Palo Alto Networks Certified Cloud Security Engineer (PCCSE)Cloud Workload Protection Platform (CWPP)Hard
A security engineer is investigating an alert from Prisma Cloud indicating unusual outbound network traffic from a critical container in a Kubernetes cluster. The container is part of a payment processing application and should only communicate with a specific database and an external payment gateway. The engineer needs to quickly determine the exact process originating the suspicious connection and its full command-line arguments. Which Prisma Cloud capability provides the most detailed information for this type of runtime incident response?
- AServerless Security Logs
- BHost Vulnerability Report
- CContainer Runtime Forensics
- DImage Assurance Scan Results
Show answer & explanationAnswer & explanation
Correct answer: C. Container Runtime Forensics
Prisma Cloud's Container Runtime Forensics provides deep visibility into runtime events, including process execution, network connections, and file system changes, enabling security teams to reconstruct an attack timeline and identify the root cause of incidents like suspicious outbound traffic.
Why the other options are wrong
- A. Serverless Security Logs are for serverless functions, not containerized applications.
- B. Host Vulnerability Report focuses on the underlying host, not specific container processes or network connections.
- D. Image Assurance Scan Results are pre-deployment and won't show runtime activity.
Prisma Cloud Container Runtime Forensics
Captures and analyzes detailed runtime events within containers, including process activity, network connections, and file changes, to aid in incident investigation.
- Provides a historical record of container behavior.
- Helps identify malicious activity and root causes.
- Essential for post-incident analysis and threat hunting.
Memory trick: When a container screams 'alert!', forensics pieces together the 'who, what, where'.