exam questions

Exam PCCSE All Questions

View all questions & answers for the PCCSE exam

Exam PCCSE topic 1 question 22 discussion

Actual exam question from Palo Alto Networks's PCCSE
Question #: 22
Topic #: 1
[All PCCSE Questions]

An S3 bucket within AWS has generated an alert by violating the Prisma Cloud Default policy `AWS S3 buckets are accessible to public`. The policy definition follows: config where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule="((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcis is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist"
Why did this alert get generated?

  • A. an event within the cloud account
  • B. network traffic to the S3 bucket
  • C. configuration of the S3 bucket
  • D. anomalous behaviors
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
[Removed]
Highly Voted 2 years, 7 months ago
websiteConfiguration does not exist concerns about config not traffic. Therefore correct answer is C
upvoted 9 times
...
assadhashmi
Most Recent 8 months, 1 week ago
Selected Answer: C
Correct option is C
upvoted 1 times
...
Spippolo
11 months ago
Selected Answer: C
For exclusion "C".
upvoted 1 times
...
kumar_57
1 year, 1 month ago
Yes, correct option is C.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago