PCCP Sample Questions Answers

Authentication is the component of the AAA (Authentication, Authorization, and Accounting) framework that verifies user identities (e.g., via passwords, certificates, or biometrics) before granting access to network resources.

Detection of threats using data analysis – SIEM platforms analyze collected data to identify suspicious patterns and detect threats.

Ingestion of log data – SIEM systems collect and centralize log data from various sources, which is essential for analysis, correlation, and alerting.

Automation and prevention are more aligned with SOAR and firewall/EDR functionalities, not the core operations of SIEM.

Workload security in a Cloud Native Security Platform (CNSP) is designed to secure containers, VMs, and serverless functions throughout the entire application lifecycle — from development to runtime — by detecting and blocking vulnerabilities, misconfigurations, and runtime threats.

A Cloud Access Security Broker (CASB) secures SaaS applications and network data by providing visibility, data security, threat protection, and compliance enforcement. It acts as a control point between users and cloud service providers to enforce security policies.

Pharming is an attack that redirects traffic from a legitimate website to a malicious fake website, typically by corrupting the DNS system or modifying host files, with the intent of stealing user credentials or sensitive data.

Account discovery is a technique in the MITRE ATT&CK framework under the Discovery tactic. It involves adversaries attempting to identify user accounts on a system or network.

Credential access, lateral movement, and resource development are tactics — high-level objectives an attacker is trying to achieve.

A container-based NGFW is specifically designed to integrate with Kubernetes environments, providing full application visibility and control within containerized workloads. It operates at the pod level, making it ideal for securing dynamic microservices architectures.

Endpoint Detection and Response (EDR) tools monitor, record, and analyze endpoint activity to detect suspicious behavior, investigate incidents, and respond to threats on user devices such as laptops and desktops.

SOAR platforms are unique in their ability to automate incident response through the use of predefined workflows. These workflows allow repetitive security tasks to be executed automatically, improving response speed and efficiency.

Containers encapsulate applications and their dependencies into lightweight, portable units that can run consistently across multiple environments. This abstraction supports cloud-native development by enabling microservices architectures, rapid deployment, and scaling within orchestration platforms like Kubernetes. Containers accelerate cloud migration by decoupling applications from infrastructure, facilitating automation, and continuous integration/continuous deployment (CI/CD) workflows. Palo Alto Networks addresses container security by integrating runtime protection, vulnerability scanning, and compliance enforcement within its Prisma Cloud platform, ensuring safe adoption of cloud-native tools and methodologies.

Lateral movement is a key stage where the attacker moves across the network to find valuable targets.

Privilege escalation involves gaining higher access rights to expand control within the compromised environment.

Communication with covert channels is a tactic used during persistence or exfiltration, while deletion of critical data is not a standard APT lifecycle stage — it’s more characteristic of destructive attacks.

The Privilege Escalation tactic in the MITRE ATT&CK framework involves techniques used by attackers to gain higher-level permissions on a system or network, allowing greater access to internal servers and sensitive data.

A User Entity Behavior Analysis (UEBA) tool performs active monitoring by continuously analyzing the behavior of users and entities to detect anomalies that may indicate insider threats, compromised accounts, or malicious activity. It uses machine learning and analytics to identify unusual patterns in real time.

Advanced WildFire is a Cloud-Delivered Security Service (CDSS) that detects zero-day malware using inline cloud machine learning (ML) and sandboxing techniques. It analyzes unknown files in real-time to identify and block new threats before they can cause harm.

Authorization is the component of the AAA (Authentication, Authorization, and Accounting) framework that regulates user access and permissions to resources after identity has been verified. It determines what actions or resources a user is allowed to access.

Cloud Security Posture Management (CSPM), including Prisma Cloud’s offering, continuously monitors all cloud resources — such as compute instances, storage, network configurations, and identities — to detect misconfigurations, vulnerabilities, and potential threats in near real time.

Code security in cloud environments involves using tools like Static Application Security Testing (SAST) to automatically analyze source code for vulnerabilities before deployment. This helps identify and remediate potential threats early in the software development lifecycle.

Prisma Access is a cloud-delivered security platform that provides policy enforcement, secure access, and threat prevention for mobile users and remote networks, ensuring consistent security regardless of location.