QUESTION: 5

A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed.

How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

set the Container model to manual relearn and set the default runtime rule to block for process protection.
set the Container model to relearn and set the default runtime rule to prevent for process protection.
add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to "prevent".
choose "copy into rule" for the Container, add a ransomWare process into the denied process list, and set the action to "block".

Answer(s): C

Explanation:

To terminate any Container from the image "topSecret:latest" when a process named "ransomWare" is executed, the administrator should create a new runtime policy in Prisma Cloud Compute specifically targeting the container in question. By adding the "ransomWare" process to the denied process list within this policy and setting the action to "prevent," Prisma Cloud Compute will actively monitor for the execution of the specified process within the targeted container and take preventive action to terminate the container if the process is detected. This approach allows for precise, targeted security measures that address specific threats identified by the organization, thereby enhancing the overall security posture and protecting sensitive workloads from potential compromise.

Reveal Solution Next Question

QUESTION: 6

Which statement is true about obtaining Console images for Prisma Cloud Compute Edition?

To retrieve Prisma Cloud Console images using basic auth:
1. Access registry.paloaltonetworks.com, and authenticate using `docker login'.
2. Retrieve the Prisma Cloud Console images using `docker pull'.
To retrieve Prisma Cloud Console images using basic auth:
1. Access registry.twistlock.com, and authenticate using `docker login'.
2. Retrieve the Prisma Cloud Console images using `docker pull'.
To retrieve Prisma Cloud Console images using URL auth:
1. Access registry-url-auth.twistlock.com, and authenticate using the user certificate.
2. Retrieve the Prisma Cloud Console images using `docker pull'.
To retrieve Prisma Cloud Console images using URL auth:
1. Access registry-auth.twistlock.com, and authenticate using the user certificate.
2. Retrieve the Prisma Cloud Console images using `docker pull'.

Answer(s): A

Explanation:

Retrieving Prisma Cloud Console images involves accessing a specific registry provided by Palo Alto Networks and authenticating using basic authentication with 'docker login'. Once authenticated, the user can pull the Prisma Cloud Console images using the 'docker pull' command. This process is part of the initial setup for deploying Prisma Cloud Console in an environment, allowing users to obtain the necessary images to run the Console, which serves as the central management interface for Prisma Cloud. The detailed steps, including the specific registry URL and authentication method, are typically provided in the Prisma Cloud documentation, ensuring that users have the information needed to successfully retrieve and deploy Console images.

Reveal Solution Next Question

QUESTION: 7

Which two statements are true about the differences between build and run config policies? (Choose two.)

Run and Network policies belong to the configuration policy set.
Build and Audit Events policies belong to the configuration policy set.
Run policies monitor resources, and check for potential issues after these cloud resources are deployed.
Build policies enable you to check for security misconfigurations in the IaC templates and ensure that these issues do not get into production.
Run policies monitor network activities in your environment, and check for potential issues during runtime.

Answer(s): C,D

Explanation:

In the context of Prisma Cloud, Build and Run policies serve distinct purposes in securing cloud environments. Build policies are designed to evaluate Infrastructure as Code (IaC) templates before deployment. These policies help identify and remediate security misconfigurations in the development phase, ensuring that vulnerabilities are addressed before the infrastructure is provisioned. This proactive approach enhances security by preventing misconfigurations from reaching production environments.
On the other hand, Run policies are applied to resources that are already deployed in the cloud. These policies continuously monitor the cloud environment, detecting and alerting on potential security issues that arise in the runtime. Run policies help maintain the security posture of cloud resources by identifying deviations from established security baselines and enabling quick remediation of identified issues.
Both Build and Run policies are integral to a comprehensive cloud security strategy, addressing security concerns at different stages of the cloud resource lifecycle--from development and deployment to ongoing operation.

Reveal Solution Next Question

QUESTION: 8

A security team notices a number of anomalies under Monitor > Events. The incident response team works with the developers to determine that these anomalies are false positives.

What will be the effect if the security team chooses to Relearn on this image?

The model is deleted, and Defender will relearn for 24 hours.
The anomalies detected will automatically be added to the model.
The model is deleted and returns to the initial learning state.
The model is retained, and any new behavior observed during the new learning period will be added to the existing model.

Answer(s): D

Explanation:

In Prisma Cloud, when anomalies are detected and the security team chooses to Relearn on a specific image, the existing behavioral model for that image is not deleted. Instead, the system retains the model and enters a new learning period, during which it observes the behavior of the container based on the image. If new behaviors are observed during this period, they are added to the existing model, thereby refining and updating the model to reflect the current operational profile of the container. This approach allows for dynamic adaptation to changes in container behavior while preserving the valuable insights and patterns already established in the model. The Relearn function is part of Prisma Cloud's adaptive capabilities, enabling it to maintain accurate and up-to-date behavioral models that reflect the evolving nature of containerized applications.

Reveal Solution Next Question

Free PCCSE Exam Braindumps (page: 2)

QUESTION: 5

Explanation:

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation: