PSE-PrismaCloud Sample Questions Answers

Microsoft Azure

Alibaba Cloud

Oracle Cloud

Amazon Web Services

network where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))

network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))

network where dest.resource IN (resource where role = 'Database'}

network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))

Direct Connect

Fast Connect

IPsecVPN

ExpressRoute

Policy rule order has little impact on optimization.

Prisma Cloud scans images in all containers immediately upon policy activation.

The default vulnerability policy rule has an alert threshold to critical.

Prisma Cloud ships all vulnerability policy with a default alert for containers, hosts, and serverless functions.

10.0.1.254

10.0.2.1

10.0.3.255

10.0.3.1

HIPAA

CIS Benchmark

Payment Card Industry DSS V3

GDPR

Service project

Host project

Admin project

Subscribing project

audit from

network from

event from

config from

Monitor > Compliance > Trusted Images

Monitor > Compliance > Images

Defend > Compliance > Trusted Images

Defend > Compliance > Images

Host and serverless rules support blocking, whereas container rules do not.

Rules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

Policies for containers, hosts, and serverless functions are not separate.

Rules are evaluated in an undefined order.

It inspects the application program interface (API) call made to public cloud and blocks the change if a policy violation is found.

It makes changes after a policy violation has been identified in monitoring.

It locks all changes to public cloud infrastructure and stops any configuration changes without prior approval.

It uses machine learning (ML) to identify unusual changes to infrastructure.

repo

trusted publisher

registry

base layer

hose from

network from

system from

event from

The image will pass the CI policy, but will be blocked by the deployed policy; therefore, it will not be deployed.

The CI policy will fail the build; therefore, the image will not be deployed.

The image will be deployed successfully, and all vulnerabilities will be reported.

The image will be deployed successfully, but no vulnerabilities will be reported.

Shield

Inspector

GuardDuty

Amazon Web Services WAF

Override the value and commit the configuration.

Clone the existing policy and change the value.

Manually create the RQL statement.

Click the Gear icon next to the policy name to open the Edit Policy dialog

issue yum update command on an instance inside Amazon Web Services

Microsoft Windows inside Azure requesting a security patch

web server inside Amazon Web Services receiving web requests from internet

issue apt-get install command on an instance inside Amazon Web Services

outgoing Prisma Public Cloud API calls

Low

Thorough

High

Baseline

Linux, macOS, and Windows

Windows only

Linux and Windows

Linux, macOS, PAN-OS, and Windows

Excessive login failures

Unusual user activity

Denial-of-service activity

Account hijacking attempts

Suspicious file activity

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'Google Bigtable Instance'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'cloudsql.googleapis.com'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'bigquery.googleapis.com'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'dataproc.googleapis.com'

GDPR

EU Data Protection Directive 95/46/EC

ISO 27001

Payment Card Industry 3.0

set system setting mgmt-interface-swap enable yes

set mgmt-interface settings swap yes

set mgmt-interface swap yes

set system setting mgmt-interface swap yes

RQL queries

alert rules

notification templates

policies

network flow logs

list of all database instances' tables

metadata about compute resources' configuration

Cortex Data Lake

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = is TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list' = TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list* and json.rule == status TERMINATED

config from cloud.resource where api.name = 'gcloud-compute-instances-list' and json.rule = status contains TERMINATED

Low, Medium, and High

Low, Medium, High, and Critical

Informational, Low, Medium, and High

Low, Medium, High, Severe, and Critical

Both Source and Destination Checks are disabled

Both Source and Destination Checks are enabled

Source Check is disabled and Destination Check is enabled

Source Check is enabled and Destination Check is disabled

An AutoFocus license is included in Prisma Cloud.

For multi-cloud environment licenses are required for the number of Prisma Cloud instances.

Can be natively integrated into Prisma Access.

No agents or proxies are required.