[Q67-Q90] Accurate & Verified 2023 New PCCSE Answers As Experienced in the Actual Test!

Q67. A customer has configured the JIT, and the user created by the process is trying to log in to the Prisma Cloud console. The user encounters the following error message:

What is the reason for the error message?

Q68. You have onboarded a public cloud account into Prisma Cloud Enterprise. Configuration Resource ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account.
Config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully.
Why are no alerts being generated?

Q69. What is the behavior of Defenders when the Console is unreachable during upgrades?

Q70. Match the service on the right that evaluates each exposure type on the left.
(Select your answer from the pull-down list. Answers may be used more than once or not at all.)

Q71. A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?

Q72. Which three types of runtime rules can be created? (Choose three.)

Q73. Given the following RQL:
event from cloud.audit_logs where operation IN (‘CreateCryptoKey’, ‘DestroyCryptoKeyVersion’,
‘v1.compute.disks.createSnapshot’)
Which audit event snippet is identified?
A)

B)

C)

D)

Q74. Which options show the steps required after upgrade of Console?

Q75. The development team wants to fail CI jobs where a specific CVE is contained within the image. How should the development team configure the pipeline or policy to produce this outcome?

Q76. Which statement about build and run policies is true?

Q77. Which two fields are required to configure SSO in Prisma Cloud? (Choose two.)

Q78. Which categories does the Adoption Advisor use to measure adoption progress for Cloud Security Posture Management?

Q79. Which statement about build and run policies is true?

Q80. One of the resources on the network has triggered an alert for a Default Config policy.
Given the following resource JSON snippet:

Which RQL detected the vulnerability?
A)

B)

C)

D)

Q81. A customer has a requirement to automatically protect all Lambda functions with runtime protection. What is the process to automatically protect all the Lambda functions?

Q82. An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration.
In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS. Which port will twistcli need to use to access the Prisma Compute APIs?

Q83. A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying.
How should the customer automate vulnerability scanning for images deployed to Fargate?

Q84. Given the following RQL:

Which audit event snippet is identified by the RQL?
A)

B)

C)

D)

Q85. An administrator needs to write a script that automatically deactivates access keys that have not been used for
30 days.
In which order should the API calls be used to accomplish this task? (Drag the steps into the correct order from the first step to the last.) Select and Place:

Q86. What is the maximum number of access keys a user can generate in Prisma Cloud with a System Admin role?

Q87. A customer has a requirement to scan serverless functions for vulnerabilities. Which three settings are required to configure serverless scanning? (Choose three )

Q88. Which statement is true regarding CloudFormation templates?

Q89. How are the following categorized?
* Backdoor account access
* Hijacked processes
* Lateral movement
* Port scanning

Q90. Which component(s), if any will Palo Alto Networks host and run when a customer purchases Prisma Cloud Enterprise Edition?