PCCSE Sample Questions for Prisma Cloud Security Certification Exam

Get exam-ready for the Prisma Certified Cloud Security Engineer (PCCSE) credential with this expertly curated set of sample questions and practice tests. Covering cloud architecture, compliance, threat detection, and data protection, these PCCSE Certification Sample Questions are tailored to mimic real exam patterns and complexities. Whether you're looking for updated dumps, scenario-based practice tests, or hands-on exercises, this preparation material supports your journey toward PCCSE certification. Ideal for security engineers, DevSecOps professionals, and cloud architects, this guide will boost your confidence and help you succeed on exam day.

PCCSE Sample Questions List :

1. What are the subtypes of configuration policies in Prisma Cloud?

1. Security and Compliance

2. Build and Deploy

3. Build and Run

4. Monitor and Analyze

2. Which data storage type is supported by Prisma Cloud Data Security?

1. IBM Cloud Object Storage

2. AWS S3 buckets

3. Oracle Object Storage

4. Google storage class

3. Which three public cloud providers are supported for VM image scanning? (Choose three.)

1. GCP

2. Alibaba

3. Oracle

4. AWS

5. Azure

4. An administrator needs to detect and alert on any activities performed by a root account. Which policy type should be used?

1. config-run

2. config-build

3. network

4. audit event

5. The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely. Which strategy should the administrator use to achieve this goal?

1. Disable the policy

2. Set the Alert Disposition to Conservative

3. Change the Training Threshold to Low

4. Set Alert Disposition to Aggressive

6. The security team wants to protect a web application container from an SQLi attack. Which type of policy should the administrator create to protect the container?

1. CNAF

2. Runtime

3. Compliance

4. CNNF

7. An administrator has deployed Console into a Kubernetes cluster running in AWS. The administrator also has configured a load balancer in TCP passthrough mode to listen on the same ports as the default Prisma Compute Console configuration. In the build pipeline, the administrator wants twistcli to talk to Console over HTTPS. Which port will twistcli need to use to access the Prisma Compute APIs?

1. 8084

2. 443

3. 8083

4. 8081

8. What is the correct method for ensuring key-sensitive data related to SSNs and credit card numbers cannot be viewed in Dashboard > Data view during investigations?

1. Go to Settings > Data > Snippet Masking and select Full Mask

2. Go to Settings > Data > Data Patterns, search for SSN Pattern, edit it, and modify the proximity keywords

3. Go to Settings > Cloud Accounts > Edit Cloud Account > Assign Account Group and select a group with limited permissions

4. Go to Policies > Data > Clone > Modify Objects containing Financial Information publicly exposed and change the file exposure to Private

9. When configuring SSO how many IdP providers can be enabled for all the cloud accounts monitored by Prisma Cloud?

1. 2

2. 4

3. 1

4. 3

10. Which two attributes of policies can be fetched using API? (Choose two.)

1. policy label

2. policy signature

3. policy mode

4. policy violation

11. Which three options are selectable in a CI policy for image scanning with Jenkins or twistcli? (Choose three.)

1. Scope - Scans run on a particular host

2. Credential

3. Apply rule only when vendor fixes are available

4. Failure threshold

5. Grace Period

12. What is the most reliable and extensive source for documentation on Prisma Cloud APIs?

1. prisma.pan.dev

2. docs.paloaltonetworks.com

3. Prisma Cloud Administrator’s Guide

4. Live Community

13. Which three AWS policy types and identities are used to calculate the net effective permissions? (Choose three.)

1. AWS IAM group

2. AWS IAM role

3. AWS service control policies (SCPs)

4. AWS IAM tag policy

5. AWS IAM User

14. What will happen when a Prisma Cloud Administrator has configured agentless scanning in an environment that also has Host and Container Defenders deployed?

1. Agentless scan will automatically be disabled, so Defender scans are the only scans occurring

2. Agentless scans do not conflict with Defender scans, so both will run

3. Defender scans will automatically be disabled, so agentless scans are the only scans occurring

4. Both agentless and Defender scans will be disabled and an error message will be received

15. Where are Top Critical CVEs for deployed images found?

1. Defend → Vulnerabilities → Code Repositories

2. Defend → Vulnerabilities → Images

3. Monitor → Vulnerabilities → Vulnerabilities Explorer

4. Monitor → Vulnerabilities → Images

16. Which two statements apply to the Defender type Container Defender - Linux?

1. It is implemented as runtime protection in the userspace

2. It is deployed as a service

3. It is deployed as a container

4. It is incapable of filesystem runtime defense

17. An administrator has a requirement to ingest all Console and Defender logs to Splunk. Which option will satisfy this requirement in Prisma Cloud Compute?

