PSE-PrismaCloud PSE Palo Alto Networks System Engineer Professional - Prisma Cloud Questions and Answers

Generate a Center for Internet Security (CIS) compliance report and search for "Amazon RDS" policy violations.

View the alert data on the "Asset Inventory" dashboard and filter on "Amazon RDS.

Within the "Alerts" tab. filter on "Amazon RDS" as a service.

Create a custom Resource Query Language (RQL) configuration report.

network

audit

anomaly

config

platform as a service

infrastructure as a service

software as code

infrastructure as code

guaranteed proof of concept (POC) extensions beyond 30 days

native integration of network, endpoint, and cloud data to stop attacks

elimination of blind spots

proactive addressing of risks

It inspects the application program interface (API) call made to public cloud and blocks the change if a policy violation is found.

It makes changes after a policy violation has been identified in monitoring.

It locks all changes to public cloud infrastructure and stops any configuration changes without prior approval.

It uses machine learning (ML) to identify unusual changes to infrastructure.

Excessive login failures

Unusual user activity

Denial-of-service activity

Account hijacking attempts

Suspicious file activity

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'Google Bigtable Instance'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'cloudsql.googleapis.com'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'bigquery.googleapis.com'

event from cloud.audit_logs where cloud.type = 'gcp' AND cloud.service = 'dataproc.googleapis.com'

event where crud = 'delete’ AND subject = 'user1'

event where crud = 'delete'

event where crud = 'delete' AND subject = 'user1' AND cloud.type = 'aws'

event where subject = 'user1'

config from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = storageEncrypted is false

event from cloud.audit_logs where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

config from cloud.resource where api.name = 'aws-rds-describe-db-instances' AND json.rule = publiclyAccessible is true

config from cloud.resource where api.name = 'aws-ec2-describe-instances' AND json.rule = publiclyAccessible is true

Cloud Network Security

Cloud Security Posture Management

Cloud Identity Security

Cloud Workload Protection (CWP)

An AutoFocus license is included in Prisma Cloud.

For multi-cloud environment licenses are required for the number of Prisma Cloud instances.

Can be natively integrated into Prisma Access.

No agents or proxies are required.

number of alerts generated

number of accounts onboarded

number of monitored workloads

volume of flow logs consumed

source address translation

destination address translation

port address translation

source and destination address translation

Policy rule order has little impact on optimization.

Prisma Cloud scans images in all containers immediately upon policy activation.

The default vulnerability policy rule has an alert threshold to critical.

Prisma Cloud ships all vulnerability policy with a default alert for containers, hosts, and serverless functions.

Linux, macOS, and Windows

Windows only

Linux and Windows

Linux, macOS, PAN-OS, and Windows

run the PAN-OS CLI command: set system mgmt-interface-swap enable yes

run the PAN-OS CLI command: set system mgmt-interface-swap setting enable yes

create a bootstrap file that includes the mgmt-interface-swap command

in the Google Cloud Console Metadata Field, enter a key-value pair where mgmt-interface-swap is the key and enable is the value

Palo Alto Networks provides full support if a valid support license is in place.

Support for the templates is available through Professional Services from Palo Alto Networks.

Unless otherwise noted, these templates are released under an as-is. best effort support policy.

The author of the template provides full support as long as the PAN-OS version specific to the template is supported.

self-managed in a customer's own container platform

self-contained hardware appliance

as a stand-alone Windows application

Cloud-hosted as part of a Prisma Cloud Enterprise tenant from Palo Alto Networks

Low, Medium, and High

Low, Medium, High, and Critical

Informational, Low, Medium, and High

Low, Medium, High, Severe, and Critical

repo

trusted publisher

registry

base layer

Azure Resource Manager (ARM)

Hyper Text Markup Language (HTML)

GitHub

Terraform

Elastic Compute Cloud (EC2) instances

Network Address Translation (NAT) gateways

CloudFront distributions

Security groups

Google Cloud Platform

Microsoft Azure

Oracle Cloud

Amazon Web Services

Direct Connect

Fast Connect

IPsecVPN

ExpressRoute

Host and serverless rules support blocking, whereas container rules do not.

Rules explain the necessary actions when vulnerabilities are found in the resources of a customer environment.

Policies for containers, hosts, and serverless functions are not separate.

Rules are evaluated in an undefined order.

10.0.1.254

10.0.2.1

10.0.3.255

10.0.3.1

Generate a new Compliance Report.

Create compliance framework in a spreadsheet then import into Prisma Public Cloud.

From Compliance tab, clone a default framework and customize.

From Compliance tab > Compliance Standards, click "Add New."

issue yum update command on an instance inside Amazon Web Services

Microsoft Windows inside Azure requesting a security patch

web server inside Amazon Web Services receiving web requests from internet

issue apt-get install command on an instance inside Amazon Web Services

outgoing Prisma Public Cloud API calls

Config from.cloud.resource where api.name = „gcloud-compute-instance-list" and json.rule = status == TERMINATED

Config from.cloud.resource where api.name = „gcloud-compute-instance-list" and json.rule = TERMINATED

Config from.cloud.resource where api.name = „gcloud-compute-instance-list" and json.rule = status contains TERMINATED

Config from.cloud.resource where api.name = „gcloud-compute-instance-list" and json.rule = is TERMINATED

Allow Prisma Cloud to automatically optimize registry scans with version pattern matching.

Allow Prisma Cloud to automatically distribute the scan job across a pool of available Defenders.

Explicitly specify the Defender to do the job.

Explicitly specify the predefined version pattern-matching algorithm.

fully instrumented API

Aperture Orchestration Engine

VM Orchestration Policy Editor

support for Dynamic Address Groups