Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Prisma Cloud PlatformHard
A security engineer has configured a new custom alert rule in Prisma Cloud. The rule is designed to detect a specific misconfiguration in AWS S3 buckets. After deployment, they notice that while the misconfiguration exists on several buckets, no alerts are triggered. Upon investigation, they confirm the policy is correctly written. What is the MOST likely reason for the lack of alerts, assuming the policy is valid and the misconfiguration exists?
- AThe data retention period for alerts has expired.
- BThe alert notification channel is misconfigured.
- CThe cloud account for the affected S3 buckets is not onboarded to Prisma Cloud.
- DThe policy is assigned to an incorrect policy group or has no schedule configured.
Show answer & explanationAnswer & explanation
Correct answer: D. The policy is assigned to an incorrect policy group or has no schedule configured.
Even if a policy is correctly written and the misconfiguration exists, if the policy is not associated with a policy group that is scheduled to run scans, or if it's in a group with no active schedule, Prisma Cloud will not evaluate it against resources, thus no alerts will be generated.
Why the other options are wrong
- A. Expired data retention would affect historical alerts, not prevent new alerts from being triggered and appearing in the console.
- B. A misconfigured notification channel would mean alerts are generated but not delivered; the question states 'no alerts are triggered' at all.
- C. If the cloud account wasn't onboarded, Prisma Cloud wouldn't even 'see' the S3 buckets, so the problem would be more fundamental than just alerts not triggering for an existing misconfiguration.
Prisma Cloud Policy Group Schedules
Policy groups in Prisma Cloud can be assigned schedules that dictate when the policies within that group are evaluated against cloud resources, determining when alerts might be generated.
- Policies must be in an active policy group to run.
- Schedules define the frequency of policy evaluation.
- No schedule means no policy evaluation, no alerts.
Memory trick: Even a perfect policy needs a 'start' button to run.