Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Hard
A development team is using Prisma Cloud's Image Security to scan their container images. They notice that an image built on an older base OS image consistently fails compliance checks due to outdated packages, even after applying all available OS patches. The team wants to ensure that this specific image, despite its compliance failures, is still permitted to be deployed to a staging environment, but with a clear audit trail. Which Prisma Cloud feature allows for this exception management?
- AVulnerability Exploitability Score
- BException Policies
- CGlobal Policies
- DCustom Compliance Rules
Show answer & explanationAnswer & explanation
Correct answer: B. Exception Policies
Exception Policies in Prisma Cloud allow specific rules or policies to be bypassed for designated resources (like a particular image or image tag) under controlled conditions. This enables flexibility for specific operational needs while maintaining an audit trail of the exception.
Why the other options are wrong
- A. Vulnerability Exploitability Score is a metric for risk, not a mechanism for policy exception management.
- C. Global Policies apply broadly and don't allow for specific, audited exceptions.
- D. Custom Compliance Rules define new checks, not bypass existing ones for specific cases.
Prisma Cloud Exception Policies
A feature that allows administrators to define controlled and auditable bypasses for specific security policies or compliance rules for designated resources.
- Permits deviations from standard policies.
- Requires explicit definition and approval.
- Maintains an audit trail of all exceptions.
Memory trick: When the policy is too rigid, an exception can bridge the gap.