1. Enable the API settings for logging

2. Enable the CSV export in the Console

3. Enable the syslog option in the Console

4. Enable the Splunk option in the Console

18. An administrator has access to a Prisma Cloud Enterprise. What are the steps to deploy a single container Defender on an ec2 node?

1. Pull the Defender image to the ec2 node, copy and execute the curl | bash script, and start the Defender to ensure it is running

2. Execute the curl | bash script on the ec2 node

3. Configure the cloud credential in the console and allow cloud discovery to auto-protect the ec2 node

4. Generate DaemonSet file and apply DaemonSet to the twistlock namespace

19. You have onboarded a public cloud account into Prisma Cloud Enterprise. Configuration Resource ingestion is visible in the Asset Inventory for the onboarded account, but no alerts are being generated for the configuration assets in the account. Config policies are enabled in the Prisma Cloud Enterprise tenant, with those policies associated to existing alert rules. ROL statements on the investigate matching those policies return config resource results successfully. Why are no alerts being generated?

1. The public cloud account is not associated with an alert notification

2. The public cloud account does not have audit trail ingestion enabled

3. The public cloud account does not access to configuration resources

4. The public cloud account is not associated with an alert rule

20. What is the default namespace created by Defender DaemonSet during deployment?

1. Redlock

2. Defender

3. Twistlock

4. Default

21. You are an existing customer of Prisma Cloud Enterprise. You want to onboard a public cloud account and immediately see all of the alerts associated with this account based off ALL of your tenant's existing enabled policies. There is no requirement to send alerts from this account to a downstream application at this time. Which option shows the steps required during the alert rule creation process to achieve this objective?

1. Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule Select "select all policies" checkbox as part of the alert rule Confirm the alert rule

2. Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule Select one or more policies checkbox as part of the alert rule Confirm the alert rule

3. Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule Select one or more policies as part of the alert rule Add alert notifications Confirm the alert rule

4. Ensure the public cloud account is assigned to an account group Assign the confirmed account group to alert rule Select "select all policies" checkbox as part of the alert rule Add alert notifications Confirm the alert rule

22. What is an automatically correlated set of individual events generated by the firewall and runtime sensors to identify unfolding attacks?

1. policy

2. incident

3. audit

4. anomaly

23. A Prisma Cloud administrator is tasked with pulling a report via API. The Prisma Cloud tenant is located on app2.prismacloud.io. What is the correct API endpoint?

1. https://api.prismacloud.io

2. https://api2.eu.prismacloud.io

3. httsp://api.prismacloud.cn

4. https://api2.prismacloud.io

24. Which two CI/CD plugins are supported by Prisma Cloud as part of its Code Security? (Choose two.)

1. Checkov

2. Visual Studio Code

3. CircleCI

4. IntelliJ

25. A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time. What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)

1. manual installation of the latest twistcli tool prior to the rolling upgrade

2. all Defenders set in read-only mode before execution of the rolling upgrade

3. a second location where you can install the Console

4. additional workload licenses are required to perform the rolling upgrade

5. an existing Console at version n-1

26. Which of the following is not a supported external integration for receiving Prisma Cloud Code Security notifications?

1. ServiceNow

2. Splunk

3. Microsoft Teams

4. Cortex XSOAR

27. What is the behavior of Defenders when the Console is unreachable during upgrades?

1. Defenders continue to alert, but not enforce, using the policies and settings most recently cached before upgrading the Console

2. Defenders will fail closed until the web-socket can be re-established

3. Defenders will fail open until the web-socket can be re-established

4. Defenders continue to alert and enforce using the policies and settings most recently cached before upgrading the Console

28. The compliance team needs to associate Prisma Cloud policies with compliance frameworks. Which option should the team select to perform this task?

1. Custom Compliance

2. Policies

3. Compliance

4. Alert Rules

29. What are two ways to scan container images in Jenkins pipelines? (Choose two.)

1. twistcli

2. Jenkins Docker plugin

3. Compute Jenkins plugin

4. Prisma Cloud Visual Studio Code plugin with Jenkins integration

30. Which step is included when configuring Kubernetes to use Prisma Cloud Compute as an admission controller?

1. copy the Console address and set the config map for the default namespace

2. create a new namespace in Kubernetes called admission-controller

3. enable Kubernetes auditing from the Defend > Access > Kubernetes page in the Console

4. copy the admission controller configuration from the Console and apply it to Kubernetes

31. An organization wants to be notified immediately to any `High Severity` alerts for the account group `Clinical Trials` via Slack. Which option shows the steps the organization can use to achieve this goal?

1. 1. Configure Slack Integration 2. Create an alert rule and select "Clinical Trials" as the account group 3. Under the "Select Policies" tab, filter on severity and select "High" 4. Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to "As it Happens"

2. 1. Create an alert rule and select "Clinical Trials" as the account group 2. Under the "Select Policies" tab, filter on severity and select "High" 3. Under the Set Alert Notification tab, choose Slack and populate the channel 4. Set Frequency to "As it Happens" 5. Set up the Slack Integration to complete the configuration

3. 1. Configure Slack Integration 2. Create an alert rule 3. Under the "Select Policies" tab, filter on severity and select "High" 4. Under the Set Alert Notification tab, choose Slack and populate the channel 5. Set Frequency to "As it Happens"

4. 1. Under the "Select Policies" tab, filter on severity and select "High" 2. Under the Set Alert Notification tab, choose Slack and populate the channel 3. Set Frequency to "As it Happens" 4. Configure Slack Integration 5. Create an Alert rule

32. Which of the following are correct statements regarding the use of access keys? (Choose two.)

1. Access keys must have an expiration date

2. Up to two access keys can be active at any time

3. System Admin can create access key for all users

4. Access keys are used for API calls

33. A security team has a requirement to ensure the environment is scanned for vulnerabilities. What are three options for configuring vulnerability policies? (Choose three.)

1. individual actions based on package type

2. output verbosity for blocked requests

3. apply policy only when vendor fix is available

4. individual grace periods for each severity level

5. customize message on blocked requests

34. A Prisma Cloud administrator is onboarding a single GCP project to Prisma Cloud. Which two steps can be performed by the Terraform script? (Choose two.)

1. enable flow logs for Prisma Cloud

2. create the Prisma Cloud role

3. enable the required APIs for Prisma Cloud

4. publish the flow log to a storage bucket

35. Which three actions are available for the container image scanning compliance rule? (Choose three.)

1. Allow

2. Snooze

3. Block

4. Ignore

5. Alert

36. A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying. How should the customer automate vulnerability scanning for images deployed to Fargate?

1. Set up a vulnerability scanner on the registry

2. Embed a Fargate Defender to automatically scan for vulnerabilities

3. Designate a Fargate Defender to serve a dedicated image scanner

4. Use Cloud Compliance to identify misconfigured AWS accounts

37. If you are required to run in an air-gapped environment, which product should you install?

1. Prisma Cloud Jenkins Plugin

2. Prisma Cloud Compute Edition

3. Prisma Cloud with self-hosted plugin

4. Prisma Cloud Enterprise Edition

38. Which intensity setting for anomaly alerts is used for the measurement of 100 events over 30 days?

1. High

2. Medium

3. Low

4. Very High

39. An administrator wants to enforce a rate limit for users not being able to post five (5) .tar.gz files within five (5) seconds. What does the administrator need to configure?

1. A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on WAAS

2. A ban for DoS protection with a burst rate of 5 and file extensions match on .tar.gz on CNNF

3. A ban for DoS protection with a burst rate of 5 and file extensions match on .tar gz on WAAS

4. A ban for DoS protection with an average rate of 5 and file extensions match on .tar.gz on CNNF

40. What is required for Prisma Cloud to successfully execute auto-remediation commands?

1. Access to the cloud platform only for Azure

2. Write access to the cloud platform

3. Read access to the cloud platform

4. Prisma Cloud requires no access to the cloud platform

41. Which two options may be used to upgrade the Defenders with a Console v20.04 and Kubernetes deployment? (Choose two.)

1. Run the provided curl | bash script from Console to remove Defenders, and then use Cloud Discovery to automatically redeploy Defenders

2. Remove Defenders DaemonSet, and then use Cloud Discovery to automatically redeploy the Defenders

3. Remove Defenders, and then deploy the new DaemonSet so Defenders do not have to automatically update on each deployment

4. Let Defenders automatically upgrade

42. Prisma Cloud Compute has been installed on Onebox. After Prisma Cloud Console has been accessed. Defender is disconnected and keeps returning the error "No console connectivity" in the logs. What could be causing the disconnection between Console and Defender in this scenario?

