Which Palo Alto Networks cloud-delivered security service provides automated inline threat prevention against malware, command-and-control traffic, and DNS-based threats using machine learning?
An organization wants to use Prisma Access to inspect all outbound internet traffic from Google Cloud Platform (GCP) VPCs. Which architecture provides the most scalable integration between GCP and Prisma Access?
An administrator is troubleshooting a policy issue where a Prisma Cloud RQL (Resource Query Language) query is not returning expected AWS EC2 instances. The query is: `config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-ec2-describe-instances'`. What is the most likely reason the query fails to return resources?
An organization wants to inspect east-west traffic between different microservices running inside an Amazon Elastic Kubernetes Service (EKS) cluster using VM-Series firewalls. Which architectural pattern is recommended?
An enterprise deploying VM-Series firewalls in Google Cloud Platform (GCP) requires centralized license management via Panorama. Which licensing mode should be configured so that firewalls automatically obtain their licenses from Panorama based on consumption or pre-purchased credits?
An organization wants to secure a Kubernetes cluster using Prisma Cloud Compute. Which THREE capabilities can the Prisma Cloud Compute Defender provide for the cluster? (Choose three)
An administrator needs to configure Prisma Access to inspect traffic from remote workers using explicit proxy mode rather than the GlobalProtect tunnel. Which component or configuration is required for explicit proxy support in Prisma Access?
An enterprise is deploying CN-Series firewalls to secure traffic inside a Kubernetes cluster. Which THREE architectural elements are required for successful deployment and operation of CN-Series firewalls? (Choose two... wait, prompt asks for THREE: Choose three)
A security engineer is designing a multi-cloud environment where workloads in AWS must access data stored in Google Cloud Storage without traversing the public internet. The engineer wants to enforce least-privilege access and centralize identity management. Which combination of technologies should the engineer implement?
A cloud security architect is implementing a solution to detect and respond to threats in a Kubernetes environment running on Amazon EKS. The architect wants to monitor runtime behavior, including process execution and network connections, and automatically block malicious activities. Which tool should the architect deploy?
A security team is deploying Cloud NGFW for AWS to protect a VPC that hosts a public web application. The team wants to inspect traffic between the internet and the application but does not want to modify the existing subnet route tables or manage firewall instances. Which deployment model should the team choose?
A security engineer is deploying VM-Series firewalls in AWS to inspect outbound traffic from a VPC. The design requires that the firewalls use a single elastic network interface (ENI) and that return traffic follows the same path. Which AWS VPC routing configuration must be implemented to meet this requirement?
A security team wants to send VMware NSX-T Distributed Firewall logs directly to a Palo Alto Networks Prisma Cloud Compute console for container workload visibility. However, the NSX-T environment only supports sending logs via syslog. Which component of Prisma Cloud Compute must be configured to receive these syslog messages?
An administrator is configuring Prisma Cloud to monitor a Google Cloud Platform (GCP) organization. The administrator wants to ensure that Prisma Cloud can detect misconfigurations in all projects, including future ones, without manually adding each project. Which onboarding method should be used?
An administrator is deploying Prisma Access for mobile users and needs to ensure that traffic to specific SaaS applications bypasses security inspection for performance reasons, while all other traffic is inspected. Which Prisma Access feature should be configured to achieve this?
A financial institution uses Prisma Cloud Enterprise to monitor its AWS environment. An administrator needs to ensure that all Amazon S3 buckets are encrypted with AWS Key Management Service (KMS) customer managed keys (CMKs) and that the encryption cannot be disabled. Which Prisma Cloud feature should the administrator use to enforce this requirement continuously?
An organization is using Prisma Access for secure internet access. Users in a branch office report that a business-critical SaaS application is slow. The security team wants to ensure that traffic to this SaaS application is not inspected by security services that could add latency. Which Prisma Access feature should be configured to bypass inspection for this application?
A multinational corporation uses Prisma Access to secure remote workers. The security team wants to ensure that all traffic to a specific SaaS application is inspected for data loss prevention (DLP) and that users cannot bypass the inspection by using a different browser or protocol. Which Prisma Access feature should they configure to enforce this?
When configuring Prisma Access to inspect traffic between different branch offices (Branch-to-Branch traffic), where is the inspection typically performed?
