

D. This is a DNS known to be a source of malware.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Which two proper agentless scanning modes are supported with Prisma Cloud? (Choose two).

A. Spoke Account Mode

B. Same Account Mode

C. Main Account Mode

D. Hub Account Mode

Correct Answer: A,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Given the following JSON query:
$.resource[*].aws_s3_bucket exists
Which tab is the correct place to add the JSON query when creating a Config policy?

A. Build Your Rule (Build tab)

B. Build Your Rule (Run tab)

C. Compliance Standards

D. Details

E. Remediation

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 9

Which IAM RQL query would correctly generate an output to view users who enabled console access with both access keys and passwords?

A. config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is false or access_key_2_active is true and password_enabled equals "*"

B. config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"

C. config from network where api.name = 'aws-iam-get-credential-report' AND json.rule = cert_1_active is true or cert_2_active is true and password_enabled equals "true"

D. config where api.name = 'aws-iam-get-credential-report' AND json.rule= access_key_1_active is true or access_key_2_active is true and password_enabled equals "true"

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Palo Alto Networks Prisma Certified Cloud Security Engineer (PCCSE) Free Practice Test