New (2026) Palo Alto Networks CloudSec-Pro Exam Dumps [Q143-Q162]

Q143. An administrator sees that a runtime audit has been generated for a host. The audit message is:
“Service postfix attempted to obtain capability SHELL by executing
/bin/sh /usr/libexec/postfix/postfix- script.stop. Low severity audit,
event is automatically added to the runtime model”
Which runtime host policy rule is the root cause for this runtime audit?

Custom rule with specific configuration for file integrity

Custom rule with specific configuration for networking

Default rule that alerts on capabilities

Default rule that alerts on suspicious runtime behavior

Q144. Which field is required during the creation of a custom config query?

resource status

api.name

finding.type

cloud.type

Q145. A Prisma Cloud Administrator onboarded an AWS cloud account with agentless scanning enabled successfully to Prisma Cloud. Which item requires deploying defenders to be able to inspect the risk on the onboarded AWS account?

Host compliances risks

Container runtime risks

Container vulnerability risks

Host vulnerability risks

Q146. A customer has a large environment that needs to upgrade Console without upgrading all Defenders at one time.
What are two prerequisites prior to performing a rolling upgrade of Defenders? (Choose two.)

manual installation of the latest twistcli tool prior to the rolling upgrade

all Defenders set in read-only mode before execution of the rolling upgrade

a second location where you can install the Console

additional workload licenses are required to perform the rolling upgrade

an existing Console at version n-1

Q147. Given a default deployment of Console, a customer needs to identify the alerted compliance checks that are set by default.
Where should the customer navigate in Console?

Monitor > Compliance

Defend > Compliance

Manage > Compliance

Custom > Compliance

Q148. A developer writes a serverless application to extract a field from a file in an S3 bucket. The Lambda function is assigned the S3FullAccess managed policy.

Refer to the scenario to answer this question:
Which two actions will allow a Cortex Cloud user to view the effective permissions of the Lambda function? (Choose two.)

Opening the Identity dashboard, filtering for serverless functions, opening the function and clicking on “Access”

Viewing all Compute assets and applying the Serverless = Yes filter in the inventory

Viewing the Access tab in the non-human identities inventory

Selecting the Access tab in the serverless function inventory after selecting the function

Q149. A customer’s Security Operations Center (SOC) team wants to receive alerts from Prisma Cloud via email once a day about all policies that have a violation, rather than receiving an alert every time a new violation occurs.
Which alert rule configuration meets this requirement?

Configure an alert rule with all the defaults except selecting email within the “Alert Notifications” tab and specifying recipient.

Configure an alert rule. Under the “Policies” tab, select “High Risk Severity Policies.” In the “Set Alert Notifications” tab, select “Email > Recurring,” set to repeat every 1 day, and enable “Email.”

Set up email integrations under the “Integrations” tab in “Settings” and create a notification template.

Configure an alert rule. Under the “Policies” tab, select “All Policies.” In the “Set Alert Notifications” tab, select “Email > Recurring,” set to repeat every 1 day, and then enable “Email.”

Q150. Which three OWASP protections are part of Prisma Cloud Web-Application and API Security (WAAS) rule? (Choose three.)

DoS Protection

Local file inclusion

SQL injection

Suspicious binary

Shellshock

Q151. Which statement is true about obtaining Console images for Prisma Cloud Compute Edition?

To retrieve Prisma Cloud Console images using basic auth:1.Access registry.paloaltonetworks.com, and authenticate using ‘docker login’.2.Retrieve the Prisma Cloud Console images using ‘docker pull’.

To retrieve Prisma Cloud Console images using basic auth:1.Access registry.twistlock.com, and authenticate using ‘docker login’.2.Retrieve the Prisma Cloud Console images using ‘docker pull’.

To retrieve Prisma Cloud Console images using URL auth:1.Access registry-url-auth.twistlock.com, and authenticate using the user certificate.2.Retrieve the Prisma Cloud Console images using ‘docker pull’.

To retrieve Prisma Cloud Console images using URL auth:1.Access registry-auth.twistlock.com, and authenticate using the user certificate.2.Retrieve the Prisma Cloud Console images using ‘docker pull’.

Q152. Which security model does Palo Alto Networks Prisma Cloud use for multi-cloud environments?

Zero Trust

Hybrid Security Model

Cloud-native security model

Traditional perimeter-based model

Q153. Which Prisma Cloud policy type detects port scanning activities in a customer environment?

Port Scan

Anomaly

Config

Network

Q154. The security team wants to enable the “block” option under compliance checks on the host.
What effect will this option have if it violates the compliance check?

The host will be taken offline.

Additional hosts will be prevented form starting.

Containers on a host will be stopped.

No containers will be allowed to start on that host.

Q155. A company operationalizing Cortex Cloud Data Security Posture Management (DSPM) experiences issues related to a lack of secure controls on its Amazon S3 buckets. An administrator wants to use the XQL editor to investigate S3 buckets but is unable to see any data in the Cortex Cloud console. How can the administrator ensure that data is being ingested?

Install the DSPM module into the cloud environment.

Install the Cortex XDR agent for cloud on the S3 buckets.

Verify that S3 is added as a data source.

Verify that the data source is properly onboarded.

Q156. Which RQL query type is invalid?

Event

IAM

Incident

Config

Q157. The attempted bytes count displays?

traffic that is either denied by the security group or firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.

traffic that is either denied by the security group or firewall rules.

traffic that is either denied by the firewall rules or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.

traffic denied by the security group or traffic that was reset by a host or virtual machine that received the packet and responded with a RST packet.

Q158. Which step should a SecOps engineer implement in order to create a network exposure policy that identifies instances accessible from any untrusted internet sources?

In Policy Section-> Add Policy-> Config type -> Define Policy details Like Name,Severity-> Configure RQL query “config from network where source.network = UNTRUSTJNTERNET and dest.resource.type = ‘Instance’ and dest.cloud.type = ‘AWS*” -> define compliance standard -> Define recommendation for remediation & save.

In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query “network from vpc.flow_record where source.publicnetwork IN (‘Suspicious IPs’, ‘Internet IPs’) and dest.resource IN (resource where role IN (‘Instance ))” -> define compliance standard -> Define recommendation for remediation & save.

In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query “network from vpc.flow_record where source.publicnetwork IN (‘Suspicious IPs’, ‘Internet IPs’) and dest.resource IN (resource where role IN ( Instance ))” -> define compliance standard -> Define recommendation for remediation & save.

In Policy Section-> Add Policy-> Network type -> Define Policy details Like Name.Severity-> Configure RQL query “config from network where source.network = UNTRUSTJNTERNET and dest.resource.type = ‘Instance’ and dest.cloud.type = ‘AWS'” -> Define recommendation for remediation & save.

Q159. An administrator wants to install the Defenders to a Kubernetes cluster. This cluster is running the console on the default service endpoint and will be exporting to YAML.
Console Address: $CONSOLE_ADDRESS Websocket Address: $WEBSOCKET_ADDRESS User: $ADMIN_USER Which command generates the YAML file for Defender install?

<PLATFORM>/twistcli defender –address $CONSOLE_ADDRESS –user $ADMIN_USER — cluster- address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender export kubernetes –address $WEBSOCKET_ADDRESS –user
$ADMIN_USER –cluster-address $CONSOLE_ADDRESS

<PLATFORM>/twistcli defender YAML kubernetes –address $CONSOLE_ADDRESS –user
$ADMIN_USER –cluster-address $WEBSOCKET_ADDRESS

<PLATFORM>/twistcli defender export kubernetes –address $CONSOLE_ADDRESS –user
$ADMIN_USER –cluster-address $WEBSOCKET_ADDRESS

Q160. A customer is deploying Defenders to a Fargate environment. It wants to understand the vulnerabilities in the image it is deploying.
How should the customer automate vulnerability scanning for images deployed to Fargate?

Set up a vulnerability scanner on the registry

Embed a Fargate Defender to automatically scan for vulnerabilities

Designate a Fargate Defender to serve a dedicated image scanner

Use Cloud Compliance to identify misconfigured AWS accounts

Q161. Taking which action will automatically enable all severity levels?

Navigate to Settings > Enterprise Settings and enable all severity levels in the alarm center.

Navigate to Policies > Settings and enable all severity levels in the alarm center.

Navigate to Settings > Enterprise Settings and ensure all severity levels are checked under “auto-enable default policies.

Navigate to Policies > Settings and ensure all severity levels are checked under “auto-enable default policies.

Q162. Given the following RQL:
event from cloud.audit_logs where operation IN (`CreateCryptoKey’, `DestroyCryptoKeyVersion’,
`v1.compute.disks.createSnapshot’)
Which audit event snippet is identified?