An enterprise is deploying Prisma Access to secure remote workers and branch offices. The security team needs to ensure that user identity from Microsoft Entra ID is correctly mapped to traffic logs without requiring users to authenticate through an explicit captive portal. Which component must be deployed?
An organization is using Prisma Cloud to monitor AWS IAM policies. A custom policy check fails because an IAM role allows overly permissive actions on S3 buckets. Where in Prisma Cloud should the administrator navigate to view and remediate this specific cloud infrastructure misconfiguration?
An engineer is configuring Prisma Cloud to scan AWS Infrastructure as Code (IaC) templates within a GitHub repository. Which scanning integration should be implemented to detect misconfigurations before deployment?
An administrator needs to protect serverless AWS Lambda functions using Prisma Cloud Compute. Which method should be used to instrument the Lambda functions for vulnerability and compliance scanning?
An administrator is deploying VM-Series firewalls in Microsoft Azure using an Azure Standard Load Balancer for inbound application traffic. Which component is required to handle asymmetry when routing return traffic from backend application VMs back through the firewall?
An administrator needs to deploy VM-Series firewalls in an AWS environment using an AWS Gateway Load Balancer (GWLB). Which CloudFormation template or method should the administrator use to ensure traffic is transparently routed through the firewall without requiring destination NAT?
An administrator is reviewing WildFire submissions in the Prisma Access monitoring dashboard and notices a custom PowerShell script was classified as malware. Where can the administrator view the detailed behavioral analysis report showing registry modifications and API calls made by the sample?
An organization running Kubernetes clusters across multiple public clouds wants to enforce runtime protection that blocks unauthorized container process execution and file system writes. Which Prisma Cloud component performs this enforcement?
Which Prisma Cloud module provides Cloud Workload Protection (CWP) capabilities, including runtime defense, vulnerability management, and compliance for containers, hosts, and serverless functions?
When setting up Prisma Access Mobile Users, what is the recommended client software installed on end-user laptops to establish secure connections to the cloud security processing nodes?
An administrator is configuring DNS Security on VM-Series firewalls protecting a multi-cloud environment. Which mechanism does DNS Security use to protect against newly registered domains and command-and-control (C2) domains that lack traditional signatures?
Which Prisma Cloud feature continuously scans cloud resource configurations to detect compliance violations against frameworks such as CIS Benchmarks, HIPAA, and PCI-DSS?
An administrator is configuring Advanced URL Filtering on Prisma Access. Which feature allows the security policy to block newly observed malicious domains that have existed for only a few hours?
An administrator is investigating a security alert in Prisma Cloud where a container image in an Amazon ECR registry has a critical CVE. The engineering team wants to prevent CI/CD pipelines from building or pushing images that contain critical vulnerabilities. Which Prisma Cloud feature should be implemented?
An organization uses Prisma Access for secure internet access. Users in a specific branch office report that a SaaS application is loading slowly. Which Prisma Access monitoring tool should the administrator use to analyze end-to-end path performance, latency, and packet loss between the branch office and the SaaS application?
Which Palo Alto Networks product provides Cloud Infrastructure Entitlement Management (CIEM) to discover, analyze, and remediate excessive permissions and identities across multi-cloud environments?
An enterprise is deploying VM-Series firewalls across AWS, Azure, and GCP. The security team wants a single pane of glass to manage firewall security policies, rule deployments, and software updates across all cloud and on-premises firewalls. Which tool should be used?
Which feature in Prisma Cloud allows security teams to write custom security policies using a SQL-like query language to inspect cloud resource configurations and audit trails?
An administrator is configuring Prisma Access to secure remote networks and mobile users. Which TWO cloud-delivered security services can be natively integrated into Prisma Access security policies to inspect traffic? (Choose two)
Which TWO deployment methods are officially supported for provisioning VM-Series firewalls in public cloud environments like AWS and Azure? (Choose two)
An administrator is configuring a secure IPsec VPN tunnel between an on-premises Palo Alto Networks firewall and a Prisma Access Remote Networks mobile gateway. During negotiation, Phase 2 fails. Where should the administrator check to view detailed IKE and IPsec negotiation error messages?
