Free PCCSE sample questions

Correct answer: twistcli images scan --address --user --password --vulnerability-threshold critical --compliance-threshold high myapp:latest

This command correctly uses two separate flags to control the failure thresholds. `--vulnerability-threshold critical` fails the build for vulnerabilities with a CVSS score of 9.0-10.0 (critical). `--compliance-threshold high` fails the build for compliance issues, such as non-approved licenses, that are rated as high severity or above. This combination precisely meets the stated requirements.

Correct answer: Settings > Enterprise Settings > SSO, within the 'Service Provider Details' section after enabling SSO.

When configuring SSO in Prisma Cloud, the required Service Provider (SP) metadata is generated and displayed directly in the user interface. The administrator must navigate to Settings > Enterprise Settings, select the SSO tab, and enable it. The 'Audience URI (SP Entity ID)' and other necessary values like the 'Assertion Consumer Service (ACS) URL' will be presented there to be copied into the IdP configuration.

Correct answers: App Firewall; API Security

Correct answer: True

This is the primary function of a Kubernetes DaemonSet. It ensures that all (or a subset of) nodes run a copy of a pod. When a new node is added to the cluster, the DaemonSet controller automatically schedules a Defender pod on that node, ensuring continuous security coverage as the cluster scales.

Correct answer: Define a new custom data pattern using a Regular Expression (RegEx) that specifically matches the 10-digit NPI format and add keywords like 'NPI' and 'Provider ID' to increase confidence.

Prisma Cloud's Data Security module allows for the creation of custom data patterns to identify proprietary or specific data formats. Using a precise RegEx (e.g., `\b\d{10}\b`) to match the 10-digit structure, combined with proximity keywords, provides a highly accurate method for the classification engine to identify NPI numbers within files, significantly reducing false positives compared to generic patterns.

Correct answer: 1. Deploy Defenders. 2. Observe the network traffic flows in the Radar view. 3. Use the 'Auto-generate policies' feature to create a baseline. 4. Review, refine, and enforce the generated policies.

This sequence follows the recommended best practice for implementing microsegmentation. First, Defenders must be deployed to collect network data. Second, the system observes actual traffic to understand legitimate communication patterns, which are visualized in the Radar. Third, Prisma Cloud can automatically generate policy recommendations based on this observed traffic. Finally, the engineer must review these recommendations, fine-tune them as needed (e.g., removing unnecessary connections), and then enforce them to lock down communication.

Correct answer: Prisma Cloud Account Groups assigned to a custom role.

Prisma Cloud's RBAC model allows administrators to create Account Groups, which can be defined based on criteria like AWS OUs, tags, or individual account IDs. By creating an Account Group for the 'Staging' OU and another for 'Production', a custom role can be created that grants permissions (e.g., 'Cloud Security Viewer') only on the 'Staging' Account Group. This effectively segments visibility and control within the platform.

Correct answers: Viewing the User Entity Behavior Analytics (UEBA) profile for the involved IAM user.; Executing the associated RQL query to see the raw event data.

Correct answer: `config from cloud.resource where api.name = 'aws-iam-role-list' AND json.rule = 'policy.statement.action equals iam:PassRole and policy.statement.resource equals *'`

This query correctly targets IAM roles and inspects the attached policy documents. The `json.rule` uses dot notation to traverse the JSON structure of the IAM policy. The condition `policy.statement.action equals iam:PassRole` finds policies with the PassRole permission, and `policy.statement.resource equals *` specifically filters for those that are dangerously permissive by applying to all resources.

Correct answer: Create a new Host Runtime Policy, specify the paths to monitor (e.g., /etc, /bin), and enable the File Integrity Monitoring effect.

File Integrity Monitoring is configured centrally within the Prisma Cloud Console. The correct procedure is to create or edit a Host Runtime Policy, navigate to the 'File Integrity' section, and add the specific files and directories that PCI DSS requires to be monitored. The 'effect' for this rule should be set to 'Alert' or 'Prevent' to log and optionally block unauthorized changes.