PCCSE sample questions

Question 1

True or False: The Prisma Cloud agentless scanning feature for hosts provides the same real-time runtime protection capabilities as a deployed Host Defender.

Accepted Answer

False

Answer

True

Question 2

A developer needs to scan a container image stored on their local workstation before pushing it to a registry. The developer has been provided with credentials and the address for the company's Prisma Cloud Compute Console. Which command should the developer use to perform this scan and output detailed results?

Accepted Answer

twistcli images scan --address --user --password --details myimage:latest

Answer

docker scan --login --token myimage:latest

Answer

prisma-scanner --console --image myimage:latest

Answer

twistcli registry scan --local --console myimage:latest

Question 3

A retail company uses Prisma Cloud to secure its e-commerce application hosted on Google Kubernetes Engine (GKE). During a security review, an auditor requires evidence that all network traffic between the 'payment-processing' pods and the 'customer-database' pods is encrypted using mTLS. Which Prisma Cloud feature can provide this evidence without instrumenting the application code?

Accepted Answer

Cloud Native Network Security (CNNS) Firewall audit logs, which show the protocol and encryption status of observed traffic flows.

Answer

WAAS event logs, by checking for HTTPS requests between the services.

Answer

Host Defender File Integrity Monitoring logs on the underlying GKE nodes.

Answer

A CSPM policy that checks the Kubernetes NetworkPolicy resource for encryption settings.

Question 4

A consultant is demonstrating Prisma Cloud's capabilities to a potential customer. The customer is concerned about misconfigurations in their Terraform IaC templates. To demonstrate the value of 'shift-left' security, the consultant wants to scan a Terraform file and show how Prisma Cloud can identify a security group that allows unrestricted SSH access. Which tool or integration is designed for this specific purpose?

Accepted Answer

The Prisma Cloud VS Code Extension.

Answer

The `twistcli` command-line utility.

Answer

The Prisma Cloud API, using a custom script to upload the Terraform file.

Answer

The Host Defender's File Integrity Monitoring feature.

Question 5

A Case Study for a Global Logistics Company

Company Background:
Global Logistics Inc. (GLI) is a multinational shipping and logistics company that manages a complex supply chain using a proprietary application suite. To improve agility and scalability, GLI is migrating this suite to a microservices architecture running on Azure Kubernetes Service (AKS). The environment is hybrid, with some legacy databases remaining on-premises, connected via an ExpressRoute circuit. The company is subject to various international data residency and privacy regulations.

Current Situation:
GLI has deployed Prisma Cloud Enterprise to secure their new AKS environment and existing Azure footprint. They have onboarded their Azure subscription and deployed Container Defenders as a DaemonSet on their AKS clusters. Initial vulnerability scans of their container images have revealed a large number of critical vulnerabilities in third-party libraries. The development teams are overwhelmed and are pushing back on fixing everything at once. Additionally, security has observed unencrypted traffic from some pods in the AKS cluster to the on-premises databases.

Security & Compliance Requirements:

A risk-based approach must be implemented for vulnerability management. Only vulnerabilities that are proven to be in loaded libraries within running containers should be prioritized for immediate remediation.
All network traffic between the AKS cluster and the on-premises databases must be encrypted and strictly controlled.
The company needs to prevent any container image from a public, untrusted registry (like Docker Hub) from being deployed in the production namespace.
A compliance report must be generated quarterly that demonstrates adherence to GDPR principles, specifically focusing on data location and access.

Problem:
As the lead cloud security engineer, you are tasked with designing and implementing a set of controls within Prisma Cloud to meet all of GLI's security and compliance requirements. Which of the following proposals BEST addresses all the stated requirements?

graph TD subgraph Azure Cloud AKS[AKS Cluster] AppGW[Application Gateway] end subgraph On-Premises Data Center DB[(Legacy Databases)] end Internet --> AppGW --> AKS AKS |ExpressRoute| DB

Accepted Answer

1. Enable 'Runtime Vulnerability Analysis' to prioritize active vulnerabilities. 2. Configure a CNNS policy to alert on unencrypted traffic to the on-premises IP range. 3. Create a Container Runtime Policy that blocks images from any registry not on an approved list. 4. Use the GDPR compliance standard report and Data Security module to track data location.

