Palo Alto Networks PCCSE Exam - Topic 5 Question 84 Discussion

Actual exam question for Palo Alto Networks's PCCSE exam

Question #: 84
Topic #: 5

Which ROL query is used to detect certain high-risk activities executed by a root user in AWS?

Aevent from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'

Bevent from cloud.security_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey' , 'DeleteAlarms' ) AND user = 'root'

Cconfig from cloud.audit_logs where operation IN ( 'ChangePassword', 'ConsoleLogin', 'DeactivateMFADevice', 'DeleteAccessKey', 'DeleteAlarms' ) AND user = 'root'

Devent from cloud.audit_logs where Risk.Level = 'high' AND user = 'root'

Show Suggested Answer

Suggested Answer: A

https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/event-query/event-query-examples#idda895fd2-4496-4b31-9766-7d50215dcc18

by Maia at Aug 24, 2024, 05:21 PM

Limited Time Offer

25%

Off

Get Premium PCCSE Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kimberlie

3 months ago

I thought it was D at first, but A makes more sense.

upvoted 0 times

...

Tasia

3 months ago

Wait, are we sure about A? Seems too specific.

upvoted 0 times

...

Alyssa

3 months ago

A all the way! Those operations are key.

upvoted 0 times

...

Iola

4 months ago

I think B could be right too, but not sure.

upvoted 0 times

...

Afton

4 months ago

It's definitely A, that's the right log for auditing.

upvoted 0 times

...

Beatriz

4 months ago

I feel like option D could be relevant too, but it seems too broad with just 'Risk.Level = high'. I think we need to focus on specific operations.

upvoted 0 times

...

Precious

4 months ago

I’m a bit confused between A and B. They both mention 'cloud.audit_logs' and 'cloud.security_logs', but I can't recall which one is specifically for high-risk activities.

upvoted 0 times

...

Sherron

4 months ago

I remember practicing a similar question, and I think it was about using 'cloud.audit_logs' for tracking root user activities.

upvoted 0 times

...

Willodean

5 months ago

I think the answer might be A, but I'm not completely sure if 'event' is the right keyword for this type of query.

upvoted 0 times

...

Brock

5 months ago

Ah, I see now. We're looking for a query that checks the audit logs for specific high-risk operations performed by the root user. Option A seems to fit the bill.

upvoted 0 times

...

Kirk

5 months ago

I'm a bit confused by the different log types mentioned. I'll need to review my notes on AWS logging and monitoring to make sure I understand the differences.

upvoted 0 times

...

German

5 months ago

The key here is to look for high-risk activities performed by the root user. I think option A is the best choice based on the list of operations.

upvoted 0 times

...

Karma

5 months ago

This looks like a straightforward question about AWS security monitoring. I'm pretty confident I can figure this out.

upvoted 0 times

...

Edna

5 months ago

Hmm, I'm a bit unsure about the difference between audit logs and security logs. I'll need to think this through carefully.

upvoted 0 times

...

Kizzy

5 months ago

This looks like a configuration question related to EVPN VPWS. I'll need to carefully review the options and think through the requirements for proper EVPN VPWS operation.

upvoted 0 times

...