PCCSE Exam Questions and Answers | Exam-Dumps (Page: 8)

QUESTION: 36

A security team has a requirement to ensure the environment is scanned for vulnerabilities.
What are three options for configuring vulnerability policies? (Choose three.)

individual actions based on package type
output verbosity for blocked requests
apply policy only when vendor fix is available
individual grace periods for each severity level
customize message on blocked requests

Answer(s): A,C,D

Explanation:

Configuring vulnerability policies within Prisma Cloud involves several options that cater to different aspects of vulnerability management and policy enforcement. Options A, C, and D are valid configurations for vulnerability policies:
A) Individual actions based on package type allow for tailored responses to vulnerabilities found in specific types of software packages, enabling more granular control over the remediation process. C) Applying policies only when a vendor fix is available helps prioritize the remediation of vulnerabilities for which a patch or update has been released by the software vendor, ensuring efficient use of resources in addressing the most actionable security issues. D) Setting individual grace periods for each severity level allows organizations to define different time frames for addressing vulnerabilities based on their severity, enabling a prioritized and risk- based approach to vulnerability management.
These configurations support a comprehensive vulnerability management strategy by allowing customization and prioritization based on the nature of the vulnerability, the availability of fixes, and the risk level associated with each vulnerability.

Reveal Solution Next Question

QUESTION: 37

The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?

Disable the policy
Set the Alert Disposition to Conservative
Change the Training Threshold to Low
Set Alert Disposition to Aggressive

Answer(s): B

Explanation:

To reduce the number of alerts generated by the "Unusual protocol activity (Internal)" network anomaly without entirely disabling the policy, setting the Alert Disposition to Conservative (option B) is the most effective strategy. This configuration adjusts the sensitivity of the anomaly detection, reducing the likelihood of false positives and minimizing alert fatigue without compromising the ability to detect genuine security threats. By adopting a more conservative approach to anomaly detection, the administrator can ensure that only the most significant and potentially harmful activities trigger alerts, thus maintaining a balance between security vigilance and operational efficiency.

Reveal Solution Next Question

QUESTION: 38

What is the behavior of Defenders when the Console is unreachable during upgrades?

Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console.
Defenders will fail closed until the web-socket can be re-established.
Defenders will fail open until the web-socket can be re-established.
Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console.

Answer(s): D

Explanation:

When the Console is unreachable during upgrades, Defenders continue to alert and enforce using the policies and settings most recently cached before the upgrade (option D). This behavior ensures that security enforcement remains active and consistent, even when the central management console is temporarily unavailable. The cached policies enable Defenders to maintain the security posture based on the last known configuration, ensuring continuous protection against threats and compliance with established security policies. This approach reflects Prisma Cloud's design principle of ensuring uninterrupted security enforcement, thereby safeguarding the environment against potential vulnerabilities during maintenance periods.

Reference:

https://docs.paloaltonetworks.com/prisma/prisma-cloud/20-09/prisma-cloud-compute- edition- admin/upgrade/upgrade_process.html

Reveal Solution Next Question

QUESTION: 39

How are the following categorized?
Backdoor account access Hijacked processes Lateral movement Port scanning

audits
incidents
admission controllers
models

Answer(s): B

Explanation:

The activities listed (Backdoor account access, Hijacked processes, Lateral movement, Port scanning) are categorized as incidents (option B). Incidents represent security events or patterns of activity that indicate potential security breaches or malicious behavior within the environment. Prisma Cloud identifies and classifies such activities as incidents to highlight significant security concerns that require investigation and potential remediation. This categorization helps security teams prioritize their response efforts, focusing on activities that pose a real threat to the integrity and security of the cloud environment. By distinguishing incidents from other types of security findings, Prisma Cloud enables more effective incident response and threat management processes.

Reveal Solution Next Question

QUESTION: 40

DRAG DROP (Drag and Drop is not supported)
An administrator needs to write a script that automatically deactivates access keys that have not been used for 30 days.

In which order should the API calls be used to accomplish this task? (Drag the steps into the correct order from the first step to the last.) Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

GET https://api.prismacloud.io/access_keys
PATCH https://api.prismacloud.io/access_keys/<id>/status/<status>
POST https://api.prismacloud.io/login

To write a script that automatically deactivates access keys that have not been used for 30 days, an administrator would need to follow an ordered sequence of API calls to the Prisma Cloud platform. The first API call must authenticate the script with the Prisma Cloud API, which is typically done using a POST request to the login endpoint. This step is necessary to establish a session and retrieve an authentication token required for subsequent API calls. Once the script is authenticated, the next call is a GET request to the access_keys endpoint. This retrieves a list of all access keys within the environment. The script can then parse through these keys to determine which ones have not been used within the specified timeframe of 30 days. For each access key that meets the criteria (unused for 30 days), the script must send a PATCH request to the specific access key's endpoint, which includes the access key ID and the desired status. This request will change the status of the access key to 'inactive' or a similar status that denotes deactivation.
Following this ordered sequence ensures that the script systematically authenticates, evaluates, and updates the status of access keys based on their usage, thereby maintaining security and compliance within the Prisma Cloud environment.

Reveal Solution Next Question

Palo Alto Networks PCCSE Exam (page: 8) Palo Alto Networks Prisma Certified Cloud Security Engineer Updated on: 12-Feb-2026

QUESTION: 36

Explanation:

QUESTION: 37

Explanation:

QUESTION: 38

Explanation:

Reference:

QUESTION: 39

Explanation:

QUESTION: 40

Explanation:

Palo Alto Networks PCCSE Exam (page: 8)
Palo Alto Networks Prisma Certified Cloud Security Engineer
Updated on: 12-Feb-2026