PSE-PrismaCloud PSE Palo Alto Networks System Engineer Professional - Prisma Cloud Questions and Answers

Azure SQL database instances

Google Kubernetes Engine

Oracle Functions service

Kubernetes DaemonSet

Policy rule order has little impact on optimization.

Prisma Cloud scans images in all containers immediately upon policy activation.

The default vulnerability policy rule has an alert threshold to critical.

Prisma Cloud ships all vulnerability policy with a default alert for containers, hosts, and serverless functions.

CloudFormation is a procedural configuration management tool.

CloudFormation templates can be used on both Amazon Web Services and Microsoft Azure

CloudFormation templates can be written in JSON or YAML

CloudFormation is a declarative orchestration tool.

issue yum update command on an instance inside Amazon Web Services

Microsoft Windows inside Azure requesting a security patch

web server inside Amazon Web Services receiving web requests from internet

issue apt-get install command on an instance inside Amazon Web Services

outgoing Prisma Public Cloud API calls

Palo Alto Networks provides full support if a valid support license is in place.

Support for the templates is available through Professional Services from Palo Alto Networks.

Unless otherwise noted, these templates are released under an as-is. best effort support policy.

The author of the template provides full support as long as the PAN-OS version specific to the template is supported.

config where api.name = 'azure-vm-list' AND json.rule = powerState = "off'

config where api.name = 'azure-vm-list' AND json.rule = powerState does not contain "running"

config where api.name = 'azure-vm-list' AND json.rule = powerState = "running"

config where api.name = 'azure-vm-list' AND json.rule = powerState contains "running"

Microsoft Azure

Alibaba Cloud

Amazon Web Services

Oracle Cloud

Azure Application Insight

Resource Group

Azure Security Center

Bootstrapping

ARM Template

local scripts to public cloud APIs

remote function calls to host agents

third-party integration tools

public cloud CLI commands

Cloud Security Posture Management

Cloud Identity Security

Cloud Network Security

Cloud Code Security

Both Source and Destination Checks are disabled

Both Source and Destination Checks are enabled

Source Check is disabled and Destination Check is enabled

Source Check is enabled and Destination Check is disabled

Override the value and commit the configuration.

Clone the existing policy and change the value.

Manually create the RQL statement.

Click the Gear icon next to the policy name to open the Edit Policy dialog

AWS CDN

AWS NAT Gateway

AWS ALB

AWS NLB

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = is TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list' = TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list* and json.rule == status TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = status contains TERMINATED

If options are listed after the image name; they will be ignored.

If option "--user" is used, it is mandatory to use option "--password.

If option "--address" is unspecified, all images are scanned.

Option "--output-file" cannot be used in conjunction with option "--details."

The thresholds can be set to informational, low, medium, high, and critical.

The alert threshold always has precedence over, and can be greater than, the block threshold.

The block threshold must always be equal to or greater than the alert threshold.

The block threshold always has precedence over, and can be less than, the alert threshold.

config from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = storageEncrypted is false

event from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

config from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = publiclyAccessible is true

Google Cloud Platform

Microsoft Azure

Oracle Cloud

Amazon Web Services

Monitor > Compliance > Trusted Images

Monitor > Compliance > Images

Defend > Compliance > Trusted Images

Defend > Compliance > Images

10.0.1.254

10.0.2.1

10.0.3.255

10.0.3.1

consistent controls from build time to runtime

prebuilt and customizable polices to detect data such as personally identifiable information (PII) in publicly exposed objects

support for multiple languages, runtimes and frameworks

continuous monitoring of all could resources for vulnerabilities, misconfigurations, and other threats

config

alert

event

data

set system setting mgmt-interface-swap enable yes

set mgmt-interface settings swap yes

set mgmt-interface swap yes

set system setting mgmt-interface swap yes

Conservative

Moderate

High

Aggressive

General Data Protection Regulation (GDPR)

International Organization for Standardization (ISO) 27001

Payment Card Industry (PCI) Data Security Standard (DSS) 3.0

EU Data Protection Directive 95/46/EC

CloudLog

CloudEvent

CloudWatch

CIoudTrail

*.acme.com

acme/*

acme.com/myrepo/allimages:/*

registry.acme.com/*

Changes will take effect after a new learning phase of 30 days.

System will perform a reboot, deleting all past alerts.

Existing alerts and new alerts are regenerated based on the new setting.

New alerts are generated based on the new setting.

self-managed in a customer's own container platform

self-contained hardware appliance

as a stand-alone Windows application

Cloud-hosted as part of a Prisma Cloud Enterprise tenant from Palo Alto Networks

An AutoFocus license is included in Prisma Cloud.

For multi-cloud environment licenses are required for the number of Prisma Cloud instances.

Can be natively integrated into Prisma Access.

No agents or proxies are required.

VM-100 BYOL on Microsoft Azure to VM-100 BYOL on Amazon Web Services

VM-300 BYOL on Microsoft Azure to VM-300 PAY6 on Amazon Web Services

VM-100 BYOL on Microsoft Azure to VM-300 BYOL on Microsoft Azure

VM-100 BYOL on Microsoft Azure to VM-300 PAYG on Amazon Web Services