UPDATED [Sep 21, 2025] Pass Palo Alto Networks System Engineer - Prisma Cloud Professional Exam with Latest Questions
PSE-Prisma-Pro-24 Exam Practice Questions prepared by Palo Alto Networks Professionals
NEW QUESTION # 26
What is required for an EC2 instance to access the internet directly from an AWS VPC?
- A. Internet Gateway
- B. Transit Gateway
- C. Customer Gateway
- D. Virtual Private Gateway
Answer: A
NEW QUESTION # 27
What does Prisma Cloud execute to change public cloud infrastructure when autoremediation is enabled?
- A. third-party integration tools
- B. local scripts to public cloud APIs
- C. remote function calls to host agents
- D. public cloud CLI commands
Answer: C
NEW QUESTION # 28
An Azure VNet has the IP network 10.0.0.0/16 with two subnets, 10.0.1.0/24 (used for web servers) and
10.0.2.0/24 (used for database servers). Which is a valid IP address to manage the VM-Series NGFW?
- A. 10.0.3.255
- B. 10.0.2.1
- C. 10.0.3.1
- D. 10.0.1.254
Answer: C
NEW QUESTION # 29
Which two resources provide operational insight within the Prisma Cloud Asset Inventory? (Choose two.)
- A. Prisma Access Gateways
- B. Cloud Storage buckets
- C. Compute Engine instance
- D. Cortex Data Lake
Answer: B,D
NEW QUESTION # 30
Based on the diagram, prioritize the order in which the Virtual Gateway evaluates the best route based on the deterministic B6P Path selection process.
Answer:
Explanation:
Explanation:
longest, shortest, path, lowest multi, lowest peer
NEW QUESTION # 31
How can a range of dates in the Prisma Cloud default policy be modified?
- A. Manually create the Resource Query Language (RQL) statement.
- B. Click the gear icon next to the policy name to open the "Edit Policy" dialog.
- C. Override the value and commit the configuration.
- D. Clone the existing policy and change the value.
Answer: D
NEW QUESTION # 32
An administrator deploys a VM-Series firewall into Amazon Web Services. Which attribute must be disabled on the data-plane elastic network interface for the instance to handle traffic that is not destined to its own IP address?
- A. source/destination checking
- B. elastic ip address
- C. security group
- D. tags
Answer: A
Explanation:
https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws
/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html
NEW QUESTION # 33
Which Prisma Public Cloud policy alerts administrators to unusual user activity?
- A. Configuration
- B. Audit Event
- C. Network
- D. Anomaly
Answer: D
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly- policies.html
NEW QUESTION # 34
The VM-Series integration with Amazon GuardDuty feeds malicious IP addresses to the VM-Series NGFW using XML API to populate a Dynamic Address Group within a Security policy that blocks traffic.
How does Amazon Web Services achieve this integration?
- A. SNS
- B. SQS
- C. Lambda
- D. CodeDeploy
Answer: C
NEW QUESTION # 35
Which two cloud providers support Load Balancers as next hop configurations for outbound connections?
(Choose two.)
- A. Amazon Web Services
- B. Microsoft Azure
- C. Google Cloud Platform
- D. Oracle Cloud
Answer: B,C
NEW QUESTION # 36
can you create a custom compliance standard in Prisma Public Cloud?
- A. From Compliance tab, clone a default framework and customize.
- B. From Compliance tab > Compliance Standards, click "Add New."
- C. Create compliance framework in a spreadsheet then import into Prisma Public Cloud.
- D. Generate a new Compliance Report.
Answer: B
Explanation:
https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-compliance/create- a-custom-compliance-standard
NEW QUESTION # 37
What are two ways to enable interface swap when deploying a VM-Series NGFW in Google Cloud Platform?
(Choose two.)
- A. run the PAN-OS CLI command: set system mgmt-interface-swap enable yes
- B. run the PAN-OS CLI command: set system mgmt-interface-swap setting enable yes
- C. create a bootstrap file that includes the mgmt-interface-swap command
- D. in the Google Cloud Console Metadata Field, enter a key-value pair where mgmt-interface-swap is the key and enable is the value
Answer: C,D
Explanation:
https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/set-up-the-vm-series-firewall-on- google-cloud-platform/deploy-the-vm-series-firewall-on-google-cloud/management-interface-mapping-for- google-internal-load-balancing.html
NEW QUESTION # 38
Based on the diagram, how many routes will the virtual gateway advertise to the on-premises NGFW over the Amazon Web Services Direct Connect link?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION # 39
What are two benefits of Cloud Security Posture Management (CSPM) over other solutions? (Choose two.)