1. Port 8083 is not open for Console and Defender communication

2. The license key provided to the Console is invalid

3. Onebox script installed an older version of the Defender

4. Port 8084 is not open for Console and Defender communication

43. A customer has a requirement to terminate any Container from image topSecret:latest when a process named ransomWare is executed. How should the administrator configure Prisma Cloud Compute to satisfy this requirement?

1. set the Container model to manual relearn and set the default runtime rule to block for process protection

2. set the Container model to relearn and set the default runtime rule to prevent for process protection

3. add a new runtime policy targeted at a specific Container name, add ransomWare process into the denied process list, and set the action to "prevent"

4. choose "copy into rule" for the Container, add a ransomWare process into the denied process list, and set the action to "block"

44. An administrator wants to retrieve the compliance policies for images scanned in a continuous integration (CI) pipeline. Which endpoint will successfully execute to enable access to the images via API?

1. GET /api/v22.01/policies/compliance

2. GET /api/v22.01/policies/compliance/ci

3. GET /api/v22.01/policies/compliance/ci/images

4. GET /api/v22.01/policies/compliance/ci/serverless

45. Which two statements explain differences between build and run config policies? (Choose two.)

1. Run and Network policies belong to the configuration policy set

2. Build policies allow checking for security misconfigurations in the IaC templates and ensure these issues do not get into production

3. Run policies monitor network activities in the environment and check for potential issues during runtime

4. Run policies monitor resources and check for potential issues after these cloud resources are deployed

46. Which Defender type performs registry scanning?

1. Serverless

2. Container

3. Host

4. RASP

47. Which data security default policy is able to scan for vulnerabilities?

1. Objects containing Vulnerabilities

2. Objects containing Threats

3. Objects containing Malware

4. Objects containing Exploits

48. Given an existing ECS Cluster, which option shows the steps required to install the Console in Amazon ECS?

1. The console cannot natively run in an ECS cluster. A onebox deployment should be used

2. Download and extract the release tarball Ensure that each node has its own storage for Console data Create the Console task definition Deploy the task definition

3. Download and extract release tarball Download task from AWS Create the Console task definition Deploy the task definition

4. Download and extract the release tarball Create an EFS file system and mount to each node in the cluster Create the Console task definition Deploy the task definition

49. An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy `AWS S3 buckets are accessible to public`. The policy definition follows: config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist" Why did this alert get generated?

1. an event within the cloud account

2. network traffic to the S3 bucket

3. configuration of the S3 bucket

4. anomalous behaviors

50. Which of the following is displayed in the asset inventory?

1. EC2 instances

2. Asset tags

3. SSO users

4. Federated users

51. Creation of a new custom compliance standard that is based on other individual custom compliance standards needs to be automated. Assuming the necessary data from other standards has been collected, which API order should be used for this new compliance standard?

1. 1) https://api.prismacloud.io/compliance/add 2) https://api.prismacloud.io/compliance/requirementld/section 3) https://api.prismacloud.io/compliance/complianceld/requirement

2. 1) https://api.prismacloud.io/compliance 2) https://api.prismacloud.io/compliance/complianceld/requirement 3) https://api.prismacloud.io/compliance/requirementld/section

3. 1) https://api.prismacloud.io/compliance/add 2) https://api.prismacloud.io/compliance/complianceld/requirement 3) https://api.prismacloud.io/compliance/requirementld/section

4. 1) https://api.prismacloud.io/compliance 2) https://api.prismacloud.io/compliance/requirementld/section 3) https://api.prismacloud.io/compliance/complianceld/requirement

52. A customer has Prisma Cloud Enterprise and host Defenders deployed. What are two options that allow an administrator to upgrade Defenders? (Choose two.)

1. with auto-upgrade, the host Defender will auto-upgrade

2. auto deploy the Lambda Defender

3. click the update button in the web-interface

4. generate a new DaemonSet file

53. Which two IDE plugins are supported by Prisma Cloud as part of its DevOps Security? (Choose two.)

1. BitBucket

2. Visual Studio Code

3. CircleCI

4. IntelliJ

54. Which resources can be added in scope while creating a vulnerability policy for continuous integration?

1. Images and cluster

2. Images and labels

3. Images and containers

4. Labels and AccountID

55. Which options show the steps required after upgrade of Console?

1. Uninstall Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable Allow the Console to redeploy the Defender

2. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Uninstall Defenders

3. Upgrade Defenders Upgrade Jenkins Plugin Upgrade twistcli where applicable

4. Update the Console image in the Twistlock hosted registry Update the Defender image in the Twistlock hosted registry Redeploy Console

56. A security team is deploying Cloud Native Application Firewall (CNAF) on a containerized web application. The application is running an NGINX container. The container is listening on port 8080 and is mapped to host port 80. Which port should the team specify in the CNAF rule to protect the application?