Which TWO actions can an administrator perform within the Prisma Cloud Cloud Security Posture Management (CSPM) console to remediate misconfigured cloud resources? (Choose two)
Which TWO log types are generated by VM-Series firewalls and can be forwarded to Panorama or external SIEM platforms for cloud security analysis? (Choose two)
When configuring Prisma Access Remote Networks, which THREE core components or settings are mandatory to establish a secure IPsec tunnel from a branch office firewall to a Prisma Access mobile gateway? (Choose three)
An administrator is configuring Prisma Cloud Compute to protect serverless functions in AWS Lambda. Which THREE features are supported for serverless function protection? (Choose three)
An administrator is reviewing Prisma Cloud Data Security reports and identifies several high-risk findings related to AWS S3 buckets. Which THREE conditions or findings would trigger an alert in Prisma Cloud Data Security? (Choose three)
Which TWO benefits are achieved by integrating Prisma Cloud with cloud provider audit logs (such as AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs)? (Choose two)
An administrator is configuring a Prisma Access Remote Network connection to an on-premises data center. The organization wants to avoid routing all internet-bound traffic through the corporate network for branch users. Which Prisma Access component should be used to provide direct internet access for remote networks?
A security team is onboarding a new AWS account into Prisma Cloud. The cloud account was created under AWS Organizations, and the team wants to grant Prisma Cloud the least-privilege permissions needed to discover resources and read CloudTrail logs. Which onboarding method should the team use?
A security engineer is deploying a VM-Series firewall in AWS to inspect outbound traffic from a VPC. The design requires that the firewall preserve the original source IP of the instances so that security policy can be applied based on actual workload addresses. The engineer configures the firewall's untrust interface with an Elastic IP and sets the trust interface to use a static private address. When testing, the instances' traffic appears to originate from the firewall's trust IP rather than the instances' own IPs. Which configuration change should the engineer make to preserve the original source IP?
An administrator is configuring Prisma Cloud Compute to protect containers in a Kubernetes environment. The organization wants to ensure that only approved container images are deployed. Which TWO features should be used to achieve this? (Choose two.)
A cloud security architect is designing a Prisma Cloud Compute deployment to protect containers running in a Kubernetes cluster on Google Kubernetes Engine (GKE). The architect must ensure that the Defender can inspect container images and enforce runtime policies. Which component must be deployed and configured?
A cloud security engineer is reviewing Prisma Cloud alerts for an Azure subscription. Several alerts indicate that storage accounts allow public blob access. The engineer wants to remediate the issue at scale across all current and future storage accounts in the subscription without disrupting applications that legitimately serve public content through a CDN. What should the engineer do?
A cloud security team is using Prisma Cloud to monitor a multi-cloud environment. They want to detect and respond to misconfigurations in AWS, Azure, and Google Cloud. Which TWO capabilities of Prisma Cloud are essential for continuously assessing cloud resource configurations against security best practices? (Choose two.)
A security analyst is investigating an alert from Prisma Cloud Compute indicating that a container in a Kubernetes cluster attempted to write to the host filesystem. The analyst needs to determine which container image and which node were involved. Which Prisma Cloud Compute component provides this runtime visibility?
A security team is using Prisma Cloud to monitor and protect their multi-cloud environment. They need to identify which TWO capabilities are provided by Prisma Cloud's Cloud Security Posture Management (CSPM) module. (Choose two.)
A security team is using Prisma Cloud to monitor their AWS environment. They want to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should they use to detect this misconfiguration?
A security team has onboarded an AWS account into Prisma Cloud and enabled the Cloud Security Posture Management (CSPM) policy set. During the initial scan, the team notices that several S3 buckets flagged previously as non-compliant are no longer generating alerts, even though no remediation occurred. The team wants to understand which mechanism could suppress these alerts without deleting the policy. Which Prisma Cloud capability should the team review?
A security administrator is configuring Prisma Access to provide secure internet access for remote users. The organization wants to ensure that users' web traffic is inspected for threats and that acceptable use policies are enforced. Which Prisma Access component is responsible for applying security policies to web traffic from remote users?
A security administrator is configuring Prisma Access to provide secure internet access for remote users. The administrator wants to ensure that web traffic from remote users is inspected for threats and that malicious sites are blocked. Which Prisma Access component is responsible for this inspection?