Answer

1. Configure `twistcli` in the CI/CD pipeline to block all critical vulnerabilities. 2. Use Cloud Native Network Security (CNNS) to monitor traffic to on-premises systems. 3. Create a custom RQL policy to detect images from Docker Hub. 4. Manually review logs for GDPR compliance.

Answer

1. Use the Vulnerability Explorer to manually prioritize CVEs. 2. Deploy Host Defenders on the on-premises databases. 3. Configure WAAS to block requests from untrusted sources. 4. Use the CIS benchmark for GDPR reporting.

Answer

1. Set the vulnerability alert threshold to 'Medium' in the CI policy. 2. Configure a CSPM policy to check ExpressRoute encryption settings. 3. Use Kubernetes Admission Control to block untrusted images. 4. Generate a custom report using the API for GDPR.

Question 6

A financial services company has deployed Prisma Cloud to monitor its AWS environment. A security architect needs to create a custom policy to detect any S3 bucket that is publicly accessible but does NOT have a 'data-classification' tag with the value 'public'. Which RQL query correctly identifies these non-compliant S3 buckets?

Accepted Answer

config from cloud.resource where api.name = 'aws-s3-bucket-list' and json.rule = 'publicAccess = true and (tag.data-classification != \'public\' or tag.data-classification is not defined)'

Answer

config from cloud.resource where api.name = 'aws-s3-bucket-policy-status' AND json.rule = 'publicAccess is true' AND json.rule = 'tag.data-classification does not exist'

Answer

config from cloud.resource where api.name = 'aws-s3-bucket-public-access' AND json.rule = 'isPublic = true' OR ( tag.data-classification != 'public' )

Answer

config from cloud.resource where api.name = 'aws-s3-bucket-get' and json.rule = 'isPublic=true' and json.rule = 'tags contains data-classification:public NOT'

Question 7

A SecOps team is investigating a container runtime incident where an anomalous process, `kdevtmpfsi`, was detected and blocked by a Host Defender. To perform forensic analysis, the team needs to find the original container image that was used to launch the compromised container. Which Prisma Cloud feature provides the most direct path to identify the source image for a specific runtime event?

Accepted Answer

Accessing the Incident Explorer for the specific runtime audit event, where the associated image name and ID are directly listed in the incident details.

Answer

Querying the Asset Explorer for all running containers and manually matching the container ID.

Answer

Navigating to Monitor > Events, selecting the specific Host Log Inspection event, and viewing the event details.

Answer

Using the Radar view to visualize the container and clicking through to its scan report.

Question 8

A DevOps team is using a Jenkins pipeline to build and push container images to a private registry. They need to configure a step that fails the build if the image contains any vulnerabilities with a CVSS score of 9.0 or higher, or if it uses a package with a non-compliant license such as GPL-3.0. Which `twistcli` command structure correctly implements these dual conditions?

Accepted Answer

twistcli images scan --address --user --password --vulnerability-threshold critical --compliance-threshold high myapp:latest

Answer

twistcli images scan --address --user --password --compliance-threshold critical --vulnerability-threshold critical myapp:latest

Answer

twistcli images scan --address --user --password --details --vulnerability-threshold critical --block-non-compliant-license myapp:latest

Answer

twistcli images scan --address --user --password --fail-on-cvss 9.0 --fail-on-license GPL-3.0 myapp:latest

Question 9

A cloud administrator is configuring a Prisma Cloud Enterprise tenant and needs to integrate it with an external SAML 2.0 Identity Provider (IdP) for Single Sign-On (SSO). The IdP requires a unique identifier for the Service Provider (SP), which is Prisma Cloud in this case. Where in the Prisma Cloud console can the administrator find the 'Audience URI (SP Entity ID)' required by the IdP?

Accepted Answer

Settings > Enterprise Settings > SSO, within the 'Service Provider Details' section after enabling SSO.

Answer

In the Audit Logs after the first failed login attempt.

Answer

Manage > Authentication > SSO Configuration, under the 'Metadata' tab.

Answer

It is not available in the console and must be constructed manually using the tenant URL.

Question 10

A security team is deploying Prisma Cloud WAAS to protect a web application running on a Kubernetes cluster. They want to prevent common injection attacks. Which of the following WAAS features should be configured to achieve this? (Select TWO)

Accepted Answer

App Firewall

Accepted Answer

API Security

Answer

DoS Protection

Answer

Runtime Protection

PCCSE Prisma Certified Cloud Security Engineer Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams