Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Prisma Cloud PlatformMedium
A security administrator is setting up custom roles in Prisma Cloud Enterprise. They need to create a role that can view all security policies and alerts, but cannot modify any policies or dismiss alerts. Additionally, this role should be able to view all asset inventory details but not initiate any remediation actions. Which combination of permissions should be assigned to this custom role?
- APolicy: Read, Alert: Manage, Asset: Read, Remediation: None
- BPolicy: Manage, Alert: Read, Asset: Manage, Remediation: Execute
- CPolicy: View, Alert: View, Asset: View, Remediation: Execute
- DPolicy: Read, Alert: Read, Asset: Read, Remediation: None
Show answer & explanationAnswer & explanation
Correct answer: D. Policy: Read, Alert: Read, Asset: Read, Remediation: None
The requirement is to only view policies, alerts, and assets, without modification or action capabilities. 'Read' permissions allow viewing, while 'Manage' or 'Execute' would grant modification or action rights. Therefore, 'Policy: Read', 'Alert: Read', 'Asset: Read', and 'Remediation: None' is the correct combination.
Why the other options are wrong
- A. Assigning 'Alert: Manage' violates the requirement that the role cannot dismiss alerts, as 'Manage' typically includes dismissal.
- B. Assigning 'Policy: Manage' and 'Asset: Manage' violates the read-only requirement for policies and assets, and 'Remediation: Execute' is also incorrect.
- C. Assigning 'Remediation: Execute' violates the requirement that the role should not initiate remediation actions.
Prisma Cloud Custom RBAC Roles
Allows administrators to define granular permissions for users and groups within Prisma Cloud, controlling access to specific features and data based on job function.
- Enforces least privilege principle.
- Permissions categorized by feature (e.g., Policy, Alert, Asset).
- Can combine read, write, manage, execute permissions.
Memory trick: Give roles just enough power, like a key that only opens specific doors.