Weekend Special Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Question # 4

An administrator has deployed an AWS transit gateway and used multiple VPC spokes to segregate a multi-tier application. The administrator also created a security VPC with multiple VM-Series NGFWs in an active/active deployment model via ECMP using Amazon Web Services VPN-based attachments.

What must be configured on the firewall to avoid asymmetric routing?

A.

source address translation

B.

destination address translation

C.

port address translation

D.

source and destination address translation

Full Access
Question # 5

Which two resource types are included in the Prisma Cloud Enterprise licensing count? (Choose two.)

A.

Elastic Compute Cloud (EC2) instances

B.

Network Address Translation (NAT) gateways

C.

CloudFront distributions

D.

Security groups

Full Access
Question # 6

Which pillar of the Prisma Cloud platform provides support for both public and private clouds as well as flexible agentless scanning and agent-based protection?

A.

Cloud Network Security

B.

Cloud Security Posture Management

C.

Cloud Identity Security

D.

Cloud Workload Protection (CWP)

Full Access
Question # 7

All Amazon Regional Database Service (RDS)-deployed resources and the regions in which they are deployed can be identified by prisma Cloud using which two methods? (Choose two.)

A.

Configure an Inventory report from the "Alerts" tab.

B.

Write an RQL query from the "Investigate" tab.

C.

Open the Asset dashboard, filter on Amazon Web Services, and click "Amazon RDS" resources.

D.

Generate a compliance report from the Compliance dashboard.

Full Access
Question # 8

Which statement explains the correlation between the block and alert thresholds in a vulnerability management policy?

A.

The thresholds can be set to informational, low, medium, high, and critical.

B.

The alert threshold always has precedence over, and can be greater than, the block threshold.

C.

The block threshold must always be equal to or greater than the alert threshold.

D.

The block threshold always has precedence over, and can be less than, the alert threshold.

Full Access
Question # 9

How can you modify a range of dates default policy in Prisma Public Cloud?

A.

Override the value and commit the configuration.

B.

Clone the existing policy and change the value.

C.

Manually create the RQL statement.

D.

Click the Gear icon next to the policy name to open the Edit Policy dialog

Full Access
Question # 10

Which statement applies to vulnerability management policies?

A.

Host and serverless rules support blocking, whereas container rules do not.

B.

Rules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

C.

Policies for containers, hosts, and serverless functions are not separate.

D.

Rules are evaluated in an undefined order.

Full Access
Question # 11

An image containing medium vulnerabilities that do not have available fixes is being deployed into the sock-shop namespace. Prisma Cloud has been configured for vulnerability management within the organization's continuous integration (CI) tool and registry.

What will occur during the attempt to deploy this image from the CI tool into the sock-shop namespace?

A.

The image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not be deployed.

B.

The CI policy will fail the build; therefore, the image will not be deployed.

C.

The image will be deployed successfully, and all vulnerabilities will be reported.

D.

The image will be deployed successfully, but no vulnerabilities will be reported.

Full Access
Question # 12

Which configuration needs to be done to perform user entity behavior analysis with Prisma Public Cloud?

A.

Create alert rules.

B.

Whitelist IP addresses.

C.

Configure User-ID.

D.

Define enterprise settings.

Full Access
Question # 13

Which change represents a VM-Series NGFW license transfer?

A.

VM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

B.

VM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

C.

VM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

D.

VM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services

Full Access
Question # 14

Which statement applies to optimization of registry scans with version pattern matching?

A.

It requires Linux images to rely on optimizing registry scans due to various Linux elements.

B.

It is only necessary in registries with tens of thousands of repositories and millions of images.

C.

It is best practice to always optimize registry scans for faster results.

D.

It is rarely successful in the Windows Operating System (OS).

Full Access
Question # 15

Which two statements are true about CloudFormation? (Choose two.)

A.

CloudFormation is a procedural configuration management tool.

B.

CloudFormation templates can be used on both Amazon Web Services and Microsoft Azure

C.

CloudFormation templates can be written in JSON or YAML

D.

CloudFormation is a declarative orchestration tool.

Full Access
Question # 16

Which three features are not supported by VM-Series NGFWs on Azure Stack? (Choose three.)

A.

Azure Application Insight

B.

Resource Group

C.

Azure Security Center

D.

Bootstrapping

E.

ARM Template

Full Access
Question # 17

Which type of Resource Query Language (RQL) query is used to create a custom policy that looks for untagged resources?

A.

config

B.

alert

C.

event

D.

data

Full Access
Question # 18

What occurs with the command twistcli when scanning images?

A.

If options are listed after the image name; they will be ignored.

B.

If option "--user" is used, it is mandatory to use option "--password.

