Palo Alto Networks PCCSE Exam - Topic 1 Question 103 Discussion

Actual exam question for Palo Alto Networks's PCCSE exam

Question #: 103
Topic #: 1

A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

AThe value of the mined currency exceeds $100.

BHigh CPU usage over time for the container is detected.

CCommon cryptominer process name was found.

DThe mined currency is associated with a user token.

ECommon cryptominer port usage was found.

Show Suggested Answer

Suggested Answer: B, C, E

In the case of identifying a cryptominer attack through container audits, the options that could have generated this audit include B. High CPU usage over time for the container is detected, which is a common indicator of cryptomining activity as it consumes significant computational resources, C. Common cryptominer process name was found, which directly indicates the presence of cryptomining based on known malicious processes, and E. Common cryptominer port usage was found, suggesting cryptomining activity based on network behavior typical of such attacks.

by Shawnda at Jul 08, 2025, 11:12 PM

Limited Time Offer

25%

Off

Get Premium PCCSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Melodie

2 months ago

D is interesting, but not always relevant.

upvoted 0 times

...

Alesia

2 months ago

Wait, can high CPU usage alone mean a cryptominer?

upvoted 0 times

...

Brigette

2 months ago

Definitely B and C for sure.

upvoted 0 times

...

Dorathy

3 months ago

E is a classic sign of cryptomining activity.

upvoted 0 times

...

Malcolm

3 months ago

A seems a bit off, not always a clear indicator.

upvoted 0 times

...

Malika

3 months ago

I’m not sure about option A, though. The value of mined currency seems less likely to trigger an audit compared to the other options.

upvoted 0 times

...

Loise

3 months ago

I think option E makes sense too, since certain ports are typically used by cryptominers. It feels familiar from practice questions.

upvoted 0 times

...

Patria

4 months ago

I'm a bit unsure about the specifics, but I feel like option C could definitely be relevant since common process names are often flagged in audits.

upvoted 0 times

...

Lauryn

4 months ago

I remember studying about CPU usage patterns, so I think option B might be one of the answers.

upvoted 0 times

...

Ricarda

4 months ago

I'm a little confused by this question. I'm not sure which options would definitively indicate a cryptominer attack. I'll need to review the material and think it through carefully.

upvoted 0 times

...

Adelle

4 months ago

I'm confident I can solve this. The value of the mined currency, the user token, and the process name are all clear signs of a cryptominer attack. I'll select those.

upvoted 0 times

...

Mi

4 months ago

Okay, let's see. High CPU usage, common cryptominer processes, and port usage seem like the most relevant clues to look for. I'll select those options.

upvoted 0 times

...

Sharita

5 months ago

Hmm, I'm a bit unsure about this one. I'll need to carefully read through each option and think about how they could potentially indicate a cryptominer attack.

upvoted 0 times

...

Vesta

5 months ago

This question seems straightforward. I'll focus on the key details about the cryptominer attack and look for the options that match those indicators.

upvoted 0 times

...

Tijuana

7 months ago

You know what they say, 'Where there's smoke, there's fire.' B, C, and E are the way to go on this one. Catch that miner before they mine the company dry!

upvoted 0 times

...

My

7 months ago

Definitely B, C, and E. Anything that drains the CPU and uses suspicious ports is a red flag for cryptomining. Gotta keep those containers secure!

upvoted 0 times

...

Ahmad

7 months ago

Hmm, I'd go with B, C, and E. Cryptominers are tricky, but those signs are a dead giveaway. Best keep an eye on that CPU, eh?

upvoted 0 times

...

King

7 months ago

Haha, I bet the customer was mining some serious crypto on the company's dime. B, C, and E sound like the way to go on this one.

upvoted 0 times

Helga

5 months ago

Yeah, and finding a common cryptominer process name is definitely suspicious.

upvoted 0 times

...

Ashlee

6 months ago

I agree, high CPU usage over time is a red flag.

upvoted 0 times

...

Annamaria

7 months ago

I believe option D could also be a possible reason. If the mined currency is associated with a user token, it could trigger the audit.

upvoted 0 times

...

Simona

7 months ago

I agree with Candida. High CPU usage, common cryptominer process name, and port usage are all signs of a cryptominer attack.

upvoted 0 times

...

Candida

7 months ago

I think options B, C, and E could have generated this audit.

upvoted 0 times

...

Bambi

7 months ago

B, C, and E for sure! Cryptominers are notorious for spiking CPU usage and leaving telltale process names and port usage. Gotta catch those sneaky miners!

upvoted 0 times

Monroe

5 months ago

Definitely, those are key indicators to look out for when identifying a cryptominer attack.

upvoted 0 times

...

Myong

7 months ago

I agree, high CPU usage, common process names, and port usage are all signs of a cryptominer attack.

upvoted 0 times

...