- A. guaranteed proof of concept (POC) extensions beyond 30 days
- B. proactive addressing of risks
- C. elimination of blind spots
- D. native integration of network, endpoint, and cloud data to stop attacks
Answer: B,C
NEW QUESTION # 40
Which pillar of the Prisma Cloud platform provides support for both public and private clouds as well as flexible agentless scanning and agent-based protection?
- A. Cloud Network Security
- B. Cloud Workload Protection (CWP)
- C. Cloud Identity Security
- D. Cloud Security Posture Management
Answer: B
NEW QUESTION # 41
Match the logging service with its cloud provider.
Answer:
Explanation:
Explanation:
AWS, Azure, GCP, Azure, AWS, GCP
NEW QUESTION # 42
Which Google Cloud Platform project shares its VPC networks with other projects?
- A. Host project
- B. Admin project
- C. Service project
- D. Subscribing project
Answer: A
Explanation:
Create a shared VPC using the Trust VPC created when you deployed the firewall template.
Set up a shared VPC for the host (firewall) project:
gcloud compute shared-vpc enable HOST_PROJECT_ID
https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on- google-cloud-platform/autoscaling-on-google-cloud-platform/deploy-autoscaling-on-google-cloud.html
NEW QUESTION # 43
Which two elements does Prisma Cloud monitor when analyzing for unusual user activity? (Choose two.)
- A. time
- B. Operating System (OS)
- C. browser
- D. location
Answer: A,D
NEW QUESTION # 44
Which Amazon Web Services (AWS) service supplies information for Prisma Cloud "event where" Resource Query Language (RQL) queries?
- A. CloudTrail Audit Logs
- B. GuardDuty
- C. Activity Logs
- D. Inspector
Answer: A
NEW QUESTION # 45
Which RQL string searches for all EBS volumes that do not have a "DataClassification" tag?
- A. config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*]key != DataClassification
- B. config where api.name = ,aws-ec2-describe-volumes' AND json.rule = tags[*].key exists
- C. config where api.name = 'aws-ec2-describe-volumes' AND json.rule = tags[*].key = 1
- D. config where api.name = 'aws-ec2-describe-volumes, AND json.rule = tags[*]key contains DataClassification
Answer: A
NEW QUESTION # 46
Which statement applies to optimization of registry scans with version pattern matching?
- A. It is only necessary in registries with tens of thousands of repositories and millions of images.
- B. It requires Linux images to rely on optimizing registry scans due to various Linux elements.
- C. It is rarely successful in the Windows Operating System (OS).
- D. It is best practice to always optimize registry scans for faster results.
Answer: A
NEW QUESTION # 47
How does a customer that has deployed a VM-Series NGFW on Microsoft Azure using a BYOL license change to a PAYG license structure?
- A. purchase a new PAYG license for Microsoft Azure from Palo Alto Networks
- B. launch a new VM using the PAYG image
- C. purchase a new PAYG license from a reseller
- D. go to Palo Alto Networks Support website to change the BYOL license to a PAYG license
Answer: B
NEW QUESTION # 48
Which two items are required when a VM-100 BYOL instance is upgraded to a VM-300 BYOL instance?
(Choose two.)
- A. API Key
- B. new Auth Code
- C. CPU ID
- D. UUID
Answer: A,B
Explanation:
In a public cloud deployment, if your firewall is licensed with the BYOL option, you must Deactivate VM before you change the instance type or VM type and apply the license again on the firewall after you complete the model or instance upgrade. When you change the instance type, because the firewall has a new UUID and CPU ID, the existing license will no longer be valid.
https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/about-the-vm-series-firewall/upgrade- the-vm-series-firewall/upgrade-the-vm-series-model
NEW QUESTION # 49
Which option is true about VM-Series NGFW templates available from the Palo Alto Networks GitHub repository?
- A. Palo Alto Networks provides full support if a valid support license is in place.
- B. Unless otherwise noted, these templates are released under an as-is. best effort support policy.
- C. The author of the template provides full support as long as the PAN-OS version specific to the template is supported.
- D. Support for the templates is available through Professional Services from Palo Alto Networks.
Answer: B
NEW QUESTION # 50
Which RQL string monitors all traffic from the Internet and Suspicious IPs destined for your Amazon Web Services databases''
- A. network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest.resource IN (resource where role IN ('LDAP'))
- B. network where dest.resource IN (resource where role = 'Database'}
- C. network where source.publicnetwork IN ('Suspicious IPs') and dest.resource IN (resource where role IN ('AWS RDS', 'Database'))
- D. network where source.publicnetwork IN ('Suspicious IPs', 'Internet IPs') and dest resource IN (resource where role IN ('AWS RDS'. 'Database'))
Answer: D
NEW QUESTION # 51
......
PSE-Prisma-Pro-24 Exam Practice Materials Collection: https://prep4sure.examtorrent.com/PSE-Prisma-Pro-24-exam-papers.html