C.

If option "--address" is unspecified, all images are scanned.

D.

Option "--output-file" cannot be used in conjunction with option "--details."

Full Access
Question # 19

Which option is true about VM-Series NGFW templates available from the Palo Alto Networks GitHub repository?

A.

Palo Alto Networks provides full support if a valid support license is in place.

B.

Support for the templates is available through Professional Services from Palo Alto Networks.

C.

Unless otherwise noted, these templates are released under an as-is. best effort support policy.

D.

The author of the template provides full support as long as the PAN-OS version specific to the template is supported.

Full Access
Question # 20

Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?

A.

config where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification

B.

config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification

C.

config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists

D.

config where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1

Full Access
Question # 21

Prisma Public Cloud enables compliance monitoring and reporting by mapping which configurations to compliance standards?

A.

RQL queries

B.

alert rules

C.

notification templates

D.

policies

Full Access
Question # 22

Which two deployment methods are supported for Prisma Cloud Compute (PCC) container Defenders? (Choose two.)

A.

Azure SQL database instances

B.

Google Kubernetes Engine

C.

Oracle Functions service

D.

Kubernetes DaemonSet

Full Access
Question # 23

How does Prisma Cloud Enterprise autoremediate unwanted violations to public cloud infrastructure?

A.

It inspects the application program interface (API) call made to public cloud and blocks the change if a policy violation is found.

B.

It makes changes after a policy violation has been identified in monitoring.

C.

It locks all changes to public cloud infrastructure and stops any configuration changes without prior approval.

D.

It uses machine learning (ML) to identify unusual changes to infrastructure.

Full Access
Question # 24

Prevention against which type of attack is configurable in Web-Application and API Security (WAAS)?

A.

credential stuffing

B.

cross-site scripting (XSS)

C.

shoulder surfing

D.

distributed denial of service (DDoS)

Full Access
Question # 25

Which two actions are appropriate when configuring Prisma Cloud to scan a registry? (Choose two.)

A.

Allow Prisma Cloud to automatically optimize registry scans with version pattern matching.

B.

Allow Prisma Cloud to automatically distribute the scan job across a pool of available Defenders.

C.

Explicitly specify the Defender to do the job.

D.

Explicitly specify the predefined version pattern-matching algorithm.

Full Access
Question # 26

Which type of Prisma Cloud Enterprise alert supports autoremediation?

A.

network

B.

audit

C.

anomaly

D.

config

Full Access
Question # 27

In which two ways can Prisma Cloud Compute (PCC) edition be installed? (Choose two.)

A.

self-managed in a customer's own container platform

B.

self-contained hardware appliance

C.

as a stand-alone Windows application

D.

Cloud-hosted as part of a Prisma Cloud Enterprise tenant from Palo Alto Networks

Full Access
Question # 28

The Microsoft Azure virtual network gateway supports which two site-to-site connectivity options? (Choose two.)

A.

Direct Connect

B.

Fast Connect

C.

IPsecVPN

D.

ExpressRoute

Full Access
Question # 29

Which Resource Query Language (RQL) query returns a list of all Azure SQL Databases that have transparent data encryption turned in?

A.

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = is TERMINATED

B.

config from cloud.resource where api.name = 'gcloud-compute-instances-list' = TERMINATED

C.

config from cloud.resource where api.name = 'gcloud-compute-instances-list* and json.rule == status TERMINATED

D.

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = status contains TERMINATED

Full Access
Question # 30

What are two examples of Amazon Web Services logging services? (Choose two.)

A.

CloudLog

B.

CloudEvent

C.

CloudWatch

D.

CIoudTrail

Full Access
Question # 31

The VM-Series integration with Amazon GuardDuty feeds malicious IP addresses to the VM-Series NGFW using XML API to populate a Dynamic Address Group within a Security policy that blocks traffic.

How does Amazon Web Services achieve this integration?

A.

SNS

B.

SQS

C.

CodeDeploy

D.

Lambda

Full Access
Question # 32

Which three services can Google Cloud Security Scanner assess? (Choose three.)

A.

Google Kubernetes Engine

B.

BigQuery

C.

Compute Engine

D.

App Engine

E.

Google Virtual Private Cloud

Full Access
Question # 33

Where can rules be configured and viewed to configure trusted images?

A.

Monitor > Compliance > Trusted Images

B.

Monitor > Compliance > Images

C.

Defend > Compliance > Trusted Images

D.

Defend > Compliance > Images

Full Access
Question # 34

Which two elements does Prisma Cloud monitor when analyzing for unusual user activity? (Choose two.)

A.

Operating System (OS)

B.

browser

C.

location

D.

time

Full Access