Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Prisma Cloud PlatformHard
A cloud security team is tasked with onboarding new cloud accounts into Prisma Cloud Enterprise. To ensure consistent security posture management and immediate detection of misconfigurations, they need to apply a standard set of policies and enable real-time scanning as soon as an account is connected. Which Prisma Cloud feature allows for the automatic assignment of policies and enforcement of scanning upon new account onboarding?
- AManual policy assignment via the Resource Explorer.
- BCustom RBAC roles for account onboarding.
- CAPI-driven policy application after onboarding.
- DDefault policy groups associated with new account profiles.
Show answer & explanationAnswer & explanation
Correct answer: D. Default policy groups associated with new account profiles.
Prisma Cloud allows administrators to define default policy groups that are automatically applied to new cloud accounts when they are onboarded. This ensures immediate application of a standard policy set and enables real-time scanning without manual intervention.
Why the other options are wrong
- A. Manual policy assignment via Resource Explorer is a reactive task and does not provide the 'automatic' and 'immediate' enforcement required.
- B. Custom RBAC roles control user permissions, not the automatic application of policies to new cloud accounts.
- C. While API-driven policy application is possible, it requires an external automation script to run post-onboarding, whereas default policy groups offer a native, built-in automation for this purpose.
Prisma Cloud Default Policy Groups
Configurable policy groups in Prisma Cloud that are automatically assigned to newly onboarded cloud accounts, ensuring a baseline security posture and immediate policy enforcement.
- Automates policy application for new accounts.
- Ensures consistent security baseline.
- Reduces manual overhead during onboarding.
Memory trick: To secure new clouds instantly, use the 'default' setup.