1. 443

2. 80

3. 8080

4. 8888

57. A customer wants to monitor the company’s AWS accounts via Prisma Cloud, but only needs the resource configuration to be monitored for now. Which two pieces of information do you need to onboard this account? (Choose two.)

1. Cloudtrail

2. Subscription ID

3. Active Directory ID

4. External ID

5. Role ARN

58. The attempted bytes count displays?

1. traffic that is either denied by the security group or firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet

2. traffic that is either denied by the security group or firewall rules

3. traffic that is either denied by the firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet

4. traffic denied by the security group or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet

59. Which two services require external notifications to be enabled for policy violations in the Prisma Cloud environment? (Choose two.)

1. Splunk

2. QROC

3. SQS

4. Email

60. A manager informs the SOC that one or more RDS instances have been compromised and the SOC needs to make sure production RDS instances are NOT publicly accessible. Which action should the SOC take to follow security best practices?

1. Enable “AWS S3 bucket is publicly accessible” policy and manually remediate each alert

2. Enable “AWS RDS database instance is publicly accessible” policy and for each alert, check that it is a production instance, and then manually remediate

3. Enable “AWS S3 bucket is publicly accessible” policy and add policy to an auto-remediation alert rule

4. Enable “AWS RDS database instance is publicly accessible” policy and add policy to an auto-remediation alert rule

61. Which `kind` of Kubernetes object is configured to ensure that Defender is acting as the admission controller?

1. MutatingWebhookConfiguration

2. DestinationRules

3. ValidatingWebhookConfiguration

4. PodSecurityPolicies

62. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML. ✑ Console Address: $CONSOLE_ADDRESS ✑ Websocket Address: $WEBSOCKET_ADDRESS ✑ User: $ADMIN_USER Which command generates the YAML file for Defender install?

1. <PLATFORM>/twistcli defender \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS

2. <PLATFORM>/twistcli defender export kubernetes \ --address $WEBSOCKET_ADDRESS \ --user $ADMIN_USER \ --cluster-address $CONSOLE_ADDRESS

3. <PLATFORM>/twistcli defender YAML kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

4. <PLATFORM>/twistcli defender export kubernetes \ --address $CONSOLE_ADDRESS \ --user $ADMIN_USER \ --cluster-address $WEBSOCKET_ADDRESS

63. Which command should be used in the Prisma Cloud twistcli tool to scan the nginx:latest image for vulnerabilities and compliance issues?

1. $ twistcli images scan --console-address --user --password --output-file scan-results.json nginx:latest

2. $ twistcli images scan --address --user --password --details nginx:latest

3. $ twistcli images build --console-address --user --password --details nginx:latest

4. $ twistcli images scan --address --username --password --details nginx:latest

64. Where can a user submit an external new feature request?

1. Aha

2. Help Center

3. Support Portal

4. Feature Request

65. An administrator has added a Cloud account on Prisma Cloud and then deleted it. What will happen if the deleted account is added back on Prisma Cloud within a 24-hour period?

1. No alerts will be displayed

2. Existing alerts will be displayed again

3. New alerts will be generated

4. Existing alerts will be marked as resolved

66. A customer has Defenders connected to Prisma Cloud Enterprise. The Defenders are deployed as a DaemonSet in OpenShift. How should the administrator get a report of vulnerabilities on hosts?

1. Navigate to Monitor > Vulnerabilities > CVE Viewer

2. Navigate to Defend > Vulnerabilities > VM Images

3. Navigate to Defend > Vulnerabilities > Hosts

4. Navigate to Monitor > Vulnerabilities > Hosts

67. Which port should a security team use to pull data from Console's API?

1. 53

2. 25

3. 8084

4. 8083

68. During an initial deployment of Prisma Cloud Compute, the customer sees vulnerabilities in their environment. Which statement correctly describes the default vulnerability policy?