An organization uses Prisma Access for secure internet access and wants to prevent users from uploading sensitive documents to unsanctioned cloud storage services. The security team already has data patterns defined for sensitive content. Which Prisma Access capability should be configured to inspect uploads and block the transfer?
An organization uses Prisma Cloud Compute to protect containers running in a Kubernetes cluster. A security engineer needs to ensure that a container image cannot run if it contains a critical vulnerability, but the team still wants developers to be able to deploy the image to a staging namespace for testing. Which Prisma Cloud Compute capability should the engineer configure to meet both requirements?
A security engineer is configuring Prisma Cloud Compute to protect containers in a Kubernetes cluster. The engineer wants to enforce runtime protection that prevents containers from executing unauthorized binaries. Which two actions are required to achieve this? (Choose two.)
A security operations team is using Prisma Cloud Compute to protect containers in a Kubernetes cluster. They want to ensure that only approved container images are allowed to run, and that any attempt to run an unapproved image is blocked. Which Prisma Cloud Compute feature should they configure to enforce this requirement?
A security operations team is using Prisma Cloud to monitor their AWS environment. They receive an alert about an S3 bucket that is publicly accessible. The team wants to quickly identify which users or roles have permissions to modify the bucket policy. Which Prisma Cloud feature should they use?
A security architect is designing a Prisma Cloud deployment to protect workloads across AWS, Azure, and Google Cloud. The architect must ensure that Prisma Cloud can detect misconfigurations in cloud resources and identify risky network exposure. Which TWO capabilities should the architect enable? (Choose two.)
A cloud security team is deploying Prisma Cloud to monitor a multi-cloud environment that includes AWS, Azure, and Google Cloud. The team wants to use the Cloud Security Posture Management (CSPM) capabilities and needs to understand which onboarding components are required to enable posture visibility across these providers. (Choose two.)
A cloud security administrator is using Prisma Cloud to monitor an AWS environment. The administrator needs to identify which S3 buckets are publicly accessible. Which Prisma Cloud feature should be used to quickly find this information?
A cloud security engineer is configuring Prisma Cloud to monitor AWS accounts for compliance with the CIS AWS Foundations Benchmark. The engineer wants to receive alerts when an S3 bucket is made publicly accessible. Which Prisma Cloud feature should be used to create a policy that triggers an alert for this specific misconfiguration?
An administrator is using Prisma Cloud to monitor a multi-cloud environment. They need to ensure that any Amazon S3 bucket containing sensitive data is encrypted at rest. Which Prisma Cloud capability should be used to continuously enforce this requirement?
A healthcare organization is using Prisma Cloud to secure its multi-cloud environment. The security team needs to identify all Amazon EC2 instances that have public IP addresses and are not protected by a security group restricting inbound traffic to only necessary ports. Which Prisma Cloud capability should they use to quickly find these instances?
A security administrator is configuring data protection for a cloud environment monitored by Prisma Cloud. The administrator wants the platform to detect when sensitive information such as credit card numbers is stored in object storage buckets and to generate an alert without blocking access. Which Prisma Cloud capability should the administrator enable?
A cloud operations team manages an AWS organization with many accounts and wants to onboard all current and future accounts into Prisma Cloud CSPM with minimal manual effort. The team needs new accounts created under the organization to be monitored automatically without repeating individual onboarding steps. Which onboarding approach should the team use?
An administrator is configuring Prisma Cloud Compute to protect a Kubernetes cluster. The security team wants to enforce runtime policies that prevent containers from running as root and from mounting sensitive host paths. Which TWO actions must the administrator take to achieve this? (Choose two.)
A security engineer manages an AWS environment where developers frequently create S3 buckets. The engineer must ensure that every new bucket is encrypted with SSE-KMS using a customer managed key, and that unencrypted buckets are remediated automatically within minutes without developer action. Which Prisma Cloud capability should be configured to meet this requirement?
A company runs production workloads in Microsoft Azure and wants Prisma Cloud to continuously assess those subscriptions against its security policies without storing long-lived Azure credentials in the platform. Which onboarding method should the administrator use?
A security team uses Prisma Cloud to monitor a Google Cloud organization. An auditor asks for evidence that no Cloud Storage bucket in any project allows anonymous public access, and the team must also be alerted within minutes whenever a new bucket is created with public access enabled. Which combination of Prisma Cloud features should the team rely on?