Which statement is true regarding CloudFormation templates?
Answer(s): A
CloudFormation templates, used to describe and provision all the infrastructure resources in cloud environments, support various elements including resources, mappings, parameters, and outputs. However, scan support for CloudFormation templates does not currently exist for nested references, macros, or intrinsic functions (option A). These advanced CloudFormation features can introduce complexity in scanning and interpreting the templates accurately for security and compliance checks.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-devops- security/use-the-prisma-cloud-iac-scan-rest-api.html
A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time.What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)
Answer(s): A,E
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/upgrade/upgrade_process_saas After the Console has been upgraded, check and upgrade any of the Defenders that have reached the end of their support lifecycle (Defenders are backward compatible for N-2 releases). The Defender release image is built from the UBI8-minimal base image and on upgrade it is a full container image upgrade, which means that the old Defender container is replaced with a new container. Then, upgrade all other Prisma Cloud components, such as the Jenkins plugin.
An administrator sees that a runtime audit has been generated for a Container. The audit message is “DNS resolution of suspicious name wikipedia.com. type A”.Why would this message appear as an audit?
The runtime audit message indicating "DNS resolution of suspicious name wikipedia.com. type A" would appear as an audit because the DNS was not learned as part of the Container model or added to the DNS allow list (option A). In cloud security platforms like Prisma Cloud, runtime protection policies monitor the behavior of running containers and compare it against a learned model of expected behavior. If a container attempts to resolve a DNS name that was not observed during the learning phase or specifically allowed, it triggers an audit event to alert security teams of potentially malicious activity.
Which “kind” of Kubernetes object is configured to ensure that Defender is acting as the admission controller?
Answer(s): C
In the context of Kubernetes, an admission controller is a piece of code that intercepts requests to the Kubernetes API server before the persistence of the object, but after the request is authenticated and authorized. The admission controller lets you apply complex validation and policy controls to objects before they are created or updated.The ValidatingWebhookConfiguration is a Kubernetes object that tells the API server to send an admission validation request to a service (the admission webhook) when a request to create, update, or delete a Kubernetes object matches the rules defined in the configuration. The webhook can then approve or deny the request based on custom logic.The MutatingWebhookConfiguration is similar but is used to modify objects before they are created or updated, which is not the primary function of an admission controller acting in a protective or validating capacity.DestinationRules are related to Istio service mesh and are not relevant to Kubernetes admission control.PodSecurityPolicies (PSPs) are a type of admission controller in Kubernetes but they are predefined by Kubernetes and do not require a specific configuration object like ValidatingWebhookConfiguration. PSPs are also deprecated in recent versions of Kubernetes.Therefore, the correct answer is C. ValidatingWebhookConfiguration, as it is the Kubernetes object used to configure admission webhooks for validating requests, which aligns with the role of Defender acting as an admission controller in Prisma Cloud.Reference from the provided documents:The documents uploaded do not contain specific details about Kubernetes objects or Prisma Cloud's integration with Kubernetes. However, this explanation aligns with general Kubernetes practices and Prisma Cloud's capabilities in securing Kubernetes environments.
https://docs.paloaltonetworks.com/prisma/prisma-cloud/21-04/prisma-cloud-compute-edition- admin/access_control/open_policy_agent.html
Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)
Answer(s): A,C,D
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/continuous_integration/set_policy_ci_plugins
Post your Comments and Discuss Palo Alto Networks CloudSec-Pro exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CloudSec-Pro content, but please register or login to continue.