1. It blocks all containers that contain a vulnerability

2. It alerts on any container with more than three critical vulnerabilities

3. It blocks containers after 30 days if they contain a critical vulnerability

4. It alerts on all vulnerabilities, regardless of severity

69. Which resource and policy type are used to calculate AWS Net Effective Permissions? (Choose two.)

1. Service Linked Roles

2. Lambda Function

3. Amazon Resource Names (ARNs) using Wild Cards

4. AWS Service Control Policies (SCPs)

70. A DevOps lead reviewed some system logs and notices some odd behavior that could be a data exfiltration attempt. The DevOps lead only has access to vulnerability data in Prisma Cloud Compute, so the DevOps lead passes this information to SecOps. Which pages in Prisma Cloud Compute can the SecOps lead use to investigate the runtime aspects of this attack?

1. The SecOps lead should investigate the attack using Vulnerability Explorer and Runtime Radar

2. The SecOps lead should use Incident Explorer and Compliance Explorer

3. The SecOps lead should use the Incident Explorer page and Monitor > Events > Container Audits

4. The SecOps lead should review the vulnerability scans in the CI/CD process to determine blame

71. How does assigning an account group to an administrative user on Prisma Cloud help restrict access to resources?

1. It restricts access to all resources and data within the cloud account

2. It restricts access only to certain types of resources within the cloud account

3. It restricts access only to the resources and data that pertains to the cloud account(s) within an account group

4. It does not restrict access to any resources within the cloud account

72. A customer does not want alerts to be generated from network traffic that originates from trusted internal networks. Which setting should you use to meet this customer's request?

1. Trusted Login IP Addresses

2. Anomaly Trusted List

3. Trusted Alert IP Addresses

4. Enterprise Alert Disposition

73. An administrator for Prisma Cloud needs to obtain a graphical view to monitor all connections, including connections across hosts and connections to any configured network objects. Which setting does the administrator enable or configure to accomplish this task?

1. ADEM

2. WAAS Analytics

3. Telemetry

4. Cloud Native Network Firewall

5. Host Insight

74. In WAAS Access control file upload controls, which three file types are supported out of the box? (Choose three.)

1. Text

2. Images

3. Audio

4. Documents

5. Journal

75. Console is running in a Kubernetes cluster, and you need to deploy Defenders on nodes within this cluster. Which option shows the steps to deploy the Defenders in Kubernetes using the default Console service name?

1. From the deployment page in Console, choose pod name for Console identifier, generate DaemonSet file, and apply the DaemonSet to twistlock namespace

2. From the deployment page configure the cloud credential in Console and allow cloud discovery to auto-protect the Kubernetes nodes

3. From the deployment page in Console, choose twistlock-console for Console identifier, generate DaemonSet file, and apply DaemonSet to the twistlock namespace

4. From the deployment page in Console, choose twistlock-console for Console identifier, and run the curl | bash script on the master Kubernetes node

FAQs

1. What is the Prisma Certified Cloud Security Engineer (PCCSE) certification?

The PCCSE certification validates your expertise in securing cloud environments using Prisma Cloud by Palo Alto Networks, covering cloud security posture management, workload protection, and compliance.

2. How do I become a Prisma Certified Cloud Security Engineer?

To become PCCSE certified, you must pass the PCCSE exam, which assesses your ability to deploy, configure, and manage Prisma Cloud across multi-cloud environments.

3. What are the prerequisites for the Prisma Certified Cloud Security Engineer (PCCSE) exam?

There are no official prerequisites, but candidates should have knowledge of cloud platforms (AWS, Azure, GCP) and basic security principles.

4. How much does the Prisma PCCSE certification exam cost?

The PCCSE exam typically costs $175 USD, though prices may vary by region or currency.

5. What topics are covered in the Prisma Certified Cloud Security Engineer exam?

The exam covers Prisma Cloud architecture, compliance, identity security, threat detection, cloud workload protection, and incident response.

6. How difficult is the Prisma Certified Cloud Security Engineer (PCCSE) exam?

It’s considered intermediate to advanced, ideal for professionals experienced in cloud security and compliance management.

7. How long does it take to prepare for the PCCSE certification exam?

Preparation usually takes 4–8 weeks, depending on your experience with cloud security and Prisma Cloud.

8. How long is the PCCSE certification valid?

The PCCSE certification is valid for two years from the date of passing the exam.

9. What are the job opportunities after earning the Prisma Certified Cloud Security Engineer certification?

This certification qualifies you for roles like Cloud Security Engineer, DevSecOps Specialist, Security Architect, and Compliance Engineer.

10. What is the average salary of a Prisma Certified Cloud Security Engineer?

Professionals with PCCSE certification typically earn between $100,000 and $135,000 per year, depending on experience and location.