Free Practice Questions for Paloalto Networks PCCSE Exam

To detect and alert on activities performed by a root account, an audit event policy should be used. An audit event policy is a type of policy that can be used to detect suspicious activities or events that may be related to security threats. This type of policy will allow the administrator to monitor and alert on any activities performed by a root account.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/prisma-cloud-threat-detection

The correct policy type to use in order to detect and alert on any activities performed by a root account is an "audit event" policy. An audit event policy is designed to monitor and record a series of chronological events in the order they occur, typically used to track user activities and changes within the system. When a root account performs any actions, an audit event policy will log these events, allowing the administrator to review and potentially set up alerts if suspicious or unauthorized activities are detected. This type of policy is crucial for security and compliance purposes as it helps ensure that all actions performed with root privileges are legitimate and authorized.

Reference to this can be found in most cloud security platforms that offer CSPM (Cloud Security Posture Management) solutions. For example, within Prisma Cloud by Palo Alto Networks, audit events are a part of the Activity Monitoring features, which track user activities and system changes to facilitate investigations into suspicious or unauthorized actions.

In the MITRE ATT&CK framework, the tactic "Exploit Public-Facing Application" is categorized under Initial Access. This tactic involves leveraging vulnerabilities in public-facing applications to gain unauthorized access to an organization's external services or applications. Initial Access tactics are concerned with the methods adversaries use to gain an initial foothold within a network, and exploiting public-facing applications is a common approach used by attackers to breach external defenses and establish a presence within a target network.

View users who enabled console access with both access keys and passwords: config from cloud.resource where api.name = 'aws-iam-get-credential-report' AND json.rule = access_key_1_active is true or access_key_2_active is true and password_enabled is true https://docs.paloaltonetworks.com/prisma/prisma- cloud/prisma-cloud-rql-reference/rql-reference/config-query/config-query-examples

The protection in the runtime rule that would cause the audit message indicating "/bin/ls launched and is explicitly blocked in the runtime rule" is related to "Processes". In container security, a runtime rule set to monitor and restrict processes can block specific executables or commands from running within a container. If the rule is triggered, it indicates that a process that is explicitly denied by the policy attempted to execute, which in this case is the 'ls' command.

https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-12/prisma-cloud-compute-edition-admin/runtime_defense/runtime_audits

In a Prisma Cloud environment where both agentless scanning and Defender-based scans (Host and Container Defenders) are configured, there is no inherent conflict between these two scanning methods. Both agentless scans and Defender scans are designed to complement each other, providing comprehensive coverage and depth in the security analysis of the environment. Agentless scans offer a broad, less intrusive overview, while Defender scans provide deep, detailed insights into the security posture. Therefore, both types of scans will run concurrently, enhancing the overall security visibility and protection of the environment without disabling or interfering with each other's operations.

The agentless scanning architecture lets you inspect a host and the container images in that host without having to install an agent or affecting its execution. https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/agentless-scanning/onboard-accounts

Prisma Cloud supports configuring Single Sign-On (SSO) with Identity Providers (IdPs) to streamline user authentication processes. However, for all the cloud accounts monitored by Prisma Cloud, only one IdP provider can be enabled at any given time. This limitation ensures a unified authentication mechanism across the platform, reducing complexity and potential security risks associated with managing multiple IdP configurations.

The Adoption Advisor is a feature within Prisma Cloud that aims to improve product operationalization. It provides visibility into how features are utilized, identifies unused capabilities, and suggests ways to leverage the full potential of the platform. Therefore, Option A: Adoption Advisor is the correct answer.

When enabling Registry Scanning in Prisma Cloud for a registry that stores Windows images, it's important to note that Windows host defenders must be deployed in the environment to scan these images effectively. The Windows host defenders are specialized versions of the Prisma Cloud Defender that are designed to run on Windows operating systems. They provide the necessary functionality to scan Windows container images stored in registries, identifying vulnerabilities and ensuring the images comply with security policies before they are deployed. This requirement underscores the importance of having the appropriate Defender deployments that match the operating systems of the images being scanned.

The correct RQL (Resource Query Language) that detected the vulnerability is:

config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-credential-report' AND json.rule = '(access_key_1_active is true and access_key_1_last_rotated != N/A and DateTime. ageInDays (access_key_1_last_rotated) > 90) or (access_key_2_active is true and access_key_2_last_rotated != N/A and _DateTime. ageInDays (access_key_2_last_rotated) > 90)'

This RQL is designed to check the age of the AWS IAM user's access keys to ensure that they are rotated within a recommended period, typically 90 days. If the access keys have not been rotated within this timeframe, it would be considered a security risk or vulnerability, as old keys may potentially be compromised. By enforcing access key rotation, it minimizes the risk of unauthorized access.

The reference for this type of policy check can be seen in cloud security best practices that advocate for regular rotation of access keys to minimize the potential impact of key compromise. CSPM tools like Prisma Cloud include such checks to automate compliance with these best practices.

To onboard an AWS account for monitoring by Prisma Cloud, specifically for resource configuration monitoring, the required pieces of information include:

A. External ID: The External ID is a unique identifier used in the trust relationship between Prisma Cloud and the AWS account, ensuring secure access, making it a correct choice.

D. RoleARN: The Role Amazon Resource Name (RoleARN) is necessary to grant Prisma Cloud the required permissions to access and monitor the AWS account resources, making it a correct choice. Option B (CloudTrail) is related to AWS logging but is not required solely for onboarding. Option C (Active Directory ID) is not relevant to AWS account onboarding for Prisma